TWI465128B - Method, system of server authentication, and a computer-readable medium - Google Patents

Description

Server authentication method, system and a computer readable medium

The present invention is a server authentication method and system, and in particular, an authentication method and system for accessing a specific server or a specific purpose by using a verification code generated by a third-party authentication mechanism.

The password you need to type when logging in to a specific device is one of the means used to prevent others from stealing information. The traditional password is fixed. When it is stolen, the stolen person can use the information of others to create a network. The problem of security, and thus the prior art, develops a technique for generating dynamic passwords of different passwords per authentication.

Such a dynamic password is, for example, a one-time password (OTP). When such a dynamic password mechanism is activated, the password obtained by the user is generated by a specific algorithm, and is valid only once, and the reference variable has the current time. , the number of times or the input content, etc., these can be used as the seed of the dynamic password. After inputting the algorithm, the result is obtained and converted into a password. Since this value is generated according to the changed information, the password generated each time. It is different, even if it is known, it will be invalidated only once, so it can achieve the purpose of safety certification.

According to one of the techniques for generating a dynamic password, a dynamic cryptographic key having a display screen, called a Token device, is embedded in the Token device, and a cryptographic generator according to a specific algorithm can be provided by the certification unit. The timing circuit has been initialized with the Token device and synchronized with the authenticated server. When the user logs in to a specific server, the login screen of the server will ask the Token device to generate it based on the timing circuit. The information generates a dynamic password, and the user fills in the dynamic password to complete the login.

The network architecture for generating a dynamic password can be referred to the schematic diagram shown in FIG. 1. The dynamic cipher key 102 shown at the user end can be the aforementioned Token device, which carries an algorithm for generating dynamic ciphers, and It is consistent with the algorithm of the authentication management server 104 that provides authentication, and can set a mechanism for synchronously generating a password, and the authentication management server 104 carries the hardware information of the dynamic password key 102 held by each user, and the generated The timing is matched as a seed generated by the password.

The figure shows that the user connects to the network server 103 through the user computer 101. When the connection is made, the network server 103, once the login request is obtained, the back end or the associated authentication management server 104 will The dynamic password is generated according to the calculation code and the corresponding dynamic password key 102. At the same time, the dynamic password key 102 also generates the password synchronously, for example, once every minute, so that the user can use the one-time password displayed by the dynamic password key 102 via the user computer. 101 logs into the web server 103. The network server 103 will obtain the authenticated data by the authentication management server 104, and thereby determine whether the login is successful.

Other one-time password mechanisms, such as a SMS password, that is, the server cooperates with the telecom operator. When the user logs in to a specific server, the server first obtains the login data, and cooperates with the carrier (or the certification provider) to send the password to the user. After the user fills in the SMS password, the login is completed.

In order to provide a mechanism for multiple identity authentication, the present invention provides a server authentication method and system, and a program instruction that executes an authentication method is provided. The computer can read the media. According to the description of the embodiments of the present invention, the authentication method uses a third-party authentication mechanism to achieve a high-security identity authentication method, wherein the user-held mobile communication device generates a verification code, and then the user is authenticated by the authentication mechanism to achieve Server login purpose.

According to an embodiment of the invention, the proposed server authentication method is particularly suitable for an identity authentication system installed on a network, which can carry a network servo module and an authentication servo module, a network servo module and authentication. The servo module can be set under the same identity authentication system, and in a specific implementation, it can be a network server and an authentication server set in different locations, and the authentication server can be a third party. A server that provides authentication and operates independently.

According to an embodiment, the server authentication method is applicable to an authentication system including a network servo module and an authentication servo module, and the method steps include receiving, by the network servo module, access from the terminal to the server end, including login, any Accessing the behavior message to perform an access procedure; then, the authentication server module will obtain the authentication data retrieved by the access message to generate an authentication message transmitted to the mobile communication device corresponding to the message. In particular, it is transmitted over the network in a push-type manner.

After transmitting the authentication message to the mobile communication device, the authentication servo module receives a verification code generated by the mobile communication device, and the verification code is generated according to the authentication message and the personalized information contained in the mobile communication device.

After the verified servo module confirms the verification code to the network servo module, the authentication procedure corresponding to the access program can be completed.

The verification code is generated according to the information in the access procedure, and the step of generating the verification code is a software program carried in the mobile communication device after the mobile communication device receives the authentication message transmitted from the authentication servo module. The content of the authentication message is parsed to determine the same board as the content of the authentication message, and then the software program can smoothly retrieve the information according to the model that is judged, as the basis for generating the verification code.

According to another embodiment of the authentication method, when the login program starts, the user wants to log in to a server through the computer device, such as a network servo module in the authentication system, and the network servo module is responsible for processing the first identity authentication. Programs, such as user accounts and passwords entered through the web login interface. After receiving the login authentication data of the user on the computer device via the network servo module, the network servo module transmits the login authentication data to the authentication server module for processing the second identity authentication program.

At this time, the authentication servo module will generate an authentication information notification (notification) and transmit it to the mobile communication device held by the user. When the mobile communication device receives the authentication information notification, the pre-loaded seed value is taken out ( Seed), the verification code is generated by the operation, and then the network servo module and the authentication servo module in the system will confirm whether to allow the user to log in to the network servo module by using the computer device according to the verification code.

According to an embodiment, the initial seed value used to generate the verification password is a personalized value generated by the authentication server module to obtain personalized information provided by the user between the execution of the method, because the device held between the users There will be differences from the information provided, so the resulting values are also proprietary information. Here, personalized information such as hardware information of the mobile communication device, information provided by the user, or communication information of the near field communication circuit of the mobile communication device can be used as personalized information. The resulting seed value is then passed to the mobile communication device for storage in memory.

According to still another embodiment, after the mobile communication device generates the verification code according to the seed value, the user can fill in the verification code to log in to the network servo. After the network server module and the authentication servo module confirm the identity on the interface of the module, the login procedure can be completed. In another embodiment, when the mobile communication device generates the verification code according to the seed value, it can be directly transmitted to the authentication servo module, and the authentication servo module and the network servo module confirm the user identity according to the verification code to complete the login. program.

According to the example set forth in the embodiment, if the mobile communication device supports near-field communication (NFC), the personalized information provided above may be the communication information of the near field communication circuit. When the mobile communication device receives the authentication information notification sent by the authentication servo module, the communication information of the near field communication circuit in the mobile communication device can be used to open the seed value to calculate the verification code. For example, if the user holds a near field authentication vehicle for near field communication, the near field communication information generated by the proximity communication device will be used to obtain authorization and open the preloaded value.

In the embodiment, the identity authentication system of the server login system mainly includes a network servo module and an authentication servo module which are disposed on two different servers or in one system. The network servo module receives one or more users through the network to perform a first identity authentication process, such as a way for a user to log in to the server through a webpage; the authentication servo module performs a second identity authentication procedure. When receiving the authentication request of the user, a notification is transmitted to the mobile communication device held by each user, and the verification code generated by the mobile communication device of the user end can be directly obtained for identity authentication; or the network servo can be obtained. The module receives the verification code generated by the mobile communication device and confirms the identity of the user.

The invention further provides a computer readable medium, wherein the program set is executed in the foregoing mobile communication device for performing identity authentication of the server login, and the program set includes the authentication provided in the identity authentication system. The program command of the servo module, the program command for receiving the authentication information notification generated by the authentication servo module, the program command for executing the near field communication program, the program command for obtaining a value recorded in the mobile communication device, and the verification code according to the seed value The program instructions, the program instructions for displaying the verification code, and the program instructions for transmitting the verification code to the authentication servo module.

The authentication system proposed by the present invention can be used to log in the authentication requirements of a specific server, and can also be applied to any authentication requirements for processing access through the network, such as online transactions, online banking, etc., when the user completes the access procedure, The certification system will provide a secure and cost-effective authentication mechanism.

The server authentication system provides an authentication server. In an embodiment, the authentication server provides a third-party authentication mechanism to replace a network server (such as a game server or online banking) that is directly logged in by the user. Mechanism (this can be called the first identity authentication procedure), that is, through the authentication server, it is responsible for authenticating the identity of the user entering the network server (this is the second identity authentication program that assists the first identity authentication program), and then authenticating the server. The server provides the authentication result to the web server as the basis for the success of the login.

According to one of the embodiments of the present invention, the server authentication system specifically uses the mobile communication device held by the user as one of the means for authentication, and the mobile communication device has at least a network connection, or is further configured in an embodiment. There are related circuit modules for Near Field Communication (NFC). Among them, the network connection is used to obtain the connection with the authentication server, and the relevant authentication file is transmitted, and the near field communication system is used for the near field communication connection with the computer system of the user end, and the login network servo is confirmed by this method. The user of the device is indeed the user of the computer.

For an embodiment, refer to the network architecture of the server authentication of the present invention shown in FIG. 2. One of the schematics.

This example shows a user computer 201 including a user terminal. The type of the computer 201 is not limited to that shown in the drawing, and can be any computer device that allows login to a specific network server 203. The user must have a mobile communication device 202, which is a necessary means for performing the authentication method shown in the embodiment of the present invention, and can be a smart phone, a tablet computer, or other electronic device having a communication function.

The figure shows an authentication system 20, which mainly includes a network server 203 and an authentication server 204. The network server 203 can be a server that provides a user login service, such as a game server or an online banking server. The server, the enterprise server, or other servers that require security authentication in particular, the server authentication method and system provided by the present invention can be applied because the data accessed by the user has security requirements.

An authentication server 204 is connected to the network server. The authentication server 204 mainly provides the user with two-factor authentication in addition to the first identity authentication program provided by the general login screen when logging in to the network server 203. The second identity authentication program.

According to the embodiment of the invention, the authentication server 204 can provide an authentication, independent operation server for the third party, so that the network server 203 of the plurality of front ends can be simultaneously served by a similar authentication mechanism.

In another embodiment, the network server 203 and the authentication server 204 may be two servos respectively disposed in different positions, and may be two servo modules disposed in the same system (20). Groups, such as network servo modules and authentication servo modules implemented by software or hardware, and two servo modules handle different jobs. The network servo module can receive one or more users through the network to perform the first identity through the computer device (such as the user computer 201) The authentication program, such as the account number, password or login screen of the relevant authentication technology provided by the webpage; the authentication servo module executes the second identity authentication procedure, and when receiving the authentication request of the user, it will be generated for each user. A notification transmitted by the mobile communication device, such as a notification of the mobile device, and the verification code generated by the mobile communication device 202 is received directly or through the network servo module to confirm the identity of the user. The verification code used here can be a plurality of types of verification codes, such as one-time password (OTP).

Furthermore, the authentication method proposed by the present invention is not limited to login information when logging in to a specific server, such as identity authentication data, but can be applied to execute a specific access procedure, such as the aforementioned web server 203 providing online shopping. When the user performs the online transaction, some necessary personal information is also transmitted, and the information is forwarded (or with some type of data) to the authentication server 204 via the web server 203, and the authentication server 204 is The user's mobile communication device 202 transmits an authentication message, and then uses the verification code (e.g., a one-time password) generated by the device 202 to confirm that the transaction was performed by the user.

For example, in the application of the online banking, the network server 203 can be a virtual banking server provided by a specific bank, and can also be used when the user wants to perform an access service such as a financial transaction, a credit card, or a financial product. According to the authentication method provided by the present invention, the authentication server 204 performs verification code authentication on the mobile communication device 202, and the authentication success indicates that the information contained in the exchanged verification code is correct, and the operation of the online banking can be successfully completed.

For another embodiment, reference may be made to the system architecture of the server authentication of the present invention shown in FIG. In this example, the mobile communication device 30 is provided on the user side, and the network server 3 and the authentication server 303 are connected through the network 3.

In this example, the user terminal can only provide the mobile communication device 30 that can receive the push message, and the software (such as the APP or the software package) carried by the mobile communication device 30 generates a verification code according to the pushed message. The verification code can be generated by using the seed generated by the initial process as shown in Figure 4 to generate the transaction information, or the content of the transaction information, personal information and initial process registration. This is generated mainly by using the dynamically generated verification code to confirm that the transaction is executed by the correct user.

For example, the user uses the mobile communication device 30 to connect to the network server 301 to log in to the server. The user can perform login through a specific software interface, and the network server 301 receives the relevant login information and forwards it to the server. The authentication server 303, the authentication server 303 carries registration information of the user, such as some basic data, information of the mobile communication device 30 (such as a phone number, International Mobile Equipment Identity (IMEI), etc.) ).

The authentication server 303 then transmits the verification message to the mobile communication device 30 registered by the user according to the registration information (database), and the verification code is generated by the mobile communication device 30, and the user continues to complete the previously logged in program with this verification code. When the verification code is generated, the user can continue to fill in the verification code through the login interface, or directly return it to the authentication server 303, and the authentication server 303 confirms the access procedure, that is, the network server 301 obtains A successful notification of the authentication, allowing the user to complete the login.

The premise of the above procedure for generating a verification code by the mobile communication device is that the user data is registered in advance on the authentication server, and the authentication server will generate a future based on the registration data (such as personal basic data, verification data, device information, etc.). The seed value of the verification code is generated, and the process of generating the value of the authentication system of the present invention can be implemented by referring to the process shown in FIG. example.

Before using the identity authentication mechanism provided by the present invention, the user should first become a registered user. The user preferably installs a software program that executes the authentication method, such as a mobile phone application, on the personal mobile communication device. Program (APP), this software program will directly correspond to the relevant authentication server, or the authentication server module in a specific server. Users can register a set of authentication materials, such as user accounts or passwords, from the beginning, and do not exclude other login authentication possibilities.

At the time of registration, the relevant authentication server will require the user to transmit personalized information, such as hardware information of the mobile communication device used by the user, such as hardware number, network hardware information, etc., and may also be a mobile communication device. The communication data of the supported near field communication (NFC) circuit; the personalized information does not exclude the information provided by other users, such as a set of pin code set by the user, one of these personalized information or Combinations can be a source of information that produces a seed.

After the authentication server obtains the personalized information (step S401), a value generating program (step S403) is executed, for example, a value generating expression is executed by the program, and such a method is known to those skilled in the art to which the present invention pertains. It is not limited to a specific method, and is mainly provided by the system side, and the purpose is to generate a personalized value based on the personalized information calculation, so that each user can obtain a unique and special seed value (step S405).

It is worth mentioning that the parameters introduced by the generation of the values here are personalized information, wherein the combination of parameters used can be the user-entered authentication code plus the near field communication information, or the authentication code plus The hardware information of the mobile communication device, or the hardware information of the mobile communication device plus the information of the near field communication. The information on the near field communication proposed here can be mobile communication. Information generated by the combination of the near field communication module in the device and another external near field authentication vehicle. These parameters that produce seed values can then be used as information necessary to extract the seed values.

The seed value generated by the initial registration procedure can be transmitted to the corresponding mobile communication device (step S407), and the seed value is stored in the memory in the mobile communication device (step S409). Such values should be effectively protected, such as encryption, as they relate to personal identity authentication information. Therefore, the personalized information provided by the user can be used to decrypt such a value. For example, the authentication code should be input before the seed value is turned on, or it can be approximated by a near field authentication vehicle (such as NFC card, dongle). After successfully connecting, the mobile communication device can decrypt the seed value according to the exchanged communication information. For example, the user holds the near-field authentication vehicle close to the pre-set paired mobile communication device, exchanges the communication information with the near field communication technology within a short distance, and can confirm whether it is the preset information according to the exchanged communication information, to confirm A program that can perform seed value decryption.

First embodiment:

5 is a flow chart showing the server authentication method of the present invention. In this example, the flow covers the program between the mobile communication device 51, the user computer 52, the network server 53, and the authentication server 54.

At the beginning of the step, as shown in step 501, the user computer 52 logs into the web server 53 according to the user's operation, and the purpose is to perform a login procedure, so that the login process of the first identity authentication program is filled in with the relevant identity. Certified information, such as user accounts, passwords, or other information that identifies the user, does not exclude other ways in which biometrics may be used.

After obtaining the user's authentication data via the web server 53, the data Passed to the authentication server 54, as in step 502, the identity of the secondary registrant is confirmed by the authentication server 54. At this time, the state of the network server 53 is the result of waiting for the second identity authentication program by the authentication server 54 to confirm the login authority.

Next, the authentication server 54 will execute the second identity authentication procedure to generate a notification such as push to the user-side mobile communication device 51. As shown in step 503, the authentication server 54 transmits the authentication message to the mobile communication device. 51. The method of pushing a message described here is generally forwarded by a server of a specific system operator, and the server sends a message to the object (such as a mobile phone number) provided by the system.

After receiving the notification by the mobile communication device 51, the user will operate the mobile communication device 51 to generate a verification code generated according to the information in the login program. In step 504, the user is provided to the user computer 52 for use. The verification code is generated by the mobile communication device 51 according to a preloaded seed value and an information operation corresponding to the secondary login program. The manner in which the seed value is generated can be referred to the flow of FIG. The extraction of the seed value may be as in the foregoing embodiment, including the user filling in the pin code to decrypt the seed value, or using the near field communication circuit to complete the communication number to perform the decryption, in order to obtain the user itself. Kind of value.

Thereafter, according to the embodiment shown in step 505, the user logs into the web server 53 using the verification code displayed on the mobile communication device 51, such as opening a window requesting that the verification code be filled in for a limited time. Since the authentication server 54 has already loaded the information of such a value when the user registers or initializes, refer to the flow of FIG. 4, so the authentication server 54 can confirm the verification code generated at this time, as in step 506, the network After the route server 53 is obtained, it is delivered to the authentication server 54 to confirm the verification code input by the user.

After being confirmed by the authentication server 54, as shown in step 507, the confirmation information is transmitted to the network server 53, and the network server 53 notifies the user that the login is successful, as in step 508.

If another embodiment is taken as an example, the verification code generated by the mobile communication device 51 will be transmitted to the authentication server 54, and after the authentication server 54 confirms the verification code to the network server 53, the network server 45 The user will be allowed to complete the login procedure with the user computer 52.

Second embodiment:

6 shows a second flowchart of the server authentication method of the present invention. This example also achieves identity authentication through authentication messages between the mobile communication device 51, the user computer 52, the network server 53, and the authentication server 54. purpose.

In the steps 601, 602, and 603, the user also logs in to the network server 53 through the user computer 52, and the related authentication information is transmitted from the network server 53 to the authentication server 54, and the authentication server 54 generates a push broadcast. The message to the mobile communication device 51.

Next, the mobile communication device 51 will take out the seed value contained therein, and if necessary, perform a decoding step in the flow as described above with reference to FIG. 5 to obtain an encrypted protected seed value, the purpose of which is to generate a verification code by operation. In this case, in particular, the verification code generated by the mobile communication device 51 will be passed directly to the authentication server 54, as in step 604, instead of filling in the login screen provided by the network server 53 as shown in FIG.

The verification code can be transmitted in a string or encoded code during transmission. Since the user has registered the value or related authentication information on the authentication server 54 after registration using the method of the present invention, The authentication server 54 can directly authenticate the verification received from the mobile communication device 51. After the code is confirmed, in step 605, the authentication server 54 confirms the identity of the user, and then confirms the authentication data with the network server 53. In step 606, the network server 53 notifies the user that the login is successful.

In this example, the authentication server 54 directly authenticates the verification code generated by the mobile communication device 51, so that it is not necessary to display the password on the display of the mobile communication device 51, and the user does not need to fill in the login screen, thereby avoiding additional possibility. The mistakes and troubles.

The flow shown in FIG. 7 is an embodiment of the server authentication method of the present invention, in particular, an authentication process designed between the mobile communication device 71, the network servo module 72, and the authentication servo module 73.

This example shows the authentication procedure executed by the mobile communication device 71 and the network servo module 72 and the authentication servo module 73. The network servo module 72 and the authentication servo module 73 can be two modules in one servo host. Or two servo programs respectively set on different servo hosts, and the network servo module 72 and the authentication servo module 73 can be connected in a network or any data transmission mode.

When the user uses the mobile communication device 71 to access the content provided by the network servo module 72, in step 701, an access message is sent to the network servo module 72, and the purpose of the access message is to perform an access. The program, the access message includes a message that the user performs a specific access service through the mobile communication device 71, such as a user account, a password, a server profile, a web service content, etc., and the behavior of the access program is such as logging in to a specific website and executing a transaction. Wait. The network server module 72 will then retrieve the authentication data according to the access message, such as authentication data (such as an account number and password) transmitted by the user through the mobile communication device 71, and then transmit the authentication data to the authentication server module 73. In step 702, the authentication servo module 73 obtains corresponding correspondence according to the data comparison. User information, including communication information of the mobile communication device 71.

In step 703, the authentication server 63 generates an authentication message corresponding to the source (the mobile communication device 71 and the user), and transmits the authentication message to the mobile communication device 71. The transmission mode can be transmitted via the network in a particularly pushable manner. When the mobile communication device 71 receives the authentication message transmitted by the authentication server module 73, the message is received by the software program carried by the mobile communication device 71 corresponding to the information originally accessed by the program, and a verification code is generated accordingly. The generation of the verification code is generated in addition to the message transmitted by the authentication server module 73, and the authentication value (such as time and network address) in the access program can be matched according to the value generated by the initialization as shown in FIG. ) is generated by an algorithm.

Next, the mobile communication device 71 transmits the verification code to the authentication servo module 73. In step 704, the authentication is performed by the authentication servo module 73, that is, the authentication servo module 73 can have the same requirement as the mobile communication device 71 generates the verification code. The information includes the generated calculation method, so that it can be judged whether the verification code is correct, and the information of the confirmation verification code is transmitted to the network servo module 72. In step 705, after the verification code is confirmed, the authentication corresponding to the access message is completed. The program confirms that the access procedure is performed by an authorized user, and then the network servo module 72 notifies the mobile communication device 71 to allow access (step 706). After the authentication servo module 73 confirms the verification code to the network servo module 72, the authentication procedure corresponding to the secondary access procedure is completed.

The functional block diagram shown in Figure 8 depicts an embodiment of the server authentication system of the present invention, wherein the authentication procedure can refer to the main flow depicted in Figure 10 at the same time.

The network servo module 801 and the authentication servo module 802 included in the authentication system 80 respectively process the login request and the second authentication. program of. The user terminal can connect the authentication system 80 to the computer device 81 to execute the first identity authentication procedure. Next, the system will require the client mobile communication device 82 to generate a personalized verification code to provide a more secure authentication mechanism.

According to an embodiment, the computer device 81 of the user end is a general desktop computer, a notebook computer, a tablet computer, or other electronic device having functions such as surfing the Internet and opening a webpage, and at least a network unit 811 is provided to allow the computer device 81 to pass through. The network is connected to the network servo module 801 of the authentication system 80. The network servo module 801 is a system-side software module for providing user-specific services, or a specific server, such as a game server, an online banking server, or the like. The computer device 81 is provided with a login interface unit 813 connected to the login interface provided by the network servo module 801. The actual implementation is, for example, a web browser or a specific software, and provides an input unit 815 for the user to input the login authentication data. For example, the user can perform input through a keyboard, a mouse, a software interface, a touch display, and the like.

When the user inputs the login authentication data, such as an account number, a password or other information for identity authentication, through the input unit 815, the data can be transmitted to the network servo module 801 via the login interface unit 813. At this time, referring to step S901 of FIG. 10, the network servo module 801 receives the login authentication data generated by the user using the computer device 81.

Then, through the processing of the authentication system 80, in step S903, the authentication servo module 802 will obtain the authentication data, for example, the identity of the user, so that the object to be transmitted can be obtained according to the registration data of the user. According to one of the embodiments, those skilled in the relevant art of the present invention may know that the authentication system 80 end should be provided with a database (not shown in the figure), and the database records that the user is registered or updated in the future, and is logged in. Certification Information, including hardware information, user-set data, or communication information generated by near-field communication circuits, or near-field authentication vehicles, for mobile communication devices that participate in authentication for each user (account, password, or biometric information) The communication information contained in 83, etc., also records the kind of value generated by this. Therefore, the authentication authentication module 802 as the identity authentication can obtain the contact information according to the user authentication data obtained by the network servo module 801, in particular, the mobile communication device 82 registered at the time of registration. Therefore, when the user sends a login request, the authentication server module 802 generates a notification of the authentication information. In step S905, the authentication information notification is transmitted through the network. In step S907, in particular, the technique of pushing the broadcast. The data is passed to the mobile communication device 82.

In this example, the mobile communication device 82 has a communication unit 821 that is connected to the authentication servo module 802, and further includes an operating system program that records the type of value or the device 82 is required to operate, and a program that executes the authentication method of the present invention. Memory unit 823.

The authentication server module 802 can notify the user of the login request through the first identity authentication program executed by the network servo module 801, that is, the authentication information notification is transmitted through the network. When the mobile communication device 82 receives the notification, the mobile communication device 82 can receive the notification. The operation unit 831 is operated to start the software program corresponding to the identity authentication of the present invention, and the memory unit 823 obtains the seed value, and then the verification code generation unit 825 calculates the verification code according to the seed value calculation, such as step S909, and then transmits the display unit. 827 is shown, or in the embodiment shown in FIG. 6, the password is transmitted directly to the authentication servo module 802 without being displayed on the terminal device.

In an embodiment, the seed value may be protected in the memory unit 823 by any encrypted form, so the aforementioned software program may be configured according to the user. The input authentication code decrypts the seed value; or according to the foregoing embodiment, the near field communication unit 829 in the mobile communication device 82 and the external near field authentication carrier 83 reach a near field communication connection, wherein when the near field is used The authentication carrier 83 is in proximity to the mobile communication device 82, and can activate a near field communication circuit such as the near field communication unit 829, and exchanges the communication information contained in the near field authentication vehicle 83 to confirm the opening of the seed value, including decrypting the seed value.

Therefore, after the verification code is obtained by the mobile communication device 82, it can be directly transmitted to the authentication servo module 802 on the system side, or the verification code can still be filled through the login screen, and then the network servo module 801 and the authentication servo module 802. The user identity is confirmed (step S911) to complete the login process (step S913).

It is worth mentioning that, in order to apply the identity authentication technology proposed by the present invention, the applied mobile communication device should carry an application provided by the system, such as an application (APP) contained in a smart phone or a tablet. The application is used to obtain the information pushed by the system, decrypt the seed value, provide the interface for inputting the authentication code, the program for generating the verification code based on the value, and the communication function for displaying or transmitting the verification code. Start when you get a push message, or you need to start it before you perform authentication.

In another embodiment, an authentication system formed by the authentication system 9 is connected by the mobile communication device 91 as shown in FIG.

This example shows that the user directly operates the mobile communication device 91 to access a specific website, such as a web server provided by the network servo module 901 provided in a specific server. In addition to the network servo module 901, the authentication system 9 provided in this example further has an authentication server module 902 that provides the authentication mechanism of the present invention.

In the mobile communication device 91, including providing keyboard input and voice input The input unit 911 for functions such as input, touch input, and gesture input displays the interactive interface with the authentication system 9 through the display unit 912, and in particular, executes a software program to execute the access program and the authentication program. The memory unit 914 is used to store the operating program and software program necessary for the operation of the mobile communication device 91. When the device is started, the processor (not shown) executes the necessary program acquired by the memory unit 914.

The mobile communication device 91 is connected to the authentication system 9 via the communication unit 915 to transmit information, including receiving the pushed message through the network and transmitting the data content related to the authentication. The interface unit 916 is a user interface for providing an access command and a display screen, such as a general purpose web browser and a specific purpose programming interface.

When the user performs some access purpose through the network communication module 901 through the mobile communication device 91, the authentication step described in the flow shown in FIG. 11 can be referred to. At the beginning, in step S111, the network servo module 901 receives the access. An access request from the mobile communication device 91 is received, and the authentication material related to the user is received.

After the network server module 901 receives the access request, the related data is forwarded to the authentication server module 902, and the authentication server module 902 obtains the data related to the user according to the authentication data, including the registered mobile communication device. 91. Therefore, the authentication message to be transmitted can be generated accordingly (step S113), for example, by using the network to transmit the push information, and notifying the mobile communication device 91 of the message corresponding to the access procedure, as by step S115.

When the user obtains the authentication message from the mobile communication device 91, the information of the access program can be obtained therefrom to ensure the authentication step of the access program. According to the embodiment, the message transmitted through the push can be used. User information filled in when registering for service, hardware of mobile communication device 91 Information, information about the access (such as information related to online transactions, amount, time, etc.), etc., information about the access procedure.

The foregoing authentication message can be received by the software program carried by the mobile communication device 91, and can be triggered (automatically or by the user) to generate a verification code, and the verification code can be generated according to the information at the time of initialization and the current access information, such as Values, time, etc., these parameters are based on the needs of the algorithm generated by the verification code, and synchronization results in the authentication servo module 902 will also produce consistent results. Next, the mobile communication device 91 transmits the verification code to the authentication servo module 902. In step S117, the authentication servo module 902 verifies whether the received verification code conforms to the verification code of the access.

After the authentication by the authentication server module 902 is successful, the network servo module 901 that notifies the providing access service allows the user to access, including logging in to the server, successfully transacting, or confirming that the message is correct (step S119).

The above verification code generation methods may be various, but it is not excluded that the information is generated according to the information in the access program and various personalized information recorded when the user logs in to the system. Therefore, such a variation may occur over time. The verification code is valid for this time in a specific short time. The software program installed on the mobile communication device will obtain the information used to generate the verification code according to the authentication message transmitted by the authentication server or the authentication server module, and the information may be time, transaction information, user information or It is one or a combination of the information provided by the authentication servo module.

Moreover, the server authentication system and method provided by the present invention are applicable to the security authentication requirements of various network services, and various network services have corresponding information, such as when the authentication server module (or the server) obtains one. When the request is authenticated, the user data for executing the access procedure is obtained based on the information comparison, and the network service also has its particularity, so when transmitting ( When the authentication message is sent to the mobile communication device, the message contained will conform to the characteristics of the network service. Accordingly, according to an embodiment of the present invention, the software program contained in the mobile communication device should be provided with a plurality of templates, which can obtain important information according to the analysis result, and thus the information can be used to generate a verification code.

As shown in FIG. 12, in step S11, the mobile communication device receives the authentication message transmitted from the authentication server module, such as the message received immediately by the push mode when performing the specific access service. Then, the software program will parse the content. In step S12, it is determined which template the content contained in the message conforms to. In step S13, the information in the template can be correctly retrieved according to the determined template, as in step S14.

For example, if the access service is a specific network transaction, the received authentication message should contain relevant information about the online transaction, such as the product name, amount, transaction time, personal information, etc. Some information is matched with the template that should be used. After parsing, it can be used to judge the attributes of the message.

Then, the verification code is generated by the software program combining the information about the access service and the seed value contained in the memory in the mobile communication device (step S15), as shown in step S16. This verification code is unique and time-sensitive because it combines the personalized information registered by the user at the time of initialization (the application of the near field communication is not excluded) and the information of the access service. It is suitable as the access service. The purpose of certification.

The present invention relates to a computer readable medium, wherein the program set is executed in the foregoing mobile communication device for executing a server authentication method, and the program mainly includes one of the authentication systems provided in the present invention. After executing the program command of the authentication servo module, receiving the program command of the authentication information notification generated by the authentication servo module, and receiving the notification of the authentication information, the near field is executed. After the program command of the communication program and the completion of the near field communication program, the program command recorded in the mobile communication device can be obtained, the program command for generating the verification code according to the seed value, and the program command for displaying the verification code, and the transmission can be included. Verification code to the program command of the authentication servo module on the system side.

In summary, the server authentication method and system and the computer readable medium proposed by the present invention mainly provide a mechanism for secure authentication, and particularly provide an authentication server other than the network server to be logged in. The authentication mechanism provided by the third party allows the user to provide a secure server authentication program using the verification code dynamically generated by the handheld mobile communication device.

However, the above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Therefore, equivalent structural changes that are made by using the specification and the contents of the present invention are equally included in the present invention. Within the scope, it is combined with Chen Ming.

101‧‧‧User computer

102‧‧‧Dynamic password key

103‧‧‧Web server

104‧‧‧Certificate Management Server

201‧‧‧User computer

202‧‧‧Mobile communication device

203‧‧‧Web server

204‧‧‧Authentication server

20‧‧‧Certification system

30‧‧‧Mobile communication devices

3‧‧‧Network

301‧‧‧Web server

303‧‧‧Authenticated server

51‧‧‧Mobile communication devices

52‧‧‧User computer

53‧‧‧Web server

54‧‧‧Authentication Server

71‧‧‧Mobile communication devices

72‧‧‧Network Servo Module

73‧‧‧Certified Servo Module

80‧‧‧Authorization System

801‧‧‧Network Servo Module

802‧‧‧ certified servo module

81‧‧‧Computer equipment

811‧‧‧Network Unit

813‧‧‧ Login interface unit

815‧‧‧ input unit

82‧‧‧Mobile communication device

821‧‧‧Communication unit

823‧‧‧ memory unit

825‧‧‧ verification code generation unit

827‧‧‧Display unit

829‧‧‧ Near Field Communication Unit

831‧‧‧ input unit

83‧‧‧ Near-field certification vehicle

91‧‧‧Mobile communication device

911‧‧‧ input unit

912‧‧‧Display unit

913‧‧‧Verification Code Generation Unit

914‧‧‧ memory unit

915‧‧‧Communication unit

916‧‧‧Interface unit

9‧‧‧Certification system

901‧‧‧Network Servo Module

902‧‧‧Certified Servo Module

Step S401~S409‧‧‧ kinds of value generation process

Step 501~508‧‧‧One of the server login identity method flow

Step 601~606‧‧‧ server login identity method flow 2

Step 701~706‧‧‧ server login identity method flow three

Step S901~S913‧‧‧Server Login Process

Step S111~S121‧‧‧Server authentication process

Step S11~S16‧‧‧ verification code generation process

FIG. 1 is a schematic diagram of a network architecture for authenticating a password using a dynamic password; FIG. 2 is a schematic diagram showing an embodiment of a network architecture for authenticating a server login identity authentication; FIG. 3 is a diagram showing a network for logging in to the identity authentication server of the present invention. 2 is a schematic diagram of the embodiment of the road architecture; the flow shown in FIG. 4 describes an embodiment of the method for generating the value of the authentication system of the invention; FIG. 5 shows one of the flowcharts of the server authentication method of the present invention; and FIG. 6 shows the server authentication of the present invention. Method flow chart 2; FIG. 7 shows the third flowchart of the server authentication method of the present invention; 8 is a functional block diagram of an embodiment of the authentication system of the present invention; FIG. 9 is a second functional block diagram of an embodiment of the authentication system of the present invention; and the flow chart shown in FIG. 10 is used to log in to a network server by using the server authentication method of the present invention. The embodiment shown in FIG. 11 describes the steps of the embodiment of the server authentication method of the present invention; the flow shown in FIG. 12 describes the steps of the mobile communication device in the server authentication method of the present invention.

201‧‧‧User computer

202‧‧‧Mobile communication device

203‧‧‧Web server

204‧‧‧Authentication server

20‧‧‧ identity authentication system

Claims (20)

A server authentication method is applicable to an authentication system including a network servo module and an authentication servo module, comprising: the network servo module receiving an access message (access by the terminal to the server end, including The login, any access behavior, will be deleted when the delivery is sent) to perform an access procedure; the authentication servo module obtains the authentication data retrieved by the access message to generate a transmission to the corresponding access An authentication message of a mobile communication device of the message (push, notification, will be deleted when the note is sent); after transmitting the authentication message to the mobile communication device, the authentication servo module is received from the mobile communication device A verification code (avoiding the use of OTP, which can be any type of code, will be deleted when the note is sent), the verification code is based on the authentication message and the personalized information contained in the mobile communication device (not excluded from the seed) And the information of the access is deleted when the delivery is sent; and after the authentication servo module confirms the verification code to the network servo module, the recognition of the corresponding access program is completed. Program. The server authentication method of claim 1, wherein the access message is generated by a user logging in to the network server module by using a computer device, and the access message comprises: logging in to the network server module. Login information. The server authentication method according to claim 1, wherein the access message is a message for accessing a service performed by the user through the mobile communication device. The server authentication method according to claim 1, wherein the authentication message is transmitted to the mobile communication device by means of a push broadcast. The server authentication method according to claim 1, wherein the personalized information is a value stored in the mobile communication device, and the value is generated when the authentication servo module is registered. The server authentication method according to claim 5, wherein the verification code is generated by an algorithm according to the value and the authentication message in the access program. The server authentication method according to claim 6, wherein the verification code is generated according to the information in the access procedure, and the step of generating the verification code comprises: receiving, by the mobile communication device, the authentication servo After the authentication message transmitted by the module, a software program included in the mobile communication device parses the content of the authentication message to determine the same board as the content of the authentication message; according to the template, the software program is determined The information is retrieved; the software program combines the information about the access program and the value to generate the verification code. A server authentication method, which is applicable to an authentication system including a network servo module and an authentication servo module, comprising: the network servo module receiving a login authentication data of a user on a computer device to perform a login a program; the network servo module transmits the received login authentication data to an authentication servo module; the information obtained by the authentication servo module according to the login authentication data And generating a verification information notification, and transmitting the certification information notification to a mobile communication device; after receiving the authentication information notification, the mobile communication device generates a verification code according to the information of the login program and a value; the mobile communication device Transmitting the verification code to the authentication servo module; and after the authentication servo module confirms the verification code to the network servo module, the network servo module allows the user to complete the login procedure with the computer device. The server authentication method according to claim 8, wherein when the mobile communication device receives the authentication information notification, the communication information of a near field communication circuit in the mobile communication device is used to enable the value to be calculated. This verification code is generated. The server authentication method according to claim 9, wherein the near field communication circuit is activated by a near field authentication vehicle, and the communication information is exchanged to confirm that the value is turned on. The server authentication method according to claim 8, wherein the generating step comprises: obtaining the personalized information transmitted by the user by the mobile communication device; performing a value generating operation Generating the value; transmitting the value to the mobile communication device; and storing the value in the mobile communication device. The server authentication method according to claim 11, wherein the personalized information includes hardware information of the mobile communication device, and the user mentions One or a combination of the information provided and the communication information of a near field communication circuit. The server authentication method according to claim 11, wherein the value is an encrypted value, and the information provided by the user or the communication information of the near field communication circuit is decrypted and retrieved. The server authentication method according to claim 8, wherein the authentication information notification generated by the authentication servo module is a notification form of a push form, and is received by a software program carried by the mobile communication device. . The server authentication method according to claim 8, wherein the verification code is generated according to information in the login procedure, and the step of generating the verification code comprises: receiving, by the mobile communication device, the authentication servo module After the authentication message transmitted by the group, a software program included in the mobile communication device parses the content of the authentication message to determine the same board as the content of the authentication message; according to the template, the software program The information is retrieved; the software program combines the information about the access program and the value to generate the verification code. A server authentication system for performing the server authentication method according to claim 1, wherein the server authentication system comprises: a network servo module, which receives one or more users through the network to execute a computer device a first identity authentication program; and an authentication server module, connecting the network server, executing a second identity authentication program, and obtaining the login request of the one or more users through the first identity authentication program, generating For each user The notification transmitted by one of the mobile communication devices is received and the verification code generated by the mobile communication device is received directly or through the network servo module to confirm the identity of the user. The authentication system of claim 16, wherein the network servo module and the authentication server module are respectively a network server and an authentication server located at different locations. The authentication system of claim 16, wherein the network servo module provides a login webpage interface for executing one of the first identity authentication procedures. The authentication system of claim 16, wherein the authentication server module obtains personalized information transmitted by the user by the mobile communication device, and generates a stored in the mobile communication device according to the personalized information. a value that is used to provide the mobile communication device to generate the verification code. The authentication system of claim 19, wherein the personalized information is one of hardware information of the mobile communication device, information provided by the user, and communication information of a near field communication circuit of the mobile communication device. Or a combination thereof.