CN105099708A - Identity authentication method - Google Patents
Identity authentication method Download PDFInfo
- Publication number
- CN105099708A CN105099708A CN201510540195.3A CN201510540195A CN105099708A CN 105099708 A CN105099708 A CN 105099708A CN 201510540195 A CN201510540195 A CN 201510540195A CN 105099708 A CN105099708 A CN 105099708A
- Authority
- CN
- China
- Prior art keywords
- check information
- user
- background server
- verification information
- auth method
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Abstract
The invention discloses an identity authentication method for a user to realize identity authentication with a background server via a client. The identity authentication method comprises: firstly, the user sends an authentication request to the background server, and the background server searches whether corresponding verification information exists after receiving the authentication request sent by the user, and reads the verification information if the corresponding verification information exists; if no corresponding verification information exists, new verification information is generated and saved; next, the background server sends the verification information to the user, and the user receives the verification information and then sends the received verification information to the background server; the background server compares the verification information received from the user with the locally saved verification information, and approves the verification and clears the corresponding verification information if the verification information received from the user is consistent with the locally saved verification information; otherwise, verification is failed. The identity authentication method is capable of effectively avoiding bad experience of the user due to data collision.
Description
Technical field
The invention belongs to computer security technique field, particularly relate to a kind of auth method.
Background technology
Along with the development of the Internet, and smart mobile phone is universal, and mobile Internet starts to enter daily life.Because mobile terminal ratio is easier to lose, the mobile terminal of loss is easily utilized the internet, applications account number of login user by other people.Therefore present internet, applications is all provided with the link of subscriber authentication, by associating of verified users identity and cell-phone number householder identity, is confirmed to be user in use.
The process of carrying out authentication at present transmit a request to background server by client usually, background server generates identifying code, user is sent to by various ways, such as note, mail, micro-letter etc., after user receives identifying code, input validation code sends to background server on the client, and background server receives the identifying code that client is sent, whether consistent with the identifying code that background server generates by comparing the identifying code sent, judge whether it is that user is in use.
But current this mode to send to rate lower, adopt repeatedly/multipath checking customer information time, data collision can be produced mutually between scheme, cause reducing Consumer's Experience.Such as generate after an identifying code sends to user at background server, if user does not receive at the appointed time, client then can send request again, and another identifying code of background server regeneration sends to user, and previous identifying code lost efficacy.And if now user receives and fills in first identifying code, then can cause authentication error, background server again can generate and send the 3rd identifying code.
Obviously, after user lives through multiple authentication mistake, Consumer's Experience can be reduced.
Summary of the invention
The object of this invention is to provide a kind of auth method, to avoid occurring data collision in prior art, cause the problem reducing Consumer's Experience.
To achieve these goals, technical solution of the present invention is as follows:
A kind of auth method, for user by realizing authentication between client and background server, described method comprises:
User sends checking request to background server;
After background server receives the checking request that user sends, search and whether there is corresponding check information, if there is corresponding check information, then read this check information; If there is no corresponding check information, then generate new check information, and preserve;
Described check information is sent to user by background server;
After user receives check information, the check information received is sent to background server;
Background server compares the check information and the local check information preserved that receive from user, if consistent, is verified, removes corresponding check information, otherwise authentication failed.
Further, described check information is also provided with the corresponding term of validity, and after described background server receives the checking request that user sends, searching and whether there is corresponding check information, is search whether to there is corresponding effective check information.
Further, there is corresponding check information if described, then, after reading this check information, also comprise step:
Extend the term of validity of this check information, and this check information extending the term of validity is preserved.
Further, the described check information removing correspondence arranges the term of validity of this check information for inefficacy.
Checking request of the present invention also comprises check information and sends the channel pattern adopted, and described channel pattern comprises short message mode, mail mode, micro-letter pattern.
Further, described background server also comprises step after receiving the checking request that user sends:
Obtain the channel pattern that checking asks to comprise, search corresponding check information according to channel pattern or generate new check information.
Further, described check information is sent to user by described background server, is to ask the channel pattern comprised to send check information by checking.
Check information of the present invention is preserved in the buffer, and this buffer memory can be the buffer memory of background server this locality, also can be the caching system be connected with background server.
A kind of auth method that the present invention proposes, by storing check information in the buffer, after the checking request receiving user, search corresponding check information, when there is effective check information, this effective check information of direct use sends to user, the situation that the Consumer's Experience that can effectively avoid data collision to cause is bad.
Accompanying drawing explanation
Fig. 1 is a kind of auth method flow chart of the present invention.
Embodiment
Be described in further details technical solution of the present invention below in conjunction with drawings and Examples, following examples do not form limitation of the invention.
Authentication is whether the last check information that check information and background server by comparing user's input store is consistent, judges that the user of current login is the validated user registered really.Usually checking is realized by channel patterns such as note, mail, micro-letters, its essence is that the user judging current login is the user of certain related information really, the householder of phone number of such as, when being registration registration, or the addresses of items of mail of registration during registration, microsignal householder.
The present embodiment, for short message sending check information (being generally identifying code), is described method of the present invention, and the user rs authentication for micro-letter, Email Channel pattern is applicable equally.
As shown in Figure 1, a kind of auth method, comprises the steps:
F1, user send checking request to background server.
User when logging in internet, applications, or when needs carry out subscriber authentication, sends checking request by client to background server.Client is the equipment that user is used for logging in and accessing internet, applications, can be the mobile phone, panel computer, common PC etc. of having installed client software.
After F2, background server receive the checking request that user sends, search and whether there is corresponding check information, if there is corresponding check information, then read this check information; If there is no corresponding check information, then generate new check information, and preserve.
The check information of the present embodiment is preserved in the buffer, and buffer memory can be the buffer memory of background server this locality, can be also the caching system be connected with background server, the invention is not restricted to the concrete form of buffer memory.
After background server receives the checking request that user sends, search corresponding authorization information in the buffer according to the ID of user.
If there is corresponding check information in buffer memory, then read this check information, thus background server is provided with this check information.If there is no corresponding check information in buffer memory, then generate new check information, and this check information is synchronized to buffer memory, preserve in the buffer.
Visible by this step, auth method of the present invention can effectively avoid user not receive check information at the appointed time, and repeats to send the problem that another check information of background server regeneration caused is asked in checking.When user does not receive check information at the appointed time, and repeat to send checking request, the method of the present embodiment searches corresponding check information in the buffer, when background server second time receives checking request, first be search in the buffer whether to there is check information corresponding to this user, the check information generated due to first time checking request is not eliminated, and therefore will find this check information, thus this check information is sent to user, can not regeneration second check information.Also would not there is user and receive first check information after transmission second time checking request, input primary check information and the authentication failed problem that causes, namely eliminate the possibility of data collision, improve the efficiency of verification.
It should be noted that, the present invention is not limited to the medium that check information is preserved, and can be above-mentioned buffer memory, also can be the memory of server, is directly preserved in a database by check information.And the form that check information is preserved in the buffer is generally a record, this record comprises check information, user ID, is convenient to search corresponding check information according to user ID.
The check information of the present embodiment is also provided with the corresponding term of validity, such as, be 30 minutes, and this term of validity sends higher than allowing user not receive check information the duration verified and ask again.When not arranging the term of validity, check information is permanently effective in the buffer.When check information is permanently effective, when other reasons causes authentication failed, the check information in buffer memory is permanently effective, makes check information there is the risk revealed, is easily utilized by illegal user.Arrange the term of validity and can effectively avoid this situation, even if when other reasons causes authentication failed, this check information is also expired very soon, needs to regenerate, and impels upgrading in time of check information, avoids being utilized by illegal user.
Further, when background server searches the check information that whether there is correspondence in the buffer, if find corresponding effective check information, then also step is comprised:
Extend the term of validity of this check information, and this check information extending the term of validity is synchronized to buffer memory, preserve in the buffer.
The term of validity of the check information of the present embodiment acquiescence is 30 minutes, and extends the term of validity of check information, is that the term of validity of current check information is set to 30 minutes again.It is easily understood that after background server receives the checking request that user sends, search and whether there is corresponding check information, be search whether to there is corresponding effective check information, in the check information lost efficacy no longer limit of consideration, repeat no more here.
Check information is sent to user by F3, background server.
Background server sends to user by check information after reading check information or newly-generated check information, and the present embodiment is sent by the mode of SMS.
After F4, user receive check information, the check information received is sent to background server.
After user receives check information by SMS, background server is sent to carry out authentication by client check information.
F5, background server compare the check information and the local check information preserved that receive from user, if consistent, are verified, remove corresponding check information, otherwise authentication failed.
After background server receives the check information of user's input, the check information obtained with step F 2 compares, if consistent, represent that user obtains check information by legal means, user is validated user, is verified; Otherwise think user's input error, authentication failed.
After being verified, also removing check information corresponding in buffer memory, can directly delete, or its term of validity is set for losing efficacy.Visible, when verify normal through, check information all can not be eliminated, and whether check information is provided with the term of validity in this case, not what impact.And when user's input error causes authentication failed, check information can not be eliminated, if user stopped continue checking, then this check information is retained, easily by other people for log in.Therefore the present embodiment is that check information is provided with the term of validity, is generally 30 minutes, and after the term of validity, this check information lost efficacy.And background server is receiving the checking request of user, finding that the check information in buffer memory lost efficacy by searching, then regenerating new check information, if also do not lost efficacy, extend its term of validity, check information is issued user.
In sum, auth method of the present invention, by storing check information in the buffer, after the checking request receiving user, searches corresponding check information, the situation that the Consumer's Experience effectively avoiding data collision to cause is bad.
Owing to can be realized the transmission of check information by channel patterns such as short message mode, mail mode, micro-letters, check information is generally check code, therefore the checking request of the present embodiment also comprises channel pattern, after background server receives checking request, search corresponding check information according to channel pattern or generate new check information, and send check information by this channel pattern in subsequent step.When Internet application system only supports a kind of channel pattern, in checking request, channel pattern can not be comprised.
Above embodiment is only in order to illustrate technical scheme of the present invention but not to be limited; when not deviating from the present invention's spirit and essence thereof; those of ordinary skill in the art are when making various corresponding change and distortion according to the present invention, but these change accordingly and are out of shape the protection range that all should belong to the claim appended by the present invention.
Claims (8)
1. an auth method, for user by realizing authentication between client and background server, is characterized in that, described method comprises:
User sends checking request to background server;
After background server receives the checking request that user sends, search and whether there is corresponding check information, if there is corresponding check information, then read this check information; If there is no corresponding check information, then generate new check information, and preserve;
Described check information is sent to user by background server;
After user receives check information, the check information received is sent to background server;
Background server compares the check information and the local check information preserved that receive from user, if consistent, is verified, removes corresponding check information, otherwise authentication failed.
2. auth method according to claim 1, it is characterized in that, described check information is also provided with the corresponding term of validity, after described background server receives the checking request that user sends, searching and whether there is corresponding check information, is search whether to there is corresponding effective check information.
3. auth method according to claim 2, is characterized in that, there is corresponding check information, then, after reading this check information, also comprise step if described:
Extend the term of validity of this check information, and this check information extending the term of validity is preserved.
4. auth method according to claim 3, is characterized in that, the described check information removing correspondence arranges the term of validity of this check information for inefficacy.
5. auth method according to claim 1, is characterized in that, described checking request also comprises check information and sends the channel pattern adopted, and described channel pattern comprises short message mode, mail mode, micro-letter pattern.
6. auth method according to claim 5, is characterized in that, described background server also comprises step after receiving the checking request that user sends:
Obtain the channel pattern that checking asks to comprise, search corresponding check information according to channel pattern or generate new check information.
7. auth method according to claim 6, is characterized in that, described check information is sent to user by described background server, is to ask the channel pattern comprised to send check information by checking.
8. the auth method according to the arbitrary claim of claim 1-7, is characterized in that, described check information is preserved in the buffer.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510540195.3A CN105099708B (en) | 2015-08-28 | 2015-08-28 | A kind of auth method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510540195.3A CN105099708B (en) | 2015-08-28 | 2015-08-28 | A kind of auth method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105099708A true CN105099708A (en) | 2015-11-25 |
| CN105099708B CN105099708B (en) | 2018-05-15 |
Family
ID=54579340
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510540195.3A Active CN105099708B (en) | 2015-08-28 | 2015-08-28 | A kind of auth method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105099708B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106411922A (en) * | 2016-10-31 | 2017-02-15 | 四川长虹电器股份有限公司 | Security identity authentication method and system |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102300182A (en) * | 2011-09-07 | 2011-12-28 | 飞天诚信科技股份有限公司 | Short-message-based authentication method, system and device |
| CN103002415A (en) * | 2011-09-15 | 2013-03-27 | 阿里巴巴集团控股有限公司 | Method and device for transmitting verification codes via short messages |
| CN104320767A (en) * | 2014-11-10 | 2015-01-28 | 吴东辉 | Short message verification system and method |
-
2015
- 2015-08-28 CN CN201510540195.3A patent/CN105099708B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102300182A (en) * | 2011-09-07 | 2011-12-28 | 飞天诚信科技股份有限公司 | Short-message-based authentication method, system and device |
| CN103002415A (en) * | 2011-09-15 | 2013-03-27 | 阿里巴巴集团控股有限公司 | Method and device for transmitting verification codes via short messages |
| CN104320767A (en) * | 2014-11-10 | 2015-01-28 | 吴东辉 | Short message verification system and method |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106411922A (en) * | 2016-10-31 | 2017-02-15 | 四川长虹电器股份有限公司 | Security identity authentication method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105099708B (en) | 2018-05-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102638468B (en) | The method of protection information transmission security, transmitting terminal, receiving terminal and system | |
| CN103905194B (en) | Identity traceability authentication method and system | |
| CN103840944A (en) | Short message authentication method, server and system | |
| CN104144419A (en) | Identity authentication method, device and system | |
| CN102835137A (en) | Facilitating authentication of access terminal identity | |
| CN103944737A (en) | User identity authentication method, third-party authentication platform and operator authentication platform | |
| US20120172067A1 (en) | System and method for verifying a sender of an sms text message | |
| CN106209900B (en) | A kind of method that smart lock is registered to repeater | |
| CN110087241B (en) | Service authorization method, device and system | |
| CN102802150B (en) | phone number verification method, system and terminal | |
| CN105993156B (en) | Server access verification method and device | |
| CN102801713A (en) | Website logging-in method and system as well as accessing management platform | |
| CN103107888B (en) | The identity identifying method that the dynamic multi-attribute of facing moving terminal is multi-level | |
| CN105681258A (en) | Session method and session device based on third-party server | |
| CN104767713A (en) | Account binding method, server and account binding system | |
| CN104348620A (en) | Method for authenticating intelligent household terminals, and corresponding devices | |
| CN104660401A (en) | Authentication method, authentication system and terminal | |
| CN107113613A (en) | Server, mobile terminal, real-name network authentication system and method | |
| CN104935435A (en) | Login methods, terminal and application server | |
| US9680814B2 (en) | Method, device, and system for registering terminal application | |
| CN106559386A (en) | A kind of authentication method and device | |
| CN108600259B (en) | Authentication and binding method of equipment, computer storage medium and server | |
| CN101257518B (en) | Method and system for preventing lawless ordering without through charging gateway in WAP platform | |
| CN105427102A (en) | Financial IC card based authentication method and corresponding device and system | |
| CN109063461B (en) | Third-party password-free login method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C41 | Transfer of patent application or patent right or utility model | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20160129 Address after: 201802, room 6, No. 688, Lane 2115, Jia Jia Road, Shanghai, Jiading District Applicant after: Shanghai hundred million health care health Management Co., Ltd Address before: 201802 Shanghai City, Jiading District Road No. 88 Chen 6 Building 4 floor A room 4094 Applicant before: SHANGHAI JIANBAO HEALTH CO., LTD. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |