CN108259436B

CN108259436B - User identity authentication processing method, application server and authentication system server

Info

Publication number: CN108259436B
Application number: CN201611246412.9A
Authority: CN
Inventors: 郑晓磊; 杨继学; 陈海伟
Original assignee: China Mobile Communications Group Co Ltd; China Mobile Group Henan Co Ltd
Current assignee: China Mobile Communications Group Co Ltd; China Mobile Group Henan Co Ltd
Priority date: 2016-12-29
Filing date: 2016-12-29
Publication date: 2021-01-01
Anticipated expiration: 2036-12-29
Also published as: CN108259436A

Abstract

The invention discloses a user identity authentication processing method, an application server and an authentication system server. The method comprises the following steps: receiving a first user account and a first password, and acquiring a first character string; generating a graphic three-dimensional code according to the first character string, the first random number and the first equipment string number, and sending the graphic three-dimensional code to the first terminal; receiving a second random number, a second user account, a second device serial number and an identification ID; sending a verification request to an authentication system server, receiving a verification passing message, and generating a second character string; and obtaining a first character string, a first random number and a first equipment string number, wherein if the first character string is the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, the user account is legal. The application server is used for executing the method. The user identity authentication processing method, the application server and the authentication system server provided by the invention improve the security of user login.

Description

User identity authentication processing method, application server and authentication system server

Technical Field

The invention relates to the technical field of internet, in particular to a user identity authentication processing method, an application server and an authentication system server.

Background

With the rapid development of the internet and mobile networks, networks have become a part of people's lives, and some network services need to be registered and then logged in before being used.

At present, most user login systems provided by network service perform user authentication in a static 'username + password' manner, and a user needs to input a username and a password to log in. Some websites also require the user to input a verification code in order to improve the security of the user account, which increases the operation of the user. The above user login methods all have the risk of being phished. In particular, a user logs in on a public device, logs in on a fishing net station, or the login device itself is infected by trojan horse virus, and a user account has a high leakage risk. In addition, the login mode can be cracked violently. Brute force cracking is exhaustive attack, and the basic idea of the exhaustive method is to determine the approximate range of answers according to partial conditions of questions and verify all possible conditions one by one in the range until all conditions are verified. If a certain condition verifies that all conditions of the problem are met, the problem is a solution of the problem; if all the conditions are not in accordance with all the conditions of the topic after all the conditions are verified, the topic has no solution. Exhaustive methods are also known as enumeration methods.

Therefore, how to provide a user login authentication method to improve the security of user login is an important issue to be solved in the industry.

Disclosure of Invention

Aiming at the defects in the prior art, the invention provides a user identity authentication processing method, an application server and an authentication system server.

In one aspect, the present invention provides a user identity authentication processing method, including:

receiving a first login request of a first terminal, wherein the first login request comprises a first user account and a first password, and acquiring a first character string according to the first user account and the first password;

generating a graphic three-dimensional code according to the first character string, the first random number and a pre-stored first equipment string number of the second terminal, and sending the graphic three-dimensional code to the first terminal;

receiving a second login request sent by the second terminal, wherein the second login request comprises a second random number, a second user account, a second equipment serial number and an identification ID of the second terminal; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID;

receiving a verification passing message sent by the authentication system server, and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal.

On the other hand, the invention also provides a user identity authentication processing method, which comprises the following steps:

the authentication system server receives a request for verifying the user validity sent by the application server, wherein the request for verifying the user validity comprises a second user account, a second equipment serial number and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number;

and if the authentication system server judges that the second user account and the second equipment serial number are the same as the locally stored user account and equipment serial number corresponding to the identification ID, sending a verification passing message to the application server, wherein the verification passing message carries the second user account and a second password, and the second password is locally stored in the authentication system server and corresponds to the second user account so that the application server can verify the second login request based on the second password.

In yet another aspect, the present invention provides an application server, including:

the first receiving unit is used for receiving a first login request of a first terminal, wherein the first login request comprises a first user account and a first password, and a first character string is obtained according to the first user account and the first password;

the first generating unit is used for generating a graphic three-dimensional code according to the first character string, the first random number and a pre-stored first equipment string number of the second terminal and sending the graphic three-dimensional code to the first terminal;

the first processing unit is used for receiving a second login request sent by the second terminal, wherein the second login request comprises a second random number, a second user account, a second equipment serial number and an identification ID of the second terminal; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID;

the verification unit is used for receiving a verification passing message sent by the authentication system server and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal.

In yet another aspect, the present invention provides an authentication system server, including:

the third receiving unit is used for receiving a request for verifying the user validity sent by the application server, wherein the request for verifying the user validity comprises a second user account, a second equipment serial number and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number;

and the authentication unit is used for sending a verification passing message to the application server if the second user account and the second equipment serial number are judged to be the same as the locally stored user account and equipment serial number corresponding to the identification ID, wherein the verification passing message carries the second user account and a second password, and the second password is locally stored in the authentication system server and corresponds to the second user account so that the application server can verify the second login request based on the second password.

According to the user identity authentication processing method, the application server and the authentication system server, the application server generates the graphic three-dimensional code based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, the user legality is verified through the authentication system server, and the application server verifies the second login request, so that the user login safety is improved.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and those skilled in the art can also obtain other drawings according to the drawings without creative efforts.

FIG. 1 is a flowchart illustrating a user identity authentication processing method according to an embodiment of the present invention;

FIG. 2 is a flowchart illustrating a user identity authentication processing method according to another embodiment of the present invention;

FIG. 3 is a flowchart illustrating a user identity authentication processing method according to another embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an application server according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an application server according to another embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an application server according to another embodiment of the present invention;

FIG. 7 is a block diagram of an authentication system server according to an embodiment of the present invention;

FIG. 8 is a diagram illustrating an authentication system server according to another embodiment of the present invention;

fig. 9 is a signaling interaction diagram of a binding flow of a user identity authentication processing method according to an embodiment of the present invention;

FIG. 10 is a signaling interaction diagram of a login verification process of a user identity authentication processing method according to an embodiment of the present invention;

fig. 11 is a schematic physical structure diagram of an application server according to an embodiment of the present invention;

fig. 12 is a schematic entity structure diagram of an authentication system server according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Fig. 1 is a schematic flow chart of a user identity authentication processing method according to an embodiment of the present invention, and as shown in fig. 1, the user identity authentication processing method provided by the present invention includes:

s101, receiving a first login request of a first terminal, wherein the first login request comprises a first user account and a first password, and acquiring a first character string according to the first user account and the first password;

specifically, when a user logs in at a first terminal by using a first account and a first password, the first terminal sends a first login request including the first user account and the first password to an application server, and the application server receives the first login request and acquires a first character string according to the first user account and the first password. Wherein the first terminal may be a desktop computer.

S102, generating a graphic three-dimensional code according to the first character string, the first random number and a pre-stored first equipment string number of the second terminal, and sending the graphic three-dimensional code to the first terminal;

specifically, a first device serial number of the second terminal is prestored in the application server, and the application server may search the first device serial number locally through the first user account, and may also randomly generate a first random number; and then, the application server generates a graphic three-dimensional code according to the acquired first character string, the acquired first random number and the acquired first equipment string number, and sends the generated graphic three-dimensional code to the first terminal. And the second terminal is a mobile terminal.

S103, receiving a second login request sent by the second terminal, wherein the second login request comprises a second random number, a second user account, a second equipment serial number and an identification ID of the second terminal; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID;

specifically, the second terminal sends a second login request to the application server, where the second login request includes a second random number, a second user account, and a second device serial number and an identification ID of the second terminal; the second random number is obtained by scanning the graphical three-dimensional code displayed on the first terminal by the second terminal, and the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number. The application server receives the second login request and then sends a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second device serial number and the identification ID.

S104, receiving a verification passing message sent by the authentication system server, and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored in the authentication system server locally and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal.

Specifically, the authentication system server verifies the validity of the user according to the second user account, the second device serial number and the identification ID, the authentication system server may locally obtain the user account and the device serial number corresponding to the identification ID, and if the user account corresponding to the identification ID is the same as the second user account and the device serial number corresponding to the identification ID is the same as the second device serial number, the validity of the user is verified; then, the authentication system server locally looks up a second password corresponding to the second user account. The authentication system server sends a verification passing message to the application server, wherein the verification passing message comprises the second user account and the second password. The application server receives the verification passing message and generates a second character string according to the second user account and the second password; the application server analyzes the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number; and the application server compares the first character string with the second character string, the first random number with the second random number, and the first equipment string number with the second equipment string number, and if the first character string is the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, the user account is legal. After verifying that the user account is legal, the application server may send information to the first terminal, so that the first account is successfully logged in at the first terminal.

According to the user identity authentication processing method provided by the invention, the application server generates the graphic three-dimensional code based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, the user legality is verified through the authentication system server, and the application server verifies the second login request, so that the user login safety is improved.

Fig. 2 is a schematic flow chart of a user identity authentication processing method according to another embodiment of the present invention, as shown in fig. 2, further, before the receiving of the first login request of the first terminal, the user identity authentication processing method according to the present invention further includes a binding process, where the binding process includes:

s201, receiving a binding request sent by the second terminal, wherein the binding request comprises the second user account and the second equipment serial number, and if the second user account is locally stored, sending a distribution request to the authentication system server, wherein the distribution request comprises the second user account and the second equipment serial number;

specifically, the second terminal sends a binding request to the application server, where the binding request includes the second user account and the second device serial number; and the application server receives the binding request, searches the second user account in a local database, and sends an allocation request to the authentication system server if the second user account is found. Wherein the allocation request includes the second user account and the second device serial number.

S202, receiving the identification ID sent by the authentication system server;

specifically, after receiving the allocation request, the authentication system server generates the identification ID according to the second user account and the second device serial number through an algorithm, where the algorithm may be AES or SM 3. And the authentication system server sends the generated identification ID to the application server, and the application server receives the identification ID.

S203, sending the identification ID to the second terminal, and receiving a binding authentication request returned by the second terminal, wherein the binding authentication request comprises the second user account, the second equipment serial number and the identification ID;

specifically, the application server sends the received identification ID to the second terminal, and after receiving the identification ID, the second terminal sends a binding authentication request to the application server, where the binding authentication request includes the second user account, the second device serial number, and the identification ID, and the application server receives the binding request.

S204, the binding authentication request is forwarded to the authentication system server, and a binding success message is sent to the second terminal after the authentication system server verifies that the second user account and the second equipment serial number are legal according to the identification ID.

Specifically, the application server sends the received binding authentication request to the authentication system server, the authentication system server verifies the legitimacy of the serial numbers of the second user account and the second device according to the second user account, the second device serial number and the identification ID, the authentication system server can locally obtain the user account and the device serial number corresponding to the identification ID, if the user account corresponding to the identification ID is the same as the second user account and the device serial number corresponding to the identification ID is the same as the second device serial number, the second user account and the second device serial number are legitimate, and the second user account and the second device serial number are successfully bound; and the authentication system server sends a binding success message to the application server, and the application server sends the binding success message to the second terminal.

According to the user identity authentication processing method provided by the invention, the application server generates the graphic three-dimensional code based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, the user legality is verified through the authentication system server, and the application server verifies the second login request, so that the user login safety is improved. And the second terminal and the second user account are bound, so that the subsequent verification of the user login is facilitated.

On the basis of the above embodiment, further, the user identity authentication processing method provided by the present invention further includes:

generating an activation code and sending the activation code to the second terminal; correspondingly, the activation code is also included in the binding request for authentication.

Specifically, the user uses a second terminal to send a second user account to be bound to the application server, the application server generates an activation code corresponding to the second user account, and then sends the activation code to the second terminal; correspondingly, when the second terminal sends the binding request, the binding request further comprises the activation code; and the application server compares the generated activation code corresponding to the second user account with the received activation code sent by the second terminal, and if the two activation codes are the same, sends an allocation request to the authentication system server.

According to the user identity authentication processing method, the application server and the authentication system server, the application server generates the graphic three-dimensional code based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, the user legality is verified through the authentication system server, and the application server verifies the second login request, so that the user login safety is improved. The activation code is added in the binding process, so that the security of the binding process is improved.

Fig. 3 is a schematic flow chart of a user identity authentication processing method according to another embodiment of the present invention, and as shown in fig. 3, the user identity authentication processing method according to the embodiment of the present invention includes:

s301, an authentication system server receives a user validity verification request sent by an application server, wherein the user validity verification request comprises a second user account, a second equipment serial number and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number;

specifically, the application server sends a request for verifying the user validity to the authentication system server, wherein the request for verifying the user validity comprises a second user account, a second device serial number and an identification ID. The second user account, the second device serial number and the identification ID are obtained by the application server through a second login request sent by a second terminal; the identification ID is pre-generated by the authentication system server from the second user account and the second device serial number. The authentication system server receives the request for verifying the validity of the user.

S302, if the authentication system server judges that the second user account and the second equipment serial number are the same as a locally stored user account and equipment serial number corresponding to the identification ID, sending a verification passing message to the application server, wherein the verification passing message carries the second user account and a second password, and the second password is stored locally in the authentication system server and corresponds to the second user account so that the application server can verify the second login request based on the second password.

Specifically, the authentication system server searches a user account and an equipment serial number corresponding to the identification ID in a local database according to the received identification ID, and if the second user account is the same as the user account corresponding to the identification ID and the second equipment serial number is the same as the equipment serial number corresponding to the identification ID, the user validity verification is passed; then, the authentication system server searches a second password corresponding to the second user account in a local database according to the second user account; and the authentication system server sends a verification passing message to the application server, wherein the verification passing message comprises the second user account and the second password. And after receiving the second user account and the second password, the application server generates a second character string according to the second user account and the second password, wherein the second character string is used for verifying the second login request.

On the basis of the foregoing embodiments, further, the user identity authentication processing method provided by the present invention further includes:

the authentication system server receives a registration request of the second terminal, wherein the registration request comprises the second user account and the second password;

the authentication system server stores the correspondence between the second user account and the second password.

Specifically, the second terminal sends a registration request to the authentication system server, where the registration request includes the second user account and the second password. And the authentication system server receives the registration request and correspondingly stores the second user account and the second password.

According to the user identity authentication processing method provided by the invention, the application server generates the graphic three-dimensional code based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, the user legality is verified through the authentication system server, and the application server verifies the second login request, so that the user login safety is improved. And the authentication system server receives the registration request of the second terminal, and correspondingly stores the registered second account and the second password, so that the subsequent verification of the second login request is facilitated.

Fig. 4 is a schematic structural diagram of an application server according to an embodiment of the present invention, and as shown in fig. 4, the application server provided by the present invention includes a first receiving unit 401, a first generating unit 402, a first processing unit 403, and a verifying unit 404, where:

the first receiving unit 401 is configured to receive a first login request of a first terminal, where the first login request includes a first user account and a first password, and obtain a first character string according to the first user account and the first password; the first generating unit 402 is configured to generate a graphic three-dimensional code according to the first character string, the first random number, and a pre-stored first device string number of the second terminal, and send the graphic three-dimensional code to the first terminal; the first processing unit 403 is configured to receive a second login request sent by the second terminal, where the second login request includes a second random number, a second user account, a second device serial number of the second terminal, and an identification ID; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID; the verification unit 404 is configured to receive a verification passing message sent by the authentication system server, and generate a second character string according to the second user account and a second password carried in the verification passing message, where the second password is stored locally in the authentication system server and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal.

Specifically, when a user logs in at a first terminal by using a first account and a first password, the first terminal sends a first login request including the first user account and the first password to the first receiving unit 401, and the first receiving unit 401 receives the first login request and obtains a first character string according to the first user account and the first password. Wherein the first terminal may be a desktop computer.

The application server pre-stores a first device serial number of the second terminal, and the first generating unit 402 may search the first device serial number locally through the first user account and may also randomly generate a first random number; then, the first generating unit 402 generates a graphical three-dimensional code according to the acquired first character string, the acquired first random number, and the acquired first device string number, and sends the generated graphical three-dimensional code to the first terminal. And the second terminal is a mobile terminal.

The second terminal sends a second login request to the first processing unit 403, where the second login request includes a second random number, a second user account, and a second device serial number and an identification ID of the second terminal; the second random number is obtained by scanning the graphical three-dimensional code displayed on the first terminal by the second terminal, and the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number. The first processing unit 403 receives the second login request, and then sends a request for verifying user validity to the authentication system server, where the request for verifying user validity includes the second user account, the second device serial number, and the identification ID.

The authentication system server verifies the user validity according to the second user account, the second equipment serial number and the identification ID, the authentication system server can locally acquire the user account and the equipment serial number corresponding to the identification ID, and if the user account corresponding to the identification ID is the same as the second user account and the equipment serial number corresponding to the identification ID is the same as the second equipment serial number, the user validity verification is passed; then, the authentication system server locally looks up a second password corresponding to the second user account. The authentication system server sends a verification pass message to the verification unit 404, the verification pass message including the second user account and the second password. The verification unit 404 receives the verification passing message, and generates a second character string according to the second user account and the second password; the verification unit 404 analyzes the locally stored three-dimensional code of the graph to obtain the first character string, the first random number, and the first device string number; the verification unit 404 compares the first character string with the second character string, the first random number with the second random number, and the first device string number with the second device string number, and if the first character string is the same as the second character string, the first random number is the same as the second random number, and the first device string number is the same as the second device string number, the user account is legal. After verifying that the user account is legal, the application server may send information to the first terminal, so that the first account is successfully logged in at the first terminal.

According to the application server provided by the invention, the graphic three-dimensional code can be generated based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, and the second login request is verified after the authentication system server passes the user validity verification, so that the user login safety is improved.

Fig. 5 is a schematic structural diagram of an application server according to another embodiment of the present invention, and as shown in fig. 5, the application server further includes a determining unit 405, a second receiving unit 406, a second processing unit 407, and a sending unit 408, where:

the determining unit 405 is configured to receive a binding request sent by the second terminal, where the binding request includes the second user account and the second device serial number, and send an allocation request to the authentication system server if it is determined that the second user account is locally stored, where the allocation request includes the second user account and the second device serial number; the second receiving unit 406 is configured to receive the identification ID sent by the authentication system server; the second processing unit 407 is configured to send the identification ID to the second terminal, and receive a binding authentication request returned by the second terminal, where the binding authentication request includes the second user account, the second device serial number, and the identification ID; the sending unit 408 is configured to forward the binding authentication request to the authentication system server, and send a binding success message to the second terminal after the authentication system server verifies that the second user account and the second device serial number are legal according to the identification ID.

Specifically, the second terminal sends a binding request to the determining unit 405, where the binding request includes the second user account and the second device serial number; the determining unit 405 receives the binding request, searches the second user account in a local database, and sends an allocation request to the authentication system server if the second user account is found. Wherein the allocation request includes the second user account and the second device serial number.

After receiving the allocation request, the authentication system server generates the identification ID according to the second user account and the second device serial number through an algorithm, where the algorithm may be AES or SM 3. The authentication system server transmits the generated identification ID to the second receiving unit 406, and the second receiving unit 406 receives the identification ID.

The second processing unit 407 sends the received identification ID to the second terminal, and after receiving the identification ID, the second terminal sends a binding authentication request to the second processing unit 407, where the binding authentication request includes the second user account, the second device serial number, and the identification ID, and the second processing unit 407 receives the binding request.

The sending unit 408 sends the received binding authentication request to the authentication system server, where the authentication system server verifies the legitimacy of the second user account and the second device serial number according to the second user account, the second device serial number, and the identification ID, and the authentication system server may locally obtain the user account and the device serial number corresponding to the identification ID, and if the user account corresponding to the identification ID is the same as the second user account and the device serial number corresponding to the identification ID is the same as the second device serial number, the second user account and the second device serial number are legitimate, and the binding is successful; the authentication system server sends a binding success message to the sending unit 408, and the sending unit 408 sends the binding success message to the second terminal.

According to the application server provided by the invention, the graphic three-dimensional code can be generated based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, and the second login request is verified after the authentication system server passes the user validity verification, so that the user login safety is improved. And the second terminal and the second user account are bound, so that the subsequent verification of the user login is facilitated.

Fig. 6 is a schematic structural diagram of an application server according to another embodiment of the present invention, and as shown in fig. 6, the application server provided in the present invention further includes:

the second generating unit 409 is used for generating an activation code and sending the activation code to the second terminal; correspondingly, the activation code is also included in the binding request for authentication.

Specifically, the user uses a second terminal to send a second user account to be bound to the application server, and the second generating unit 409 generates an activation code corresponding to the second user account and then sends the activation code to the second terminal; correspondingly, when the second terminal sends the binding request, the binding request further comprises the activation code; the determining unit 405 compares the generated activation code corresponding to the second user account with the received activation code sent by the second terminal, and if the two are the same, sends an allocation request to the authentication system server.

According to the application server provided by the invention, the graphic three-dimensional code can be generated based on the first login request sent by the first terminal, so that the second terminal sends the second login request after scanning the graphic three-dimensional code, and the second login request is verified after the authentication system server passes the user validity verification, so that the user login safety is improved. The activation code is added in the binding process, so that the security of the binding process is improved.

The embodiment of the application server provided in the present invention may be specifically configured to execute the processing flow corresponding to the method embodiment, and the functions of the embodiment are not described herein again, and refer to the detailed description of the method embodiment.

Fig. 7 is a schematic structural diagram of an authentication system server according to an embodiment of the present invention, and as shown in fig. 7, the authentication system server provided in the present invention includes a third receiving unit 701 and an authentication unit 702, where:

the third receiving unit 701 is configured to receive a request for verifying user validity sent by an application server, where the request for verifying user validity includes a second user account, a second device serial number, and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number; the authentication unit 702 is configured to send a verification passing message to the application server if it is determined that the second user account and the second device serial number are the same as a locally stored user account and device serial number corresponding to the identification ID, where the verification passing message carries the second user account and a second password, and the second password is stored locally in the authentication system server and corresponds to the second user account, so that the application server verifies the second login request based on the second password.

Specifically, the application server sends a request for verifying the validity of the user to the third receiving unit 701, where the request for verifying the validity of the user includes the second user account, the second device serial number, and the identification ID. The second user account, the second device serial number and the identification ID are obtained by the application server through a second login request sent by a second terminal; the identification ID is pre-generated by the authentication system server from the second user account and the second device serial number. The third receiving unit 701 receives the request for verifying the validity of the user.

The authentication unit 702 searches a local database for a user account and an equipment serial number corresponding to the identification ID according to the received identification ID, and if the second user account is the same as the user account corresponding to the identification ID and the second equipment serial number is the same as the equipment serial number corresponding to the identification ID, the user validity verification is passed; then, the authentication unit 702 searches a second password corresponding to the second user account in a local database according to the second user account; the authentication unit 702 sends a verification-passed message to the application server, where the verification-passed message includes the second user account and the second password. And after receiving the second user account and the second password, the application server generates a second character string according to the second user account and the second password, wherein the second character string is used for verifying the second login request.

The authentication system server provided by the invention can verify the legality of the user based on the information sent by the application server, so that the login safety of the user is improved.

Fig. 8 is a schematic structural diagram of an authentication system server according to another embodiment of the present invention, and as shown in fig. 8, the authentication system server provided in the present invention further includes:

the fourth receiving unit 703 is configured to receive a registration request of the second terminal, where the registration request includes the second user account and the second password; the storage unit 704 is configured to store a corresponding relationship between the second user account and the second password.

Specifically, the second terminal sends a registration request to the fourth receiving unit 703, where the registration request includes the second user account and the second password. The fourth receiving unit 703 receives the registration request, and the storing unit 704 stores the second user account and the second password in a corresponding manner.

The authentication system server provided by the invention can verify the legality of the user based on the information sent by the application server, so that the login safety of the user is improved. And the authentication system server receives the registration request of the second terminal, and correspondingly stores the registered second account and the second password, so that the subsequent verification of the second login request is facilitated.

The embodiment of the authentication system server provided by the present invention may be specifically configured to execute the processing flow corresponding to the method embodiment, and the functions of the embodiment are not described herein again, and refer to the detailed description of the method embodiment.

Fig. 9 is a signaling interaction diagram of a binding flow of a user identity authentication processing method according to an embodiment of the present invention, and as shown in fig. 9, in the user identity authentication processing method provided in the embodiment of the present invention, a flow of an embodiment in which a user binds a mobile terminal and a user account is as follows:

firstly, a user uses a mobile terminal to initiate a binding request, and the user can directly apply for binding by using a user account registered on an application server;

secondly, the mobile terminal sends a binding request to the application server, wherein the binding request can be sent in a GPRS or short message mode and comprises a user account and a device serial number of the mobile terminal;

thirdly, the application server receives the binding request and verifies the user account, and if the application server finds the user account in a local database, the user verification is passed;

fourthly, the application server sends an allocation request to the authentication system server, wherein the allocation request comprises the user account and the equipment serial number;

fifthly, the authentication system server receives the user account and the equipment serial number, and generates a unique identification ID by adopting an algorithm according to the user account and the equipment serial number, wherein the algorithm can be AES or SM 3; then, the identification ID is correspondingly stored with the user account and the equipment serial number, and the identification ID can be encrypted for improving the safety;

sixthly, the authentication system server sends the identification ID to the application server;

seventhly, the application server receives the identification ID sent by the authentication system server and sends the identification ID to the mobile terminal;

eighthly, the mobile terminal receives the identification ID and sends a binding authentication request to the application server, wherein the binding authentication request comprises the user account, the equipment serial number and the identification ID;

ninthly, the application server receives the binding authentication request and sends the user account, the equipment serial number and the identification ID to the authentication system server to request binding authentication;

tenth, the authentication system server receives the user account, the equipment serial number and the identification ID, searches a database for the user account and the equipment serial number corresponding to the identification ID according to the identification ID, and if the user account is the same as the user account corresponding to the identification ID and the equipment serial number is the same as the equipment serial number corresponding to the identification ID, the binding authentication is passed, and the mobile terminal and the user account are bound successfully;

step ten, the authentication system server sends a message of successful binding to the application server;

and step twelve, the application server sends the message of successful binding to the mobile terminal.

Fig. 10 is a signaling interaction diagram of a login verification process of a user identity authentication processing method according to an embodiment of the present invention, and as shown in fig. 10, in the user identity authentication processing method provided in the embodiment of the present invention, a process of a user performing login verification at a PC client according to an embodiment is as follows:

the method comprises the following steps that firstly, a user logs in a PC client by using a first user account and a first password;

secondly, the PC client sends the first user account and the first password to the application server to carry out a first login request;

thirdly, the application server receives the first user account and the first password and generates a first character string according to the first user account and the first password; the application server may further randomly generate a first random number; the application server searches a first equipment string number of the mobile terminal corresponding to the first user account in a database, generates a graphic three-dimensional code according to the first character string, the first random number and the first equipment string number, and stores the graphic three-dimensional code;

fourthly, the application server sends the graphic three-dimensional code to the PC client;

fifthly, the PC client displays the received graphic three-dimensional code and waits;

sixthly, the mobile terminal scans the graph three-dimensional code and analyzes the graph three-dimensional code to obtain a second random number;

seventhly, the user initiates a second login request through the mobile terminal;

eighthly, the mobile terminal sends a second login request to the application server, wherein the second login request comprises the second random number, a second user account corresponding to the mobile terminal, a second equipment serial number and an identification ID;

ninthly, the application server receives the second login request sent by the mobile terminal, and then sends a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID;

tenth, the authentication system server receives the second user account, the second device serial number and the identification ID, and searches a user account and a device serial number corresponding to the identification ID in a local database according to the identification ID; if the user account corresponding to the identification ID is the same as the second user account and the equipment serial number corresponding to the identification ID is the same as the second equipment serial number, the user validity verification is passed;

step eleven, the authentication system server searches a second password corresponding to the second user account in a database according to the second user account, and sends a verification passing message to the application server, wherein the verification passing message carries the second user account and the second password;

and step eleven, after receiving the verification passing message, the application server generates a second character string according to the second user account and the second password, and analyzes the stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number. If the application server judges that the first character string is the same as the second character string, the first equipment string number is the same as the second equipment string number, and the first random number is the same as the second random number, the second login request passes verification;

step thirteen, the application server sends the second login request verification passing message to the mobile terminal and the PC client; the PC client verifies a passing message according to the second login request and logs in; the mobile terminal can display prompt information that the first user account successfully logs in the PC client.

Fig. 11 is a schematic entity structure diagram of an application server according to an embodiment of the present invention, and as shown in fig. 11, the application server provided by the present invention includes:

a processor (processor)1101, a memory (memory)1102, and a communication bus 1103;

wherein the content of the first and second substances,

the processor 1101 and the memory 1102 communicate with each other via the communication bus 1103;

the processor 1101 is configured to call the program instructions in the memory 1102 to execute the following user identity authentication processing method, for example, including: receiving a first login request of a first terminal, wherein the first login request comprises a first user account and a first password, and acquiring a first character string according to the first user account and the first password; generating a graphic three-dimensional code according to the first character string, the first random number and a pre-stored first equipment string number of the second terminal, and sending the graphic three-dimensional code to the first terminal; receiving a second login request sent by the second terminal, wherein the second login request comprises a second random number, a second user account, a second equipment serial number and an identification ID of the second terminal; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID; receiving a verification passing message sent by the authentication system server, and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal. Embodiments of the present invention provide a computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions that, when executed by a computer, enable the computer to perform the methods provided by the above-mentioned method embodiments, for example, including: obtaining a sender number of a suspected fraud short message, confirming a keyword of the suspected fraud short message, and obtaining a short message service center access address to which the sender number belongs according to the sender number; inquiring the short messages sent by the sender number in the short message service center according to the access address and the keywords so as to obtain the number of the short messages containing the keywords; if the number of the short messages is judged to be larger than the threshold value, determining that the sender number is a fraud short message number; and sending a halt processing request to the attribution subscriber server to which the fraud short message number belongs so that the attribution subscriber server carries out halt processing on the fraud short message number.

The embodiment of the invention provides a non-transitory computer readable storage medium, which stores computer instructions, where the computer instructions cause the computer to execute a user identity authentication processing method, for example, receiving a first login request of a first terminal, where the first login request includes a first user account and a first password, and obtaining a first character string according to the first user account and the first password; generating a graphic three-dimensional code according to the first character string, the first random number and a pre-stored first equipment string number of the second terminal, and sending the graphic three-dimensional code to the first terminal; receiving a second login request sent by the second terminal, wherein the second login request comprises a second random number, a second user account, a second equipment serial number and an identification ID of the second terminal; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID; receiving a verification passing message sent by the authentication system server, and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal.

An embodiment of the present invention provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, which when executed by a computer, the computer is capable of performing a user identity authentication processing method, for example, comprising: receiving a first login request of a first terminal, wherein the first login request comprises a first user account and a first password, and acquiring a first character string according to the first user account and the first password; generating a graphic three-dimensional code according to the first character string, the first random number and a pre-stored first equipment string number of the second terminal, and sending the graphic three-dimensional code to the first terminal; receiving a second login request sent by the second terminal, wherein the second login request comprises a second random number, a second user account, a second equipment serial number and an identification ID of the second terminal; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number, and the second random number is obtained by the second terminal through scanning the graphic three-dimensional code; sending a request for verifying user validity to the authentication system server, wherein the request for verifying user validity comprises the second user account, the second equipment serial number and the identification ID; receiving a verification passing message sent by the authentication system server, and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; analyzing the locally stored graphic three-dimensional code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the user account is legal.

Fig. 12 is a schematic entity structure diagram of an authentication system server according to an embodiment of the present invention, and as shown in fig. 12, the authentication system server provided in the present invention includes:

a processor (processor)1201, memory (memory)1202, and a communication bus 1203;

wherein the content of the first and second substances,

the processor 1201 and the memory 1202 communicate with each other via the communication bus 1203;

the processor 1201 is configured to call program instructions in the memory 1202 to execute the following user identity authentication processing method, for example, including: receiving a request for verifying user validity sent by an application server, wherein the request for verifying user validity comprises a second user account, a second equipment serial number and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number; and if the second user account and the second equipment serial number are judged to be the same as the locally stored user account and equipment serial number corresponding to the identification ID, sending a verification passing message to the application server, wherein the verification passing message carries the second user account and a second password, and the second password is locally stored in the authentication system server and corresponds to the second user account so that the application server can verify the second login request based on the second password.

The embodiment of the invention provides a non-transitory computer readable storage medium, which stores computer instructions, where the computer instructions cause the computer to execute a user identity authentication processing method, for example, receiving a request for verifying user validity sent by an application server, where the request for verifying user validity includes a second user account, a second device serial number, and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number; and if the second user account and the second equipment serial number are judged to be the same as the locally stored user account and equipment serial number corresponding to the identification ID, sending a verification passing message to the application server, wherein the verification passing message carries the second user account and a second password, and the second password is locally stored in the authentication system server and corresponds to the second user account so that the application server can verify the second login request based on the second password.

An embodiment of the present invention provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, which when executed by a computer, the computer is capable of performing a user identity authentication processing method, for example, comprising: receiving a request for verifying user validity sent by an application server, wherein the request for verifying user validity comprises a second user account, a second equipment serial number and an identification ID; the second user account, the second equipment serial number and the identification ID are carried in a second login request sent by the second terminal to the application server; the identification ID is generated by the authentication system server in advance according to the second user account and the second equipment serial number; and if the second user account and the second equipment serial number are judged to be the same as the locally stored user account and equipment serial number corresponding to the identification ID, sending a verification passing message to the application server, wherein the verification passing message carries the second user account and a second password, and the second password is locally stored in the authentication system server and corresponds to the second user account so that the application server can verify the second login request based on the second password.

Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: various media that can store program codes, such as ROM, RAM, magnetic or optical disks.

Finally, it should be noted that: the above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.

Claims

1. A user identity authentication processing method is characterized by comprising the following steps:

receiving a verification passing message sent by the authentication system server, and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; and analyzing the locally stored three-dimensional graph code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the second user account is legal.

2. The method according to claim 1, wherein before said receiving the first login request of the first terminal, the method further comprises a binding procedure, the binding procedure comprising:

receiving a binding request sent by the second terminal, wherein the binding request comprises the second user account and the second equipment serial number, and if the second user account is judged to be locally stored, sending a distribution request to the authentication system server, wherein the distribution request comprises the second user account and the second equipment serial number;

receiving the identification ID sent by the authentication system server;

sending the identification ID to the second terminal, and receiving a binding authentication request returned by the second terminal, wherein the binding authentication request comprises the second user account, the second equipment serial number and the identification ID;

and forwarding the binding authentication request to the authentication system server, and sending a binding success message to the second terminal after the authentication system server verifies that the second user account and the second equipment serial number are legal according to the identification ID.

3. The method of claim 2, further comprising:

4. An application server, comprising:

the verification unit is used for receiving a verification passing message sent by the authentication system server and generating a second character string according to a second user account and a second password carried by the verification passing message, wherein the second password is stored locally in the authentication system server and corresponds to the second user account; and analyzing the locally stored three-dimensional graph code to obtain the first character string, the first random number and the first equipment string number, and if the first character string is judged to be the same as the second character string, the first random number is the same as the second random number, and the first equipment string number is the same as the second equipment string number, verifying that the second user account is legal.

5. The application server of claim 4, further comprising:

a determining unit, configured to receive a binding request sent by the second terminal, where the binding request includes the second user account and the second device serial number, and send an allocation request to the authentication system server if it is determined that the second user account is locally stored, where the allocation request includes the second user account and the second device serial number;

a second receiving unit configured to receive the identification ID transmitted by the authentication system server;

the second processing unit is configured to send the identification ID to the second terminal, and receive a binding authentication request returned by the second terminal, where the binding authentication request includes the second user account, the second device serial number, and the identification ID;

and the sending unit is used for forwarding the binding authentication request to the authentication system server and sending a binding success message to the second terminal after the authentication system server verifies that the second user account and the second equipment serial number are legal according to the identification ID.

6. The application server of claim 5, further comprising:

the second generating unit is used for generating the activation code and sending the activation code to the second terminal; correspondingly, the activation code is also included in the binding request for authentication.