CN114501441A - User authentication method and device - Google Patents

Abstract

The invention provides a user authentication method and device, wherein the method comprises the following steps: receiving an authentication request sent by a terminal, wherein the authentication request carries a device factor and a private identification of the terminal; searching for a device identifier and a private identifier of the terminal which are locally stored; according to whether the locally stored equipment identifier and the private identifier of the terminal are matched with the equipment identifier sent by the terminal and the private identifier obtained by calculating based on the equipment factor sent by the terminal, authenticating the terminal and obtaining an authentication result; and sending the authentication result to the terminal. The invention can realize the safety certification of the independent hardware equipment, eliminate the influence on all equipment after the key information of the operator is leaked, and reduce the risk of user identity leakage and equipment hardware cracking or embezzlement.

Description

User authentication method and device

technical field

The present invention relates to the technical field of network security and authentication, and in particular, the present invention relates to a user authentication method and device.

Background technique

With the rapid development of the network, more and more attention has been paid to network security issues. It cooperates to realize the admission control of the computer equipment connected to the corresponding network. RADIUS (Remote Authentication Dial In User Service) is a remote user dial-in authentication service protocol with a client/server structure. Its purpose is to authenticate, authorize and account for dial-up users (AAA). Any computer equipment running NAS software can Can be a RADIUS client.

A current user authentication method includes the following steps: the RADIUS server stores the user name and password in clear text in the configuration file or database of the RADIUS server, when a user wants to use a service, he can log in to the client of the service, and then When logging in, the client will be triggered to send an access request to the corresponding access point device. When the access point device receives the access request, it will send an authentication request to the RADIUS server. The authentication request carries the user ID and password. RADIUS The server obtains the corresponding password from the local configuration file or database according to the user ID carried in the authentication request, and compares the password with the password carried in the authentication request. When the password is consistent with the password carried in the authentication request, the RADIUS server sends an authentication pass notification to the access point device; when the password is inconsistent with the password carried in the authentication request, the RADIUS server sends a notification to the access point device Certification failed notification.

In the above authentication method, since the password stored in the RADIUS server is in plain text, the password is easily exposed, and once the user ID and password are exposed, other users can use the password to log in to the client on any computer device. , resulting in the leakage of the user's information, posing a great threat to network security. Simply relying on the user ID and password for authentication, there is a greater security risk.

In addition, there are other requirements that need to be met for user authentication in some application scenarios. For example, currently, cars are authenticated and managed using customized car keys. But in car sharing or car rental scenarios, it is usually impossible to assign a specific key to each customer, thus restricting customers to only rent a car at a specific location and return the car, which brings a lot of inconvenience.

SUMMARY OF THE INVENTION

The technical problem to be solved by the embodiments of the present invention is to provide a user authentication method and device to improve the security and convenience of user authentication.

In order to solve the above technical problems, a user authentication method provided by an embodiment of the present invention includes:

receiving an authentication request sent by a terminal, where the authentication request carries the device factor and private identifier of the terminal;

Find the device identity and private identity of the terminal locally stored;

According to whether the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, the terminal is authenticated, and the authentication is obtained. result;

Send the authentication result to the terminal.

Optionally, when the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, the terminal authentication is obtained. If the authentication result is passed, otherwise, the authentication result of the terminal authentication failure is obtained.

Optionally, according to whether the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, the terminal is Authenticate, including:

Determine whether the locally stored private identifier is the same as the private identifier sent by the terminal: if they are different, obtain the authentication result of the terminal authentication failure; if they are the same, calculate the device identifier of the terminal according to the device factor of the terminal ;

It is judged whether the locally stored device identification is the same as the calculated device identification of the terminal: if they are different, the authentication result of the terminal authentication failure is obtained; if they are the same, the authentication result of the terminal authentication is obtained.

Optionally, before receiving the device factor and private identifier sent by the terminal, the method further includes:

receiving a registration request sent by the terminal and carrying the device factor of the terminal;

According to the device factor sent by the terminal, the private identifier and device identifier of the terminal are obtained by calculation, the generated private identifier of the terminal is sent to the terminal, and the user identity of the terminal and the terminal are established. The corresponding relationship between the private ID and the device ID is stored locally.

Optionally, calculating and obtaining the private identifier and device identifier of the terminal according to the device factor sent by the terminal, including:

Using the first encryption algorithm, the device factor and the first preset parameter sent by the terminal are calculated to obtain the private identifier of the terminal;

Using the second encryption algorithm, the device factor and the second preset parameter sent by the terminal are calculated to obtain the device identifier of the terminal;

Wherein, the first encryption algorithm is different from the second encryption algorithm, and/or the first preset parameter is different from the second preset parameter.

The embodiment of the present invention also provides another user authentication method, which is applied to a terminal, including:

Collect the device factor of the terminal itself and the private identifier stored locally, wherein the private identifier is calculated by the server based on the device factor sent by the terminal and sent to the terminal;

sending an authentication request carrying the device factor and private identifier of the terminal to the server;

Receive the authentication result returned by the server.

Optionally, before collecting the device factor of the terminal itself and the private identifier stored locally, the method further includes:

Collect the device factor of the terminal itself;

sending a registration request carrying the device factor of the terminal to the server;

The private identifier of the terminal sent by the server is received and stored locally in the terminal.

The embodiment of the present invention also provides a server, including:

a first receiving module, configured to receive an authentication request sent by a terminal, where the authentication request carries the device factor and private identifier of the terminal;

a search module, used to search for the device identity and private identity of the terminal that are locally stored;

The authentication module is configured to perform an authentication on the terminal according to whether the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal. Certification, and obtain certification results;

A first sending module, configured to send the authentication result to the terminal.

Optionally, the authentication module is further used for:

Determine whether the locally stored private identifier is the same as the private identifier sent by the terminal: if they are different, obtain the authentication result of the terminal authentication failure; if they are the same, calculate the device identifier of the terminal according to the device factor of the terminal ;

It is judged whether the locally stored device identification is the same as the calculated device identification of the terminal: if they are different, the authentication result of the terminal authentication failure is obtained; if they are the same, the authentication result of the terminal authentication is obtained.

Optionally, the server further includes:

a second receiving module, configured to receive a registration request sent by the terminal that carries the device factor of the terminal;

The registration module is configured to calculate and obtain the private identifier and device identifier of the terminal according to the device factor sent by the terminal, send the generated private identifier of the terminal to the terminal, and establish a user of the terminal The correspondence between the identity and the private identifier of the terminal and the device identifier is stored locally.

Optionally, the registration module is further used for:

Using the first encryption algorithm, the device factor and the first preset parameter sent by the terminal are calculated to obtain the private identifier of the terminal;

Using the second encryption algorithm, the device factor and the second preset parameter sent by the terminal are calculated to obtain the device identifier of the terminal;

Wherein, the first encryption algorithm is different from the second encryption algorithm, and/or the first preset parameter is different from the second preset parameter.

An embodiment of the present invention also provides a terminal, which is characterized by comprising:

a first collection module, configured to collect the device factor of the terminal itself and the private identifier stored locally, wherein the private identifier is calculated by the server based on the device factor sent by the terminal and sent to the terminal;

a first sending module, configured to send an authentication request carrying the device factor and private identifier of the terminal to the server;

The first receiving module is configured to receive the authentication result returned by the server.

Optionally, the terminal further includes:

The second collection module is used to collect the device factor of the terminal itself;

a second sending module, configured to send a registration request carrying the device factor of the terminal to the server;

The second receiving module is configured to receive the private identifier of the terminal sent by the server and store it locally in the terminal.

Embodiments of the present invention further provide a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, implements the steps of the user authentication method described above.

Compared with the prior art, the user authentication method and device provided by the embodiments of the present invention realize independent hardware device security authentication on the user's terminal, which can eliminate the impact on all devices after the operator's key information is leaked, and can also reduce the risk of users. Risk of identity compromise, compromised or theft of device hardware. In this embodiment of the present invention, both the device identification and the private identification are used for user authentication, and these two identifications are different identifications obtained by different calculation methods, and only the private identification is carried in the authentication request, while the device identification needs to be temporarily generated by the server, and then combined with The two local identifiers of the server are matched accordingly. Since the private identifier is generated online and written into the terminal's APP, it can prevent the security risk caused by the leakage of user identity information.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the drawings that are used in the description of the embodiments of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention. , for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

1 is a schematic diagram of an application system of a user authentication method provided by an embodiment of the present invention;

2 is a schematic flowchart of a user authentication method provided by an embodiment of the present invention;

3 is another schematic flowchart of a user authentication method provided by an embodiment of the present invention;

FIG. 4 is an exemplary diagram of a user authentication method provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a server provided by an embodiment of the present invention;

6 is another schematic structural diagram of a server provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a terminal provided by an embodiment of the present invention;

FIG. 8 is another schematic structural diagram of a terminal provided by an embodiment of the present invention.

Detailed ways

In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, detailed description will be given below with reference to the accompanying drawings and specific embodiments. In the following description, specific details such as specific configurations and components are provided merely to assist in a comprehensive understanding of embodiments of the present invention. Accordingly, it should be apparent to those skilled in the art that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted for clarity and conciseness.

It is to be understood that reference throughout the specification to "one embodiment" or "an embodiment" means that a particular feature, structure or characteristic associated with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily necessarily referring to the same embodiment. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more embodiments.

In various embodiments of the present invention, it should be understood that the size of the sequence numbers of the following processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, rather than the implementation of the present invention The implementation of the examples constitutes no limitation.

As described in the background art, some user authentication methods in the prior art have the problem of poor security. In addition, in application scenarios such as car rental, it is desirable to provide an independent authentication solution that does not rely on car keys. In order to solve at least one of the above problems, the embodiment of the present invention provides a user authentication method, which can realize the user authentication process through the user's terminal, such as a smart phone, a tablet computer (PAD) and other devices, so as to get rid of the need for a vehicle. Key dependence, and can improve the security of user authentication.

Referring to FIG. 1 , an embodiment of the present invention provides a user authentication method, which can be applied to a system including a terminal 101 , an application (APP) 111 and a server 121 . here,

The terminal 101 may specifically be various mobile devices, such as a smart phone, a tablet computer (PAD) and other mobile devices. The terminal 101 includes:

Device attributes 102, device attributes can be classified as unique attributes or non-unique attributes. The unique attribute refers to an attribute that can be used to uniquely identify the terminal, which is also referred to as the device factor 103 herein. Non-unique attributes refer to attributes that are shared or the same by multiple endpoints. Specifically, the equipment factor 103 may include various factors of each terminal, such as International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), physical address ( i.e. MAC address), device serial number, device installation ID, etc. Non-unique attributes can be attributes such as device type, model, operating system type, etc.

The APP 111 is a certain application installed on the terminal 101, and may be, for example, a car rental application or the like. The APP111 includes the following functions:

1) Attribute collection 112, which is used to collect the equipment attributes of the terminal, such as equipment factors (unique attributes), and can also collect non-unique attributes.

2) Message generation and interaction 113 , which is used to process device attributes and organize device attributes into messages, and is also responsible for sending and receiving messages between the APP and the server 121 .

3) The private identification storage 114 is used to store the identification related to the APP to prevent the forgery of the APP. Specifically, in this embodiment of the present invention, a private identifier generated by the server based on information such as the device factor of the terminal may be stored.

The server 121 includes the following functions:

Identification generation 122, generating a device identification and a private identification according to the device factor of the terminal.

The message generation and interaction 123 processes the message sending and receiving between the APP (application) of the terminal and the server.

Attribute receiving 124, receiving the device attribute including the device factor sent by the terminal.

Identity authentication 125 , which authenticates the device identity and private identity of the terminal.

The identification binding and storage 126 binds and stores the device identification and private identification of the terminal and the user identity information of the terminal. The user identity information of the terminal may specifically be personal information (such as name, user ID, etc.).

The external information acquisition 127 may acquire the user identity information of the terminal to be bound from an external source.

Referring to FIG. 2 , the user authentication method provided by the embodiment of the present invention, when applied to the server side, includes:

Step 21: Receive an authentication request sent by the terminal, where the authentication request carries the device factor and private identifier of the terminal.

Here, in this embodiment of the present invention, after the terminal logs into the APP, a user authentication process of the terminal may be initiated, that is, the terminal is required to send an authentication request and carry the device factor and private identifier of the terminal. The terminal can use the functions of the APP only after the user's authentication is passed; when the authentication fails, the user's operation will be rejected. Of course, it is also possible to initiate a user authentication process of the terminal when using some predefined functions, and allow the terminal to use the function after the authentication is passed, and reject the terminal to use the function when the authentication fails.

Specifically, the device factor is a device attribute that can uniquely identify the terminal, including but not limited to one or more of the terminal's IMEI, IMSI, MAC address, device serial number, and device installation ID. Optionally, the authentication request may also carry non-unique device attributes of the terminal, such as attributes such as the type, model, and operating system type of the device. The private identifier is an identifier pre-calculated by the server based on the device factor of the terminal and sent to the terminal for storage. The private identifier sent by the server can be stored locally in the terminal through the private identifier storage 114 function of the terminal.

Step 22: Search for the device identifier and private identifier of the terminal that are locally stored.

Here, after receiving the authentication request sent by the terminal, the server searches for the device identifier and private identifier of the terminal stored locally. Specifically, the server may pre-establish a binding relationship between user identities (eg, user ID, name, etc.) of each terminal and the above-mentioned identifiers (including device identifiers and private identifiers). Usually, messages sent by a terminal (such as an authentication request, a registration message, etc.) carry user identity information of the terminal, such as a name or a user ID. In this way, after receiving the above authentication request, the server can locally search the server for the device identifier and private identifier bound to the user identity according to the user identity of the terminal sending the authentication request.

Step 23: Authenticate the terminal according to whether the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, And get the certification result.

Here, if the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal respectively, then the terminal authentication passed The authentication result; otherwise, the authentication result of the terminal authentication failure is obtained.

In order to simplify the matching process, the server can first determine whether the locally stored private identifier is the same as the private identifier sent by the terminal: if they are different, obtain the authentication result of the terminal authentication failure; if they are the same, then according to the device factor of the terminal The device identification of the terminal is obtained by calculation. Then, it is judged whether the locally stored device identification is the same as the calculated device identification of the terminal: if they are different, the authentication result of the terminal authentication failure is obtained; if they are the same, the authentication result of the terminal authentication is obtained.

Step 24: Send the authentication result to the terminal.

Here, the server sends an authentication result indicating authentication failure or authentication pass to the terminal. After receiving the above authentication result, the APP of the terminal can refuse the user to use the APP or refuse to use the specific function of the APP when the authentication fails; , you can allow users to use the APP or allow the use of specific functions of the APP.

Through the above steps, the embodiment of the present invention can realize independent hardware device security authentication based on the user's terminal, can eliminate the impact on all devices after the operator's key information is leaked, and can also reduce the risk of user identity leakage, device hardware being cracked or embezzled . In this embodiment of the present invention, both the device identification and the private identification are used for user authentication, and these two identifications are different identifications obtained by different calculation methods, and only the private identification is carried in the authentication request, while the device identification needs to be temporarily generated by the server, and then combined with The two local identifiers of the server are matched accordingly. Since the private identifier is generated online and written into the APP of the terminal, the security risk caused by the leakage of user identity information can be prevented.

Before the above step 21, the server may also bind the user identity of the terminal with the private identifier and device identifier of the terminal during the terminal registration process.

Specifically, the server may receive a registration request sent by the terminal that carries the device factor of the terminal. Then, according to the device factor sent by the terminal, the private identifier and the device identifier of the terminal are obtained by calculation, the generated private identifier of the terminal is sent to the terminal, and the user identity of the terminal and the device identifier are established. The corresponding relationship between the private identifier of the terminal and the device identifier is stored locally.

Since there are many kinds of device factors, in order to ensure that the server can obtain the device factor used for calculating the device ID or the private ID, and to reduce the unnecessary device factors sent by the terminal, and to improve the information transmission efficiency, the embodiment of the present invention may use a predefined device factor. Device factor list to instruct the terminal to collect and send the device factors in the list. Specifically, in the process of terminal registration, after receiving the registration request that the terminal does not carry the device factor, the server may send a predefined device factor list to the terminal, where the list is used to indicate the device factor that the terminal needs to collect and upload. The terminal collects the relevant equipment factors according to the list, and resends the registration request carrying the relevant equipment factors. The subsequent server may, after receiving the registration request carrying the relevant equipment factors sent by the terminal, , calculate and obtain the private identity and device identity of the terminal, send the generated private identity of the terminal to the terminal, and establish a relationship between the user identity of the terminal and the private identity and device identity of the terminal The corresponding relationship is saved locally. Similarly, in the above step 21, when sending the authentication request, the terminal may collect the relevant device factors according to the list, and then send the authentication request carrying the device factor and private identifier of the terminal. An example of a list of device factors is given in Table 1.

Table 1

In the embodiment of the present invention, in the terminal authentication process, or in the terminal registration process, the server needs to obtain the private identifier and the device identifier of the terminal according to the device factor sent by the terminal. Specifically, the first encryption algorithm can be used to calculate the device factor and the first preset parameter sent by the terminal to obtain the private identifier of the terminal; the second encryption algorithm can be used to calculate the device factor and the first preset parameter sent by the terminal. The second preset parameter is calculated to obtain the device identifier of the terminal. Here, in order to ensure that the device identification is different from the private identification, the first encryption algorithm is usually different from the second encryption algorithm, and/or the first preset parameter is usually different from the second preset parameter. For example, the first encryption algorithm may use a different algorithm or calculation step than the second encryption algorithm to encrypt the device factor and related preset parameters. The specific encryption algorithm may be a hash algorithm or the like. The first preset parameter and the second preset parameter may be information bits defined by the server.

The user authentication method according to the embodiment of the present invention has been described above from the server side. The following is further described from the terminal side.

Referring to FIG. 3 , the user authentication method provided by the embodiment of the present invention, when applied to the terminal side, includes:

Step 31: Collect the device factor of the terminal itself and the private identifier stored locally, wherein the private identifier is calculated by the server based on the device factor sent by the terminal and sent to the terminal.

Here, the terminal may collect the relevant device factors according to the pre-obtained device factor list, and collect the locally stored private identifier of the terminal. The private identifier stored locally by the terminal is calculated by the server in advance based on the device factor sent by the terminal and sent to the terminal, for example, calculated during the terminal registration process and sent to the terminal.

Step 32: Send an authentication request carrying the device factor and private identifier of the terminal to the server.

Here, the terminal sends an authentication request carrying the collected device factor and private identifier of the terminal. The server performs user authentication according to the received device factor and private identifier of the terminal, and the specific authentication method can refer to the description of the relevant steps on the server side above, which will not be repeated here.

Step 33: Receive the authentication result returned by the server.

Here, the authentication result sent by the server to indicate whether the authentication is passed is received. The above-mentioned step 31 may specifically be executed after the user logs in the specific APP, or may be executed when the user uses a specific function of the specific APP. After step 33, if the authentication fails, the user can be refused to use the APP or the specific function of the APP; and when the authentication is passed, the user can be allowed to use the APP or allowed to use the specific function of the APP.

Before the above-mentioned step 31, the above-mentioned terminal may obtain the private identifier through the registration process. Specifically, the above-mentioned terminal may initiate a registration process, and collect the device factor of the terminal itself. Then, a registration request carrying the device factor of the terminal is sent to the server. Then, the private identifier of the terminal sent by the server is received and stored locally in the terminal. During the registration process, the terminal can collect the relevant device factors according to the device factor list sent by the server, and send them to the server in the registration request. The server calculates and obtains the private identifier and device identifier of the terminal according to the device factor sent by the terminal, sends the generated private identifier of the terminal to the terminal, and establishes the user identity of the terminal and the device identifier. The correspondence between the private identifier of the terminal and the device identifier is stored locally on the server. The terminal receives and saves the private identifier sent by the server, which may be specifically received and stored by the specific APP, for example, written into the internal space of the APP.

Figure 4 provides an example diagram of the interaction flow of the authentication process between the server and the terminal, specifically:

In step 401, the user starts an operation, which may specifically be starting a mobile APP on the terminal, or starting a specific function of the mobile APP.

In steps 402 to 403, the mobile APP collects the device factor and private identifier of the terminal, and sends them to the server.

In step 404, the server searches for the device identifier and private identifier bound to the terminal, and matches with the private identifier sent by the terminal.

In step 405, if the two private identifiers match, go to step 407; otherwise, go to step 406.

In step 406, the authentication result of user authentication failure is obtained, and then step 409 is entered.

In steps 407 to 408, the server calculates the device ID according to the device factor sent by the terminal, matches the calculated device ID with the device ID sent by the terminal, and obtains the authentication result of whether the user authentication is passed according to whether the match is successful, and then enters the Step 409.

In step 409, the server returns the authentication result to the mobile APP of the terminal.

In step 410, when the authentication result indicates that the authentication is passed, the mobile APP of the terminal goes to step 411, otherwise, goes to step 412.

In step 411, the mobile APP executes the current operation of the user.

In step 412, the mobile APP rejects the user's current operation.

In addition, in this embodiment of the present invention, multiple weight sets may also be obtained, each weight set includes a weight for each device factor in the device factor list, and these weight sets may be independently provided by multiple experts. Then, according to the preset determination algorithm of the index weight, the multiple weight sets are calculated to obtain a final weight set. Then, according to the device factor and the final weight set, the first/second encryption algorithm is used to obtain the private identifier/device identifier. The following provides a specific example of calculating the private identifier/device identifier. It should be noted that the following is only a calculation method that can be used in the present invention, and is not intended to limit the present invention.

First, set the equipment factor set U={u ₁ , u ₂ , u ₃ ,..., u _n }, and assuming that there are K expert settings, give the independent weights {a _i1 ,a _i2 , a _i3 ,...,a _in }(i=1,2,3,...k). For each expert, the set of settings is as follows:

将权重值从小到大划分为P个间距组。可以得到每个集合对应的权值X_i,设置频率值为N_i,同时计算

基于以上的结果，得到平均的权重

j＝(1,2,3,…,n)。最终，得到权重集合A＝{a₁,a₂,a₃,…,a_n}。Find the largest weight value M _j and the smallest weight value m _j (j=1,2,3,...,n) in each set respectively. To set a positive integer P as the spacing division, use the formula

Divide the weight values into P spacing groups from small to large. The weight X _i corresponding to each set can be obtained, set the frequency value to N _i , and calculate at the same time

Based on the above results, get the average weight

j=(1,2,3,...,n). Finally, the weight set A={a ₁ , a ₂ , a ₃ , . . . , a _n } is obtained.

Suppose the device factor set U={Imei, Mac, Network_address, Device_ID}. Suppose two experts give weight sets {0.5, 0.1, 0.2, 0.2} and {0.4, 0.2, 0.3, 0.1}, and set P=2 as the spacing division. After calculation, the weights of each factor are obtained as shown in Table 2:

equipment factor Weights IMEI 0.325 MAC address (MAC) 0.3 Network address (Network_address) 0.2 Device ID (Device_ID) 0.175

Table 2

Further, combined with the actual situation, the factor weights can be multiplied by the scale coefficient according to the actual proportions of different devices to obtain various factor weights for different devices, as shown in Table 3:

equipment factor Weights Device 1 (75%) Device 2 (25%) Imei 0.325 0.24375 0.08125 Mac 0.3 0.225 0.075 Network_address 0.2 0.15 0.05 Device_ID 0.175 0.13125 0.04375

table 3

Taking the equipment factor set u={100, 200, 150, 300} as an example, suppose there are two experts who give the weight set A ₁ ={0.5, 0.1, 0.2, 0.2}, A ₂ ={0.4, 0.2, 0.3, 0.1}. After calculation, the corresponding set U={90, 60, 75, 120} is obtained:

得到A₁对应的X₁为{0.125，0.075，0.15，0.15}，相应的，A₂对应的X₂为{0.2，0.1，0.15，0.05}The maximum value of A ₁ is 0.5 and the minimum value is 0.1, corresponding to the maximum weight value M _j and the minimum weight value m _j (j=1,2,3,...,n) in each set. Set p=2 , using the formula

The X ₁ corresponding to A ₁ is {0.125, 0.075, 0.15, 0.15}, and correspondingly, the X ₂ corresponding to A ₂ is {0.2, 0.1, 0.15, 0.05}

The corresponding W ₁ is {0.25, 0.75, 0.75, 0.75}, and the corresponding W ₂ is {0.5, 0.5, 0.5, 0.5};

j＝(1,2,3,…,n)。Finally, according to the average coefficient

j=(1,2,3,...,n).

We get a1=21/160, a2=17/160, a3=3/16, a4=22/160.

The corresponding hardware information string is: d.2+15.4+1c.2+29.4.

The splice is: d.215.41c.229.4.

In this way, the encrypted corresponding ciphertext is represented by (MD5 32-bit uppercase: 40935C33AB5A7E4948D27F1795958465. The above ciphertext can be used as a device identification. In addition, some preset character strings or preset ASCII can be spliced after the above ciphertext to obtain The new ciphertext, as a private identifier.

Based on the above user authentication method, an embodiment of the present invention further provides an apparatus for implementing the above method.

Referring to FIG. 5 , a server 50 provided by an embodiment of the present invention includes:

The first receiving module 51 is configured to receive an authentication request sent by a terminal, where the authentication request carries the device factor and private identifier of the terminal;

A search module 52 is used to search for the device identity and private identity of the terminal that are stored locally;

The authentication module 53 is used for determining whether the device identification and private identification of the terminal stored locally match the device identification sent by the terminal and the private identification calculated based on the device factor sent by the terminal. Carry out certification and obtain certification results;

The first sending module 54 is configured to send the authentication result to the terminal.

Through the above modules, the server of the embodiment of the present invention can implement independent hardware device security authentication, eliminate the impact on all devices after the operator's key information is leaked, and can also reduce the risk of user identity leakage and device hardware being cracked or stolen.

Optionally, when the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, the terminal authentication is obtained. If the authentication result is passed, otherwise, the authentication result of the terminal authentication failure is obtained.

Optionally, the authentication module is further used for:

Determine whether the locally stored private identifier is the same as the private identifier sent by the terminal: if they are different, obtain the authentication result of the terminal authentication failure; if they are the same, calculate the device identifier of the terminal according to the device factor of the terminal ;

It is judged whether the locally stored device identification is the same as the calculated device identification of the terminal: if they are different, the authentication result of the terminal authentication failure is obtained; if they are the same, the authentication result of the terminal authentication is obtained.

Optionally, the server further includes:

a second receiving module, configured to receive a registration request sent by the terminal that carries the device factor of the terminal;

The registration module is configured to calculate and obtain the private identifier and device identifier of the terminal according to the device factor sent by the terminal, send the generated private identifier of the terminal to the terminal, and establish a user of the terminal The correspondence between the identity and the private identifier of the terminal and the device identifier is stored locally.

Optionally, the registration module is further used for:

Using the first encryption algorithm, the device factor and the first preset parameter sent by the terminal are calculated to obtain the private identifier of the terminal;

Using the second encryption algorithm, the device factor and the second preset parameter sent by the terminal are calculated to obtain the device identifier of the terminal;

Wherein, the first encryption algorithm is different from the second encryption algorithm, and/or the first preset parameter is different from the second preset parameter.

As shown in FIG. 6 , an embodiment of the present invention further provides a server 60 with another structure. The server 60 specifically includes a processor 61 , a memory 62 , a bus system 63 , a receiver 64 and a transmitter 65 . The processor 61, the memory 62, the receiver 64 and the transmitter 65 are connected through the bus system 63, the memory 62 is used for storing instructions, and the processor 61 is used for executing the instructions stored in the memory 62 to control the receiver 64 to receive signal, and control the transmitter 65 to send the signal;

Wherein, the processor 61 is used to read the program in the memory, and execute the following process:

receiving an authentication request sent by a terminal, where the authentication request carries the device factor and private identifier of the terminal;

Find the device identity and private identity of the terminal locally stored;

According to whether the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, the terminal is authenticated, and the authentication is obtained. result;

Send the authentication result to the terminal.

It should be understood that, in this embodiment of the present invention, the processor 61 may be a central processing unit (Central Processing Unit, referred to as “CPU” for short), and the processor 61 may also be other general-purpose processors, digital signal processors (DSPs), Application Specific Integrated Circuits (ASICs), Off-The-Shelf Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 62 may include read only memory and random access memory and provides instructions and data to the processor 61 . A portion of memory 62 may also include non-volatile random access memory. For example, memory 62 may also store device type information.

In addition to the data bus, the bus system 63 may also include a power bus, a control bus, a status signal bus, and the like. However, for the sake of clarity, the various buses are labeled as bus system 63 in the figure.

In the implementation process, each step of the above-mentioned method can be completed by a hardware integrated logic circuit in the processor 61 or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiments of the present invention may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor. The software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art. The storage medium is located in the memory 62, and the processor 61 reads the information in the memory 62, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.

When the program is executed by the processor, all the implementation manners in the user authentication method shown in FIG. 2 can be implemented, and the same technical effect can be achieved. In order to avoid repetition, details are not repeated here.

In some embodiments of the present invention, a computer-readable storage medium is also provided, on which a program is stored, and when the program is executed by a processor, the following steps are implemented:

receiving an authentication request sent by a terminal, where the authentication request carries the device factor and private identifier of the terminal;

Find the device identity and private identity of the terminal locally stored;

According to whether the locally stored device identifier and private identifier of the terminal match the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal, the terminal is authenticated, and the authentication is obtained. result;

Send the authentication result to the terminal.

When the program is executed by the processor, it can implement all the implementation manners in the above-mentioned method applied to the server side, and can achieve the same technical effect. To avoid repetition, details are not repeated here.

Referring to FIG. 7, an embodiment of the present invention further provides a terminal 70, including:

The first collection module 71 is used to collect the device factor of the terminal itself and the private identifier stored locally, wherein the private identifier is calculated by the server based on the device factor sent by the terminal and sent to the terminal;

a first sending module 72, configured to send an authentication request carrying the device factor and private identifier of the terminal to the server;

The first receiving module 73 is configured to receive the authentication result returned by the server.

Optionally, the terminal further includes:

The second collection module is used to collect the device factor of the terminal itself;

a second sending module, configured to send a registration request carrying the device factor of the terminal to the server;

The second receiving module is configured to receive the private identifier of the terminal sent by the server and store it locally in the terminal.

Please refer to FIG. 8 , which is a schematic structural diagram of a terminal provided by an embodiment of the present invention. The terminal 800 includes: a processor 801 , a transceiver 802 , a memory 803 , a user interface 804 and a bus interface.

In this embodiment of the present invention, the terminal 800 further includes: a program stored on the memory 803 and executable on the processor 801 .

When the processor 801 executes the program, the following steps are implemented: '

Collecting the device factor of the terminal itself and the private identifier stored locally, wherein the private identifier is calculated by the server based on the device factor sent by the terminal and sent to the terminal;

sending an authentication request carrying the device factor and private identifier of the terminal to the server;

Receive the authentication result returned by the server.

Understandably, in this embodiment of the present invention, when the computer program is executed by the processor 801, each process of the method embodiment shown in FIG. 3 can be implemented, and the same technical effect can be achieved. Repeat.

In FIG. 8, the bus architecture may include any number of interconnected buses and bridges, in particular one or more processors represented by processor 801 and various circuits of memory represented by memory 803 linked together. The bus architecture may also link together various other circuits, such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be described further herein. The bus interface provides the interface. Transceiver 802 may be a number of elements, including a transmitter and a receiver, that provide a means for communicating with various other devices over a transmission medium. For different user equipments, the user interface 804 may also be an interface capable of externally connecting the required equipment, and the connected equipment includes but is not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

The processor 801 is responsible for managing the bus architecture and general processing, and the memory 803 may store data used by the processor 801 in performing operations.

In some embodiments of the present invention, a computer-readable storage medium is also provided, on which a program is stored, and when the program is executed by a processor, the following steps are implemented:

Collecting the device factor of the terminal itself and the private identifier stored locally, wherein the private identifier is calculated by the server based on the device factor sent by the terminal and sent to the terminal;

sending an authentication request carrying the device factor and private identifier of the terminal to the server;

Receive the authentication result returned by the server.

When the program is executed by the processor, all the implementation manners in the above-mentioned method applied to the terminal can be realized, and the same technical effect can be achieved. In order to avoid repetition, details are not repeated here.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions in the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed by the present invention. Modifications or substitutions should be included within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims (13)

1. A user authentication method is applied to a server, and is characterized by comprising the following steps:

receiving an authentication request sent by a terminal, wherein the authentication request carries a device factor and a private identification of the terminal;

searching for a device identifier and a private identifier of the terminal which are locally stored;

according to whether the locally stored equipment identifier and the private identifier of the terminal are matched with the equipment identifier sent by the terminal and the private identifier obtained by calculating based on the equipment factor sent by the terminal, authenticating the terminal and obtaining an authentication result;

and sending the authentication result to the terminal.

2. The method of claim 1,

and when the locally stored equipment identifier and the private identifier of the terminal are respectively matched with the equipment identifier sent by the terminal and the private identifier obtained by calculation based on the equipment factor sent by the terminal, obtaining an authentication result that the terminal passes authentication, otherwise, obtaining an authentication result that the terminal fails authentication.

3. The method of claim 1, wherein the authenticating the terminal according to whether the device identifier and the private identifier of the terminal stored locally match with the device identifier sent by the terminal and the private identifier calculated based on the device factor sent by the terminal comprises:

judging whether the private identity stored locally is the same as the private identity sent by the terminal: if the terminal authentication fails, obtaining an authentication result of the terminal authentication failure; if the terminal identification is the same as the equipment identification, calculating to obtain the equipment identification of the terminal according to the equipment factor of the terminal;

judging whether the locally stored equipment identification is the same as the equipment identification of the terminal obtained by calculation: if the terminal authentication fails, obtaining an authentication result of the terminal authentication failure; and if the authentication result is the same, obtaining the authentication result that the terminal passes the authentication.

4. A method according to any of claims 1 to 3, wherein prior to receiving the device factor and the private identity sent by the terminal, the method further comprises:

receiving a registration request which is sent by the terminal and carries the equipment factor of the terminal;

and calculating to obtain the private identification and the equipment identification of the terminal according to the equipment factor sent by the terminal, sending the generated private identification of the terminal to the terminal, establishing a corresponding relation between the user identity of the terminal and the private identification and the equipment identification of the terminal, and storing the corresponding relation locally.

5. The method as claimed in claim 4, wherein said calculating the private identity and the device identity of the terminal according to the device factor sent by the terminal comprises:

calculating the equipment factor and a first preset parameter sent by the terminal by using a first encryption algorithm to obtain a private identifier of the terminal;

calculating the equipment factor and a second preset parameter sent by the terminal by using a second encryption algorithm to obtain an equipment identifier of the terminal;

wherein the first encryption algorithm is different from the second encryption algorithm, and/or the first preset parameter is different from the second preset parameter.

6. A user authentication method is applied to a terminal, and is characterized by comprising the following steps:

collecting the device factors of the terminal and a private identification stored locally, wherein the private identification is obtained by a server based on the device factors sent by the terminal and is sent to the terminal;

sending an authentication request carrying the equipment factor and the private identification of the terminal to a server;

and receiving an authentication result returned by the server.

7. The method of claim 6, wherein prior to collecting the terminal's own device factor and the locally stored private identity, the method further comprises:

collecting the self equipment factors of the terminal;

sending a registration request carrying the equipment factor of the terminal to a server;

and receiving the private identification of the terminal sent by the server and storing the private identification in the local terminal.

8. A server, comprising:

the first receiving module is used for receiving an authentication request sent by a terminal, wherein the authentication request carries an equipment factor and a private identity of the terminal;

the searching module is used for searching the equipment identifier and the private identifier of the terminal stored locally;

the authentication module is used for authenticating the terminal according to whether the locally stored equipment identifier and the private identifier of the terminal are matched with the equipment identifier sent by the terminal and the private identifier obtained by calculation based on the equipment factor sent by the terminal, and obtaining an authentication result;

and the first sending module is used for sending the authentication result to the terminal.

9. The server of claim 8, wherein the authentication module is further to:

judging whether the private identity stored locally is the same as the private identity sent by the terminal: if the terminal authentication fails, obtaining an authentication result of the terminal authentication failure; if the terminal identification is the same as the equipment identification, calculating to obtain the equipment identification of the terminal according to the equipment factor of the terminal;

judging whether the locally stored equipment identification is the same as the equipment identification of the terminal obtained by calculation: if the terminal authentication fails, obtaining an authentication result of the terminal authentication failure; and if the authentication result is the same, obtaining the authentication result that the terminal passes the authentication.

10. The server according to any one of claims 8 to 9, further comprising:

a second receiving module, configured to receive a registration request that is sent by the terminal and carries the device factor of the terminal;

and the registration module is used for calculating to obtain the private identification and the equipment identification of the terminal according to the equipment factor sent by the terminal, sending the generated private identification of the terminal to the terminal, establishing the corresponding relationship between the user identity of the terminal and the private identification and the equipment identification of the terminal, and storing the corresponding relationship locally.

11. The server of claim 10, wherein the registration module is further to:

calculating the equipment factor and a first preset parameter sent by the terminal by using a first encryption algorithm to obtain a private identifier of the terminal;

calculating the equipment factor and a second preset parameter sent by the terminal by using a second encryption algorithm to obtain an equipment identifier of the terminal;

wherein the first encryption algorithm is different from the second encryption algorithm, and/or the first preset parameter is different from the second preset parameter.

12. A terminal, comprising:

the first collection module is used for collecting the device factors of the terminal and the private identification stored locally, wherein the private identification is obtained by the server through calculation based on the device factors sent by the terminal and is sent to the terminal;

the first sending module is used for sending an authentication request carrying the equipment factor and the private identity of the terminal to a server;

and the first receiving module is used for receiving the authentication result returned by the server.

13. The terminal of claim 12, further comprising:

the second collection module is used for collecting the self equipment factors of the terminal;

the second sending module is used for sending a registration request carrying the equipment factor of the terminal to a server;

and the second receiving module is used for receiving the private identity of the terminal sent by the server and storing the private identity in the local terminal.

Images