CN116074009A

CN116074009A - Identity verification method and related device

Info

Publication number: CN116074009A
Application number: CN202111300861.8A
Authority: CN
Inventors: 欧霄; 黄东庆; 郭润增
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2021-11-04
Filing date: 2021-11-04
Publication date: 2023-05-05

Abstract

The embodiment of the application discloses an identity verification method and a related device, which can be applied to the fields of cloud technology, artificial intelligence, intelligent traffic and the like and related scenes. Aiming at the object associated with the platform, the object identifier can play a role of a unique corresponding object, the content to be signed is determined through the object identifier and the random number, the possibility that different objects are determined to be the same content to be signed is reduced, the randomness provided by the random number can be provided on the premise of guaranteeing the uniqueness, and the possibility that the content to be signed is presumed is reduced. The signature sequence comprising N characters is obtained by carrying out data signature on the content to be signed, and a part of M characters are selected as the object authorization code of the object, so that the object authorization code is difficult to predict, and even if an attacker takes the content to be signed, a great deal of cost is required to determine the M characters serving as the object authorization code. And the use scene of the object authorization code is only identity verification, so that the cracking difficulty of the object authorization code is further improved.

Description

Identity verification method and related device

Technical Field

The present disclosure relates to the field of data processing, and in particular, to an authentication method and related apparatus.

Background

The object can obtain the service provided by the platform by accessing the platform interface of the Internet platform. Before providing services for the object, the platform needs to check whether the identity of the object is legal.

In the related art, an object identifier of an object is used as a basis of identity verification, the object identifier is a unique identifier allocated by a platform for the object, and the unique identifier is permanently used as an identifier corresponding to the object after allocation. The generation of the object identification generally follows a certain rule, and the object identification is used by the object when different services of the platform are involved. It can be seen that the regularity and widespread use of object identification results in an attacker easily analyzing the regularity therein to obtain the object identification. Once the object identification is acquired by an attacker, the platform can be attacked in an identity imitation mode and the like.

It can be seen that how to reduce the possibility of the platform being attacked is a problem that needs to be solved under the premise of implementing identity verification.

Disclosure of Invention

In order to solve the technical problems, the application provides an identity verification method and a related device, which have randomness on the premise of guaranteeing uniqueness, reduce possibility of being presumed, reduce complexity of an object authorization code on the premise of meeting identity verification, and improve applicability.

The embodiment of the application discloses the following technical scheme:

in one aspect, an embodiment of the present application provides an authentication method, where the method includes:

acquiring an object identifier of an object associated with the platform;

determining the content to be signed according to the object identifier and the random number corresponding to the object;

carrying out digital signature on the content to be signed to obtain a signature sequence comprising N characters;

determining M characters from N characters of the signature sequence as object authorization codes of the objects, and sending the object authorization codes to the objects, wherein M < N;

acquiring an interface access request comprising an object identifier and a pending authorization code of the object;

and carrying out identity verification according to the to-be-determined authorization code and the object authorization code to determine whether the interface access request is a legal request sent by the object.

On the other hand, the embodiment of the application provides an identity verification device, which comprises an acquisition unit, a determination unit, a signature unit and an identity verification unit:

the acquisition unit is used for acquiring the object identification of the object associated with the platform;

the determining unit is used for determining the content to be signed according to the object identifier and the random number corresponding to the object;

The signature unit is used for carrying out digital signature on the content to be signed to obtain a signature sequence comprising N characters;

the determining unit is further configured to determine M characters from the N characters of the signature sequence as an object authorization code of the object, and send the object authorization code to the object, where M < N;

the acquisition unit is further used for acquiring an interface access request comprising an object identifier and a pending authorization code of the object;

the identity verification unit is used for carrying out identity verification according to the to-be-determined authorization code and the object authorization code so as to determine whether the interface access request is a legal request sent by the object.

In a possible implementation manner, the object authorization code is a temporary authorization code that is valid only for a valid duration, and the determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine M characters from N characters of the signature sequence as the object authorization code of the object, and return the re-determined object authorization code to the object; wherein the M characters re-determined are not exactly the same as the M characters determined to generate the invalid authorization code.

In a possible implementation manner, the acquiring unit is further configured to trigger the determining unit to determine M characters from the N characters of the signature sequence as the object authorization code of the object again when acquiring the authorization code update request sent by the object, and return the re-determined object authorization code to the object.

In a possible implementation manner, the M characters used as the object authorization code are consecutive characters of the N characters, and the determining unit is further configured to:

moving M characters corresponding to the invalid authorization code in a first position interval of the N characters according to a selection rule to obtain a second position interval, wherein the first position interval and the second position interval are used for marking the position range of the M characters in the N characters;

and taking M characters in the second position interval as object authorization codes of the objects according to the N characters.

In a possible implementation manner, the object authorization code is a temporary authorization code valid only for a valid duration, and the apparatus further includes a transmitting unit:

the sending unit is used for sending the signature sequence and a first authorization code updating condition to the object, wherein the first authorization code updating condition is used for indicating the object to re-determine the corresponding object authorization code from the signature sequence based on a first updating rule when the authorization code of the object becomes invalid authorization code;

The determining unit is further configured to re-determine an object authorization code corresponding to the object from the signature sequence based on the first update rule when the object authorization code becomes an invalid authorization code.

the sending unit is used for sending a second authorization code updating condition to the object, wherein the second authorization code updating condition is used for indicating that when an authorization code of the object is changed into an invalid authorization code, the authorization code of the object is redetermined for M characters corresponding to the invalid authorization code based on a second updating rule;

the determining unit is further configured to, when the object authorization code becomes an invalid authorization code, redetermine the object authorization code based on a second update rule for M characters corresponding to the invalid authorization code.

In a possible implementation, the authentication unit is further configured to:

if the pending authorization code is not matched with the object authorization code, determining that the interface access request is an illegal request, and rejecting the access of the interface access request to a platform interface;

And if the pending authorization code is matched with the object authorization code, determining that the interface access request is a legal request sent by the object, and allowing the object to access a corresponding platform interface through the interface access request.

In a possible implementation manner, the interface access request further includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code, and the identity verification unit is further configured to:

carrying out digital signature on the data packet according to the object authorization code to obtain a target service signature sequence;

if the pending service signature sequence is not matched with the target service signature sequence, determining that the interface access request is an illegal request and the service data packet does not pass the integrity detection, and rejecting the access of the interface access request to a platform interface;

and if the pending service signature sequence is matched with the target service signature sequence, determining that the interface access request is a legal request sent by the object, and allowing the object to access a corresponding platform interface through the interface access request through integrity detection of the service data packet.

In a possible implementation manner, the determining unit is further configured to splice the object identifier and the random number to obtain the content to be signed.

In a possible implementation manner, the signature unit is further configured to digitally sign the content to be signed by using an information summarization algorithm to obtain a signature sequence including N characters.

In one possible implementation, the object identification is a merchant number, vendor code, or self-increasing identification of the object.

In yet another aspect, embodiments of the present application provide a computer device comprising a processor and a memory:

the memory is used for storing program codes and transmitting the program codes to the processor;

the processor is configured to perform the authentication method according to the above aspect according to instructions in the program code.

In yet another aspect, embodiments of the present application provide a computer-readable storage medium for storing a computer program for performing the authentication method described in the above aspect.

In yet another aspect, embodiments of the present application provide a computer program product comprising instructions which, when run on a computer, cause the computer to perform the authentication method of the above aspect.

According to the technical scheme, the object identifier of the object associated with the platform can play a role of a unique corresponding object, the object identifier and the random number are used for determining the content to be signed, so that the possibility that different objects are determined to be the same content to be signed can be reduced, the random number can increase a random factor for the content to be signed, the uniqueness is guaranteed, the randomness can be achieved, and the possibility that the content to be signed is presumed is reduced. The signature sequence comprising N characters is obtained by carrying out data signature on the content to be signed, and a part of M characters are selected as the object authorization code of the object, so that the object authorization code is difficult to predict, and even if an attacker takes the content to be signed, a great deal of cost is required to determine M characters serving as the object authorization code from the N characters. Furthermore, the use scene of the object authorization code is only identity verification, so that the cracking difficulty of the object authorization code is further improved. In addition, the number of characters included in the object authorization code is smaller than that of the signature sequence, and on the premise of meeting the authentication, the complexity of the object authorization code is reduced, and the applicability is improved.

When an interface access request comprising the object identification of the object and the pending authorization code is acquired, identity verification can be performed between the pending authorization code and the object authorization code to determine whether the interface access request is a legal request sent by the object.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a schematic diagram of an authentication scenario provided in an embodiment of the present application;

fig. 2 is a method flowchart of an authentication method according to an embodiment of the present application;

fig. 3 is a system schematic diagram of an authentication scenario provided in an embodiment of the present application;

fig. 4 is a device structure diagram of an authentication device according to an embodiment of the present application;

fig. 5 is a block diagram of a terminal device according to an embodiment of the present application;

fig. 6 is a structural diagram of a server according to an embodiment of the present application.

Detailed Description

Embodiments of the present application are described below with reference to the accompanying drawings.

In the related art, the platform performs identity verification on the accessed object through the object identifier of the object, however, the generation of the object identifier generally follows a rule and is widely used, so that an attacker has enough data analysis rule to acquire the object identifier, and platform attack is performed according to the object identifier.

Therefore, the embodiment of the application provides an identity verification method, which is used for verifying the identity, so that the object authorization code is difficult to predict and crack, the complexity of the object authorization code is reduced, and the applicability is improved.

The authentication method provided by the embodiment of the application can be implemented through computer equipment, and the computer equipment can be terminal equipment or a server, wherein the server can be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server for providing cloud computing service. The terminal equipment comprises, but is not limited to, mobile phones, computers, intelligent voice interaction equipment, intelligent household appliances, vehicle-mounted terminals and the like. The terminal device and the server may be directly or indirectly connected through wired or wireless communication, which is not limited herein.

Fig. 1 is a schematic diagram of an authentication scenario provided in the embodiment of the present application, where a server 100 is a server corresponding to a platform, and the platform may be a content platform, a social platform, a management platform, and so on.

The server 100 may obtain an object identification of an object associated with the platform, where the object may be a user, merchant, etc., and the specific type of object is related to the type of platform and is not limited herein. The object identifier belongs to an identifier generated and distributed for the object by the platform, and generally has the function of uniquely identifying the corresponding object.

For an object in the platform, the server 100 may determine a corresponding random number for the object by using a random algorithm, and determine the content to be signed according to the object identifier of the object and the corresponding random number, for example, the object identifier is: 123456, random number: when fds1321 is generated, the random number can be spliced after the object identifier, and the obtained content to be signed is: 123456fds1321. The object identification and the random number are used for determining the content to be signed, so that the possibility that different objects are determined to be the same content to be signed can be reduced, the random number can increase a random factor for the content to be signed, the randomness can be achieved on the premise of guaranteeing the uniqueness, and the possibility that the content to be signed is presumed is reduced.

The server 100 obtains a signature sequence comprising N characters by digitally signing the content to be signed, wherein the digital signature is some data attached to the data unit or is a cryptographic transformation of the data unit. Such data or transformations allow the recipient of the data unit to confirm the source of the data unit and the integrity of the data unit and to protect the data from forgery by a person (e.g., the recipient). It is a method of signing messages in electronic form. The size of N may depend on the encryption algorithm used to sign the data or may be set.

The server 100 does not directly take the signature sequence of N characters as the object authorization code of the object, but determines M characters therefrom as the object authorization code of the object. Making the subject authorization code not only difficult to predict, but also requires a significant amount of cost to determine M characters as the subject authorization code from N characters even when an attacker takes the content to be signed.

After determining the object authorization code, the server 100 transmits the object authorization code to the object, which is acquired by the terminal device 200 in the scenario of fig. 1.

When the object needs to access the platform to obtain the service, the server 100 obtains an interface access request including the object identifier and the pending authorization code of the object, and performs identity verification with the object authorization code according to the pending authorization code to determine whether the interface access request is a legal request sent by the object, and the server 100 may return the identity verification result to the terminal device 200.

Therefore, the use scene of the object authorization code is only identity verification, and the cracking difficulty of the object authorization code is further improved. In addition, the number of characters included in the object authorization code is smaller than that of the signature sequence, and on the premise of meeting the authentication, the complexity of the object authorization code is reduced, and the applicability is improved.

Fig. 2 is a flowchart of a method of authentication according to an embodiment of the present application, in this embodiment, a server will be used as an example of the foregoing computer device. The method comprises the following steps:

s201: and obtaining the object identification of the object associated with the platform.

As previously mentioned, the present application is not limited to the type of platform and object. For example, in one possible implementation, the platform may be a detection platform for a device provider, such as for a social, payment type application, requiring the use of a biometric device, such as a face brushing device, a fingerprint recognition device, etc., in the application context of the application.

These biometric devices are required to be manufactured and delivered by a device manufacturer, and accordingly, the provider of the application program needs to perform quality detection on the delivered device through a detection platform, that is, detect whether the device meets the standard of the corresponding application program through a series of detection items. The detection platform can be a platform special for quality detection, can also be a platform corresponding to social and payment application programs, and can carry out the quality detection by means of strong calculation power of the platform through a function entry built in the application programs. And the equipment manufacturer takes the form of a merchant as the object associated with the detection platform.

The object identifier is used to uniquely identify an object, and an object may have one or more object identifiers in the platform. For example, in the foregoing scenario, the object identification may include at least one of a merchant number, vendor code, or self-increasing identification. The merchant number may be a platform-specific identifier assigned to the merchant by the platform upon registration of the merchant, the vendor code may be a number unique to the device manufacturer, and the self-increasing identifier is a continuously growing number assigned to the associated object by the platform.

In this step, for one object, the object identifier acquired by the server may be one or more, which is not limited in this application.

S202: and determining the content to be signed according to the object identifier and the random number corresponding to the object.

The object identifier can play a role of uniquely identifying the object, and the random number can bring a random factor, so that the content to be signed determined by the object identifier and the random number can also have randomness on the premise of ensuring uniqueness, and the possibility that the content to be signed is presumed is reduced.

The random numbers corresponding to different objects are respectively determined by a random algorithm, and the random numbers can comprise combinations of various characters such as numbers, letters, symbols and the like.

However, since the random algorithm does not reach truly random, it is pseudo random. I.e. the random number generated each time must not have been generated before. Therefore, the object identification of the unique identification object is added when the content to be signed is determined, and the purpose of improving the uniqueness of the content to be signed can be achieved.

The method for determining the content to be signed by the object identification and the random number is not limited, and can be, for example, a splicing and mixing processing method.

In one possible implementation manner, the object identifier and the random number are spliced to obtain the content to be signed.

That is, the form of the obtained content to be signed may be [ object identifier+random number ], or may be [ random number+object identifier ], where "+" is used to represent concatenation, and "[ ]" is the content to be signed.

For example, a unique identifier of a device manufacturer is generated in a system of the test platform, and the unique identifier (such as a merchant number, a merchant id, etc.) of the device manufacturer on the platform is firstly obtained according to the identity of the manufacturer, for example, the merchant number: 12345678.

then a string of randomly generated 16-bit random numbers (for example, including a combination of numbers and letters) is spliced after that: AFDL123a20AKX912, which is to increase the randomness factor, can reduce the attacker from guessing the content to be signed by the object identification. A character string is obtained therefrom: 12345678AFDL123a20AKX912, the content to be signed by the device manufacturer.

S203: and carrying out digital signature on the content to be signed to obtain a signature sequence comprising N characters.

The application is not limited to the Algorithm used to implement the digital signature, for example, in one possible implementation, the content to be signed is digitally signed by a Message-Digest Algorithm (MD 5) to obtain a signature sequence including N characters.

MD5 is a widely used cryptographic hash function that produces a 128-bit (32-bit hexadecimal) hash value (hash value) to ensure complete consistency of information transfer.

For example, for the foregoing example content to be signed: 12345678AFDL123a20AKX912 by MD5 signing the string, a signature sequence of fixed length (32-bit hexadecimal number) comprising a combination of numbers and letters can be obtained, which signature sequence generates a unique result from the correspondence of the content to be signed and is not reverse recoverable. Taking all capital letters here, a signature sequence corresponding to the content to be signed is obtained: 889832E84BB5F68BCB7F9953a1037a82.

S204: m characters are determined from N characters of the signature sequence as an object authorization code of the object, and the object authorization code is sent to the object.

Where M < N, that is, only a part of the signature sequence is used as the object authorization code, and a part of M characters are selected from the signature sequence as the object authorization code of the object, so that the object authorization code is difficult to predict, and even if an attacker takes the content to be signed, it is possible to determine M characters as the object authorization code from N characters at a great cost.

In one example, for the aforementioned signature sequence comprising 32-bit characters (i.e., n=32): 889832E84BB5F68BCB7F9953a1037a82, an object authorization code in which a 16-bit character (i.e., m=16) is the object can be selected. The 16 characters may be 16-bit consecutive characters in the signature sequence or may be hashed characters, which is not limited in this application.

The object authorization code is sent to the object after being determined and is only used for the identity verification link of the object, and the object authorization code is used for only verifying the identity, so that the cracking difficulty of the object authorization code is further improved. In addition, the number of characters included in the object authorization code is smaller than that of the signature sequence, and on the premise of meeting the authentication, the complexity of the object authorization code is reduced, and the applicability is improved. For example, in some authentication scenarios, the pending authorization code in the interface access request needs to be manually input, and the authorization code with a smaller number of characters can also reduce the input difficulty and the possibility of error.

It should be emphasized that the input mode of the pending authorization code in the interface access request is not limited in the present application, and the pending authorization code may be manually input by the object, or may be converted into a form of a page link or a two-dimensional code, etc. to be provided to the object, and the object may implement addition of the pending authorization code in the interface access request by clicking the page link or scanning the two-dimensional code when the interface access request needs to be sent.

It should be noted that the foregoing S201-S204 belong to the preprocessing stage of the object authorization code, and need not be implemented each time before the authentication is performed. After the object authorization codes are determined through S201-S204 for the objects associated with one platform, the object authorization codes may be determined for the objects newly added to the platform without further execution, or by means of periodic execution, triggering execution, or the like.

That is, there is no strict execution order restriction between S201-S204 and S205. The authentication of the interface access request may be performed after the object authorization code is determined for all the objects associated with one platform, or the authentication may be performed on the interface access request of the object for which the object authorization code has been obtained during the process of determining the object authorization code.

S205: an interface access request including an object identification of the object and a pending authorization code is obtained.

After the object associated with the platform acquires the corresponding object authorization code through S204, the object authorization code may be carried for the platform to authenticate itself when the platform needs to be accessed to acquire the service.

For the server for obtaining the interface access request, the server carries an object authorization code which needs to be authenticated, and the authenticity of the object authorization code is not known before the authentication result is obtained, so that the object authorization code to be authenticated in the interface access request is marked as the to-be-authenticated authorization code in the step.

For example, in the aforementioned quality detection scenario for biometric devices, the acquired object authorization code may be carried in an interface access request for sending to the platform an interface access request including device quality parameters. The purpose of carrying out identity verification on the interface access request is to ensure that the request of equipment detection comes from a manufacturer corresponding to the equipment model, and to avoid flooding attack on the detection interface from the safety point of view. Broad flooding attack means that a malicious user counterfeits a large number of requests to send to a server by using a tool, and the server resources are maliciously exhausted, so that a legal user cannot obtain a server response.

By carrying out identity verification before actually processing the interface access request, the illegal interface access request is directly discarded or not processed, so that the influence of flooding attack on the platform can be effectively prevented.

S206: and carrying out identity verification according to the to-be-determined authorization code and the object authorization code to determine whether the interface access request is a legal request sent by the object.

Since the server can determine the object that sent the interface access request when it obtains the interface access request, the object authorization code of the object maintained at the server can be obtained based on the object identification. The manner in which verification is performed by the pending authorization code and the subject authorization code is not limited in this application.

The identity verification result can be obtained through verification, so that whether the interface access request comes from a legal object, namely whether the interface access request is a legal request sent by the object or not is identified.

Therefore, aiming at the object associated with the platform, the object identifier can play a role of a unique corresponding object, and the content to be signed is determined through the object identifier and the random number, so that the possibility that different objects are determined to be the same content to be signed can be reduced, the random number can increase a random factor for the content to be signed, the randomness can be realized on the premise of ensuring the uniqueness, and the possibility that the content to be signed is presumed is reduced. The signature sequence comprising N characters is obtained by carrying out data signature on the content to be signed, and a part of M characters are selected as the object authorization code of the object, so that the object authorization code is difficult to predict, and even if an attacker takes the content to be signed, a great deal of cost is required to determine M characters serving as the object authorization code from the N characters. Furthermore, the use scene of the object authorization code is only identity verification, so that the cracking difficulty of the object authorization code is further improved. In addition, the number of characters included in the object authorization code is smaller than that of the signature sequence, and on the premise of meeting the authentication, the complexity of the object authorization code is reduced, and the applicability is improved.

In order to further improve the difficulty of cracking the object authorization code by an attacker, a corresponding effective duration can be configured for the object authorization code, so that the object authorization code is effective in the effective duration and can be used for identity verification, and when the effective duration is exceeded, the object authorization code is switched into an invalid authorization code by a server, and cannot be used as a basis of identity verification or cannot obtain a result passing the identity verification. In this case, even if the attacker successfully obtains the object authorization code, the attacker can only attack the platform within the effective duration of the object authorization code, so that the degree of attack of the platform is reduced. Furthermore, even if the attacker has the technology of acquiring the object authorization code, the object authorization code has high difficulty to be cracked, so that the object authorization code is possibly switched to the invalid authorization code when the attacker acquires the object authorization code, and the security of the platform is further improved.

The validity period may be timed from when the subject authorization code is determined or may be timed when it is confirmed that the subject authorization code is sent to the subject. The present application is not limited to the length of the effective period of time, and may be, for example, several days, several weeks, or the like.

In one possible implementation, the object authorization code is a temporary authorization code that is valid only for a valid duration, and when the object authorization code becomes an invalid authorization code, the method further comprises:

and re-determining M characters from N characters of the signature sequence as an object authorization code of the object, wherein the re-determined M characters are different from M characters determined by generating the invalid authorization code.

That is, for an object, when the object authorization code that the server last determined for becomes an invalid authorization code, the server may determine an available object authorization code for the object again, and since the signature sequence including N characters has been determined in the foregoing S203 and only M characters are used as the object authorization code through S204, when the object authorization code is newly determined this time, the character may be continuously selected from the signature sequence, and the M characters selected this time are not identical to the M characters of the object authorization code that was previously determined.

The present application does not limit the timing of redefining the object authorization code, and the server may start redefining a new object authorization code for a certain object when the object authorization code of the object is found to be an invalid authorization code, or may initiate updating of the object authorization code to the server by the object itself.

In one possible implementation, the method further includes: and the server acquires an authorization code update request sent by the object. At this time, the server performs an operation of re-determining the authorization code of the object based on the signature sequence corresponding to the object.

In this case, the server may not need to monitor whether the object authorization code of each object is valid all the time in real time, and also need not to determine a new object authorization code immediately when the object becomes invalid authorization code, and only need to determine a new object authorization code for the object when the object is needed, thereby reducing consumption of system resources and improving system stability.

In determining a new object authorization code, embodiments of the present application provide a possible implementation in which M characters used as the object authorization code are consecutive characters of the N characters.

The operation for re-determining M characters from the N characters of the signature sequence as the object authorization code of the object may include the steps of:

step 1: and moving M characters corresponding to the invalid authorization code in a first position interval in the N characters according to a selection rule to obtain a second position interval.

The first location interval and the second location interval each identify a location range of M characters among the N characters.

Step 2: and taking M characters in the second position interval as object authorization codes of the objects according to the N characters.

For example, the N characters in the signature sequence are sequentially from left to right in positions 1-N, and the position range identified by the first position interval in the signature sequence may be from position i to position i+m-1, and the selection rule may be shift according to a certain direction or may be other selection manners. Taking shifting as an example, the range of positions identified by the second position interval in the signature sequence may be positions i+1 to i+m, assuming a shift of one bit to the right.

Signature sequence with the aforementioned 32-bit character: 889832E84BB5F68BCB7F9953a1037a82 for example, in the case of n=32, m=16, the object authorization code determined for the object for the first time may be the first 16-bit character: 889832E84BB5F68B, the second redetermined object authorization code may be based on a one-bit right-shifting rule, resulting in 16 characters of: 89832E84BB5F68BC and so on, so that 16 object authorization codes can be determined for the object by the signature sequence.

The signature sequence may be replaced with 16 months when the effective duration is one month, and with 4 months when the effective duration is one week.

And the selection rules can be set more abundantly by combining requirements and scenes, so that more flexibility is brought to the authentication of the server. If the validity period is one month, the server may shift the result of the object authorization code according to the current month, for example, if the validity period is 5 months, the object authorization code takes the 16-bit string from the 5 th bit of the MD5 result, and so on, so that the effect of automatically switching the authorization code every month is automatically achieved.

When the signature sequence needs to be replaced, a random number can be redetermined for the object, and then a new signature sequence can be redetermined for the object in a manner based on S202-S203. So that it can continue to determine the object authorization code back to the object in the manner of S204 based on the newly determined signature sequence.

In a scenario where the object authorization code is a temporary authorization code that is valid only for a valid duration, in addition to the foregoing scheme that the server needs to send the redetermined object authorization code to the object when the object authorization code becomes an invalid authorization code, the embodiments of the present application further provide a manner of redetermining the object authorization code, in this manner, without having to interact additional data between the server and the object, and also allow the object to obtain the redetermined object authorization code after the object authorization code becomes an invalid authorization code.

It should be noted that, in this determination mode, the M characters of the authorization code of the object that is redetermined are not identical to the M characters of the invalid authorization code.

The following description is primarily based on two main implementations. In both ways, the object authorization code is a temporary authorization code that is valid only for a valid duration.

First object authorization code redetermining method:

step 11: the signature sequence and a first authorization code update condition are sent to the object.

The first authorization code update condition is used for indicating the object to redetermine the corresponding object authorization code from the signature sequence based on a first update rule when the object changes to an invalid authorization code.

Step 12: and when the object authorization code is changed into an invalid authorization code, re-determining the object authorization code corresponding to the object from the signature sequence based on the first updating rule.

In this determination manner, when the server sends the object authorization code to the object, the signature content including N characters determined in S203 may also be sent to the object, and at the same time, the first authorization code update condition may also be sent to instruct the object to redetermine what update rule is adopted when the object authorization code needs to be redetermined.

When the currently used object authorization code becomes an invalid authorization code, the server and the two ends of the object can adopt the same updating rule, namely the first updating rule indicated in the first authorization code updating condition, and the same object authorization code is redetermined from the signature content, so that the object authorization codes at the two ends of the server and the object are resynchronized, the server does not need to send new object authorization codes to the object again, the exposure times of the object authorization codes in the using process are reduced, and the possibility of being intercepted by an attacker when the new object authorization code is sent to the object is reduced.

The specific rule form of the first updating rule is not limited in this application, as long as the server and the two ends of the object can obtain the same object authorization code each time a new object authorization code can be redetermined.

For example, the first updating rule may select M characters from the signature content as the object authorization code according to a specified number of bits or order for each re-determination; or when M characters are continuous characters in the signature content, selecting continuous M characters in the signature content as an object authorization code according to a preset shift bit number and the like when re-determining each time.

Second object authorization code redetermination method:

step 21: and sending a second authorization code update condition to the object.

The second authorization code updating condition is used for indicating that when the authorization code of the object is changed into an invalid authorization code, the authorization code of the object is redetermined for M characters corresponding to the invalid authorization code based on a second updating rule;

step 22: and when the object authorization code is changed into an invalid authorization code, re-determining the object authorization code based on a second updating rule for M characters corresponding to the invalid authorization code.

In this determination mode, when the server sends the object authorization code to the object, the server may also send a second authorization code update condition to instruct the object to redetermine with what update rule when the object authorization code needs to be redetermined.

When the currently used object authorization code becomes an invalid authorization code, the server and the two ends of the object can re-determine the same object authorization code from the changed invalid authorization code by adopting the same updating rule, namely the second updating rule indicated in the second authorization code updating condition, thereby realizing the re-synchronization of the object authorization codes at the two ends of the server and the object without sending a new object authorization code to the object again through the server, thereby reducing the exposure times of the object authorization code in the use process and reducing the possibility of being intercepted by an attacker when sending the new object authorization code to the object.

The specific rule form of the second updating rule is not limited in this application, as long as the server and the two ends of the object can obtain the same object authorization code each time a new object authorization code can be redetermined.

For example, the second updating rule may rearrange M characters of the invalid authorization code in a specified rearrangement manner to obtain the object authorization code for each redetermination, or convert new M characters based on the M characters as the object authorization code based on a specified data conversion manner, or the like.

Next, with respect to S206, several main authentication methods provided in the embodiments of the present application are described.

The first authentication mode: authentication is performed based on matching of the authorization codes.

In view of the fact that the object authorization code provided by the application is difficult to crack, if an attacker cracks the object identification used for identity verification in the related art, the attacker wants to impersonate the identity attack platform of the object, and the attacker can carry the object identification of a legal object in an interface access request sent to the platform, but the authorization code will not be the correct object authorization code of the object.

The server may determine the corresponding object authorization code stored in the server by the object identification and determine whether to actually process the interface access request based on a result of matching the pending authorization code in the interface access request with the object authorization code. Therefore, the interface access request which does not carry the right object authorization code can be shielded in the initial stage, even if an attacker initiates a flooding attack, the influence of the flooding attack can only stay in the initial authentication stage, once the authentication cannot be passed, the platform interface cannot be accessed, namely, the platform cannot only actually process the interface access request, so that the influence on the actual service of the platform is very little.

The second authentication mode: authentication is based on integrity detection.

In this manner, the interface access request further includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code.

That is, the embodiment of the application also provides a link of borrowing the object authorization code to the integrity detection, and the server can complete the authentication work of the access request of the interface while realizing the integrity detection, thereby not only improving the efficiency, but also saving the system resources.

When the server determines that the interface access request further comprises a service data packet and a service signature sequence to be determined, a corresponding object authorization code can be determined based on the object identifier carried in the interface access request, and then the service data packet is digitally signed based on the object authorization code to obtain a target service signature sequence.

The related description of the digital signature mentioned herein may refer to the foregoing embodiment corresponding to fig. 2, and will not be repeated herein. If the pending service signature sequence obtained according to the service data packet can be matched with the target service signature sequence, the verification of the identity can be realized, the verification belongs to legal requests, and meanwhile, the integrity detection can be finished, and the fact that the service data packet is not tampered by an attacker in the transmission process is confirmed.

Therefore, through the second identity verification mode, identity verification and integrity detection of the service data packet can be completed based on one-time verification operation, and the efficiency of the identity verification is improved.

Next, description will be made by using an application scenario, such as the scenario shown in fig. 3, which is the aforementioned quality detection scenario for the biometric equipment, where the platform is a platform for quality detection, and identity verification and service are performed through cooperation between the service module 311, the vendor authorization code verification module 312, and the vendor authorization code acquirer 313 configured in the server 310. The object associated with the platform is a vendor that provides the biometric device, and the vendor system 320 interacts with the business service module 311 of the management platform interface to perform business processes.

The business service module 311 obtains the vendor's currently valid object authorization code from the vendor authorization code acquirer 313 and provides knowledge to the vendor in some way, such as through a special web page, rather than being provided in every interface interaction.

After the manufacturer receives the authorization code, the authorization code of the assigned object is carried in the process of the interaction between the manufacturer system 320 and the interface of the business service module 311, and is transmitted to the business service module 311 together with the interface parameters through the interface access request. When receiving the interface access request, the service module 311 uniformly transmits the received pending authorization code and manufacturer identification to the manufacturer authorization code verification module 312 for identity verification, and when the identity verification is passed (i.e. the pending authorization code provided by the manufacturer system is valid and corresponds to the identity of the manufacturer identification), the service module 311 performs the logical operation of the interface, and if the interface is invalid (the object authorization code has expired to become the invalid authorization code or does not match the identity), the interface access request is refused.

Thus, the method for verifying the identity of the manufacturer through the object authorization code uses the identity of the manufacturer to add a random string and uses MD5 to further convert to obtain the object authorization code; then the validity period is set manually and refreshed, or the validity period verification of the authorization code is maintained in a mode of automatically shifting the authorization code of the update object along with the validity period; and finally, guaranteeing the credibility and the integrity of the data by directly comparing the authorization codes or digitally signing the data packet by using the authorization codes. Based on the scheme, the object authorization code can be effectively prevented from being forged or guessed, the cost of human intervention can be reduced, the effect of the authorization code is expanded, and the additional effect of data integrity verification is achieved.

On the basis of the foregoing embodiments corresponding to fig. 1 to fig. 3, fig. 4 is a device structure diagram of an authentication device provided in this embodiment of the present application, where the authentication device 400 includes an obtaining unit 401, a determining unit 402, a signature unit 403, and an authentication unit 404:

the acquiring unit 401 is configured to acquire an object identifier of an object associated with the platform;

the determining unit 402 is configured to determine content to be signed according to the object identifier and a random number corresponding to the object;

The signing unit 403 is configured to digitally sign the content to be signed to obtain a signature sequence including N characters;

the determining unit 402 is further configured to determine M characters from the N characters of the signature sequence as an object authorization code of the object, and send the object authorization code to the object, where M < N;

the obtaining unit 401 is further configured to obtain an interface access request including an object identifier and a pending authorization code of the object;

the authentication unit 404 is configured to perform authentication according to the pending authorization code and the object authorization code, so as to determine whether the interface access request is a legal request sent by the object.

In a possible implementation, the authentication unit is further configured to:

The embodiment of the application also provides a computer device, which is the computer device introduced above, and may include a terminal device or a server, where the authentication device described above may be configured in the computer device. The computer device is described below with reference to the accompanying drawings.

If the computer device is a terminal device, please refer to fig. 5, an embodiment of the present application provides a terminal device, taking the terminal device as a mobile phone as an example:

fig. 5 is a block diagram showing a part of the structure of a mobile phone related to a terminal device provided in an embodiment of the present application. Referring to fig. 5, the mobile phone includes: radio Frequency (RF) circuitry 1410, memory 1420, input unit 1430, display unit 1440, sensor 1450, audio circuitry 1460, wireless fidelity (Wireless Fidelity, wiFi) module 1470, processor 1480, and power supply 1490. Those skilled in the art will appreciate that the handset configuration shown in fig. 5 is not limiting of the handset and may include more or fewer components than shown, or may combine certain components, or may be arranged in a different arrangement of components.

The following describes the components of the mobile phone in detail with reference to fig. 5:

The RF circuit 1410 may be used for receiving and transmitting signals during a message or a call, and particularly, after receiving downlink information of a base station, the downlink information is processed by the processor 1480; in addition, the data of the design uplink is sent to the base station. Typically, the RF circuitry 1410 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, LNA for short), a duplexer, and the like. In addition, the RF circuitry 1410 may also communicate with networks and other devices through wireless communications. The wireless communication may use any communication standard or protocol, including but not limited to global system for mobile communications (Global System of Mobile communication, GSM for short), general packet radio service (General Packet Radio Service, GPRS for short), code division multiple access (Code Division Multiple Access, CDMA for short), wideband code division multiple access (Wideband Code Division Multiple Access, WCDMA for short), long term evolution (Long Term Evolution, LTE for short), email, short message service (Short Messaging Service, SMS for short), and the like.

The memory 1420 may be used to store software programs and modules, and the processor 1480 performs various functional applications and data processing of the cellular phone by executing the software programs and modules stored in the memory 1420. The memory 1420 may mainly include a storage program area that may store an operating system, application programs required for at least one function (such as a sound playing function, an image playing function, etc.), and a storage data area; the storage data area may store data (such as audio data, phonebook, etc.) created according to the use of the handset, etc. In addition, memory 1420 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

The input unit 1430 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the handset. In particular, the input unit 1430 may include a touch panel 1431 and other input devices 1432. The touch panel 1431, also referred to as a touch screen, may collect touch operations thereon or thereabout by a user (e.g., operations of the user on the touch panel 1431 or thereabout by using any suitable object or accessory such as a finger, a stylus, etc.), and drive the corresponding connection device according to a predetermined program. Alternatively, the touch panel 1431 may include two parts, a touch detection device and a touch controller. The touch detection device detects the touch azimuth of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device and converts it into touch point coordinates, which are then sent to the processor 1480, and can receive commands from the processor 1480 and execute them. Further, the touch panel 1431 may be implemented in various types such as a resistive type, a capacitive type, an infrared type, and a surface acoustic wave type. The input unit 1430 may include other input devices 1432 in addition to the touch panel 1431. In particular, the other input devices 1432 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, mouse, joystick, etc.

The display unit 1440 may be used to display information input by a user or information provided to the user and various menus of the mobile phone. The display unit 1440 may include a display panel 1441, and optionally, the display panel 1441 may be configured in a form of a liquid crystal display (Liquid Crystal Display, LCD), an Organic Light-Emitting Diode (OLED), or the like. Further, the touch panel 1431 may overlay the display panel 1441, and when the touch panel 1431 detects a touch operation thereon or nearby, the touch operation is transferred to the processor 1480 to determine the type of the touch event, and then the processor 1480 provides a corresponding visual output on the display panel 1441 according to the type of the touch event. Although in fig. 5 the touch panel 1431 and the display panel 1441 are two separate components to implement the input and input functions of the mobile phone, in some embodiments, the touch panel 1431 may be integrated with the display panel 1441 to implement the input and output functions of the mobile phone.

The handset can also include at least one sensor 1450, such as a light sensor, motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor that may adjust the brightness of the display panel 1441 according to the brightness of ambient light, and a proximity sensor that may turn off the display panel 1441 and/or the backlight when the phone is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the acceleration in all directions (generally three axes), and can detect the gravity and direction when stationary, and can be used for applications of recognizing the gesture of a mobile phone (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration recognition related functions (such as pedometer and knocking), and the like; other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc. that may also be configured with the handset are not described in detail herein.

Audio circuitry 1460, speaker 1461, microphone 1462 may provide an audio interface between the user and the handset. The audio circuit 1460 may transmit the received electrical signal after the audio data conversion to the speaker 1461, and the electrical signal is converted into a sound signal by the speaker 1461 and output; on the other hand, the microphone 1462 converts the collected sound signals into electrical signals, which are received by the audio circuit 1460 and converted into audio data, which are processed by the audio data output processor 1480 and sent via the RF circuit 1410 to, for example, another cell phone, or which are output to the memory 1420 for further processing.

WiFi belongs to a short-distance wireless transmission technology, and a mobile phone can help a user to send and receive emails, browse webpages, access streaming media and the like through a WiFi module 1470, so that wireless broadband Internet access is provided for the user. Although fig. 5 shows a WiFi module 1470, it is understood that it does not belong to the necessary components of a cell phone, and can be omitted entirely as needed within the scope of not changing the essence of the invention.

The processor 1480 is a control center of the mobile phone, connects various parts of the entire mobile phone using various interfaces and lines, and performs various functions and processes data of the mobile phone by running or executing software programs and/or modules stored in the memory 1420, and calling data stored in the memory 1420, thereby performing overall monitoring of the mobile phone. In the alternative, processor 1480 may include one or more processing units; preferably, the processor 1480 may integrate an application processor that primarily handles operating systems, user interfaces, applications, etc., with a modem processor that primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 1480.

The handset further includes a power supply 1490 (e.g., a battery) for powering the various components, which may be logically connected to the processor 1480 via a power management system so as to provide for managing charge, discharge, and power consumption by the power management system.

Although not shown, the mobile phone may further include a camera, a bluetooth module, etc., which will not be described herein.

In this embodiment, the processor 1480 included in the terminal apparatus also has the following functions:

acquiring an object identifier of an object associated with the platform;

If the computer device is a server, as shown in fig. 6, fig. 6 is a block diagram of the server 1500 provided in the embodiment of the present application, where the server 1500 may have a relatively large difference due to different configurations or performances, and may include one or more central processing units (Central Processing Units, abbreviated as CPU) 1522 (e.g., one or more processors) and a memory 1532, one or more storage media 1530 (e.g., one or more mass storage devices) storing application programs 1542 or data 1544. Wherein the memory 1532 and the storage medium 1530 may be transitory or persistent storage. The program stored on the storage medium 1530 may include one or more modules (not shown), each of which may include a series of instruction operations on the server. Still further, the central processor 1522 may be configured to communicate with a storage medium 1530 and execute a series of instruction operations on the storage medium 1530 on the server 1500.

The Server 1500 may also include one or more power supplies 1526, one or more wired or wireless network interfaces 1550, one or more input/output interfaces 1558, and/or one or more operating systems 1541, such as Windows Server ^TM ，Mac OS X ^TM ，Unix ^TM ,Linux ^TM ，FreeBSD ^TM Etc.

The steps performed by the server in the above embodiments may be based on the server structure shown in fig. 6.

In addition, the embodiment of the application also provides a storage medium for storing a computer program for executing the method provided by the embodiment.

The present embodiments also provide a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method provided by the above embodiments.

Those of ordinary skill in the art will appreciate that: all or part of the steps for implementing the above method embodiments may be implemented by hardware related to program instructions, where the above program may be stored in a computer readable storage medium, and when the program is executed, the program performs steps including the above method embodiments; and the aforementioned storage medium may be at least one of the following media: read-only Memory (ROM), RAM, magnetic disk or optical disk, etc.

It should be noted that, in the present specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment is mainly described in a different point from other embodiments. In particular, for the apparatus and system embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, with reference to the description of the method embodiments in part. The apparatus and system embodiments described above are merely illustrative, in which elements illustrated as separate elements may or may not be physically separate, and elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.

The foregoing is merely one specific embodiment of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present application should be covered in the protection scope of the present application. Further combinations of the implementations provided in the above aspects may be made to provide further implementations. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of identity verification, the method comprising:

acquiring an object identifier of an object associated with the platform;

2. The method of claim 1, wherein the object authorization code is a temporary authorization code that is valid only for a valid duration, the method further comprising, when the object authorization code becomes an invalid authorization code:

re-determining M characters from N characters of the signature sequence as object authorization codes of the object, and returning the re-determined object authorization codes to the object; wherein the M characters re-determined are not exactly the same as the M characters that generated the invalid authorization code.

3. The method according to claim 2, wherein the method further comprises:

and if the authorization code updating request sent by the object is acquired, executing the operation of re-determining M characters from N characters of the signature sequence as the object authorization code of the object and returning the re-determined object authorization code to the object.

4. The method of claim 2, wherein the M characters used as the object authorization code are consecutive ones of the N characters, and wherein the re-determining M characters from the N characters of the signature sequence as the object authorization code for the object comprises:

5. The method of claim 1, wherein the object authorization code is a temporary authorization code that is valid only for a valid duration, the method further comprising:

The signature sequence and a first authorization code updating condition are sent to the object, wherein the first authorization code updating condition is used for indicating the object to re-determine the corresponding object authorization code from the signature sequence based on a first updating rule when the authorization code of the object changes into an invalid authorization code;

and when the object authorization code is changed into an invalid authorization code, re-determining the object authorization code corresponding to the object from the signature sequence based on the first updating rule.

6. The method of claim 1, wherein the object authorization code is a temporary authorization code that is valid only for a valid duration, the method further comprising:

sending a second authorization code updating condition to the object, wherein the second authorization code updating condition is used for indicating the object to re-determine the authorization code of the object based on a second updating rule through M characters corresponding to the invalid authorization code when the authorization code is changed into the invalid authorization code;

when the object authorization code becomes an invalid authorization code, the object authorization code is redetermined based on a second updating rule by M characters corresponding to the invalid authorization code.

7. The method according to any one of claims 1-6, wherein said authenticating with said object authorization code based on said pending authorization code to determine if said interface access request is a legitimate request sent by said object comprises:

8. The method according to any one of claims 1-6, wherein the interface access request further includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code, and the performing identity verification according to the pending authorization code and the object authorization code to determine whether the interface access request is a legal request sent by the object includes:

9. The method according to any one of claims 1-6, wherein the determining the content to be signed according to the object identifier and the random number corresponding to the object comprises:

and splicing the object identifier and the random number to obtain the content to be signed.

10. The method according to any one of claims 1-6, wherein digitally signing the content to be signed results in a signature sequence comprising N characters, comprising:

and carrying out digital signature on the content to be signed through a message digest algorithm to obtain a signature sequence comprising N characters.

11. The method of any of claims 1-6, wherein the object identification is a merchant number, vendor code, or self-increasing identification of the object.

12. An authentication apparatus, characterized in that the apparatus comprises an acquisition unit, a determination unit, a signature unit and an authentication unit:

13. A computer device, the computer device comprising a processor and a memory:

the processor is configured to perform the authentication method according to any one of claims 1-11 according to instructions in the program code.

14. A computer readable storage medium, characterized in that the computer readable storage medium is for storing a computer program for executing the authentication method according to any one of claims 1-11.

15. A computer program product comprising instructions which, when run on a computer, cause the computer to perform the authentication method of any of claims 1-11.