TW201947434A - Application login method - Google Patents

Abstract

An application login method includes: an APP in a first login status transmitting a first token and a user account to a cloud server; the cloud server transmitting the update first token back to a mobile device when judging the successful login to a fist stage operation status; the APP in a second login status transmitting the decrypted first token, the decrypted user account, and a second stage login password to the cloud server; the cloud server allowing the APP to keep in a second stage operation status in a predetermined condition when judging the successful login to the second stage operation status. Using the login method not only enables two stage login and quick login feature, but also has higher security.

Description

Application login method

The invention relates to a login method, in particular to a login method of an application program (APP) on a mobile device.

With the popularization of mobile devices (such as smart phones) and their increasingly powerful performance, various enterprise-related applications (APPs) have also increased significantly. Especially in the applications provided by the financial industry (such as banks), it is necessary not only to consider the issue of user experience, but also to pay attention to customer privacy and security required by financial regulations. Therefore, how to provide an application login method with both security and user experience has become an important issue.

Therefore, an object of the present invention is to provide a login method for an application program with a two-stage and fast login feature.

Therefore, the method for logging in the application of the present invention is applicable to a mobile device and a cloud server, and includes steps (a) to (d).

In step (a), the mobile device executes an application in a first-stage login state, and the mobile device transmits a decrypted first token and a user account to the cloud server, And destroy the first token.

In step (b), when the cloud server determines that the first token and the user account match according to a comparison table, it further determines that the application successfully logs in to a first-stage operation state, and updates the new operation status. The generated first token is returned to the mobile device, and the comparison table is updated.

In step (c), the mobile device executes the application in a second-stage login state, and the mobile device transmits the decrypted first token and the user account, and a second-stage password to the Cloud server.

In step (d), when the cloud server judges that the first token, the user account, and the second-stage password match according to the comparison table, it further determines that the application successfully logs in a second Phase operation status, and allows the application to remain in the second phase operation status under a predetermined condition.

In some implementations, the application login method is also applicable to a push server, and further includes steps (e) to (f).

In step (e), when the mobile device executes the application program, a device token (Device Token) is received from the push server.

In step (f), when the mobile device receives the first token newly generated by the cloud server, the mobile device encrypts the first token according to the device token to store the first token Keychain information (KeyChain), and destroy the old first sign.

In some implementation aspects, in step (f), the mobile device enters the device token into a predetermined hash function (Hash) to generate a key name data (KeyName), and the device The token uses a secure hash algorithm (SHA) to generate a key, and then uses the key to encrypt the first token (Advanced Encryption Standard (AES)) to generate an encrypted first token ( EnToken), and finally store the key name data and the encrypted first token in the KeyChain.

In some implementation aspects, in step (a), the mobile device further enters the device token into the predetermined hash function (Hash) to generate the key name data (KeyName), and from the In the keychain data (KeyChain), the encrypted first token (EnToken) corresponding to the key name data is read.

The mobile device also generates the key with the device token using a secure hash algorithm (SHA), and then uses the key to decrypt the encrypted first token (EnToken) with Advanced Encryption Standard (AES) to The decrypted first token is generated.

In other implementation aspects, the application login method further includes step (g). The mobile device executes the application in a first-stage registration state, and the mobile device sends a first-stage application message to The cloud server obtains a first-stage authentication code generated by the cloud server, and then transmits the first-stage authentication code, the user account, and a user password to the cloud server. When the cloud server confirms that the first-stage authentication code is correct, it stores the user account and the user password into the comparison table, and determines that the application registration is successful.

In some implementation aspects, the application login method further includes step (h). When the mobile device executes the application and logs in to the first stage for the first time, the mobile device stores the user account and the user account. The user password is transmitted to the cloud server. When the cloud server determines that the user account and the user password match according to the comparison table, the first token is generated and returned to the mobile device. .

In other implementations, the application login method is also applicable to an enterprise server, which stores an identification code and a mobile phone number associated with a user. The application login method further includes step (i).

In step (i), the mobile device executes the application to establish a password state in the second phase, and the mobile device sends a second phase application message to the cloud server to obtain the cloud server generated A second-stage authentication code, and then transmitting the second-stage password, the second-stage authentication code, the first token (Token), and the encrypted identity identification code and the mobile phone number to the cloud server .

When receiving the second-stage password, the second-stage authentication code, and the first token, the cloud server directly transmits the encrypted identity identification code and the mobile phone number to the enterprise server without storing, When the enterprise server judges that the identification code matches the mobile phone number, it generates a virtual identification code and sends it back to the cloud server to store it in the comparison table, and corresponds to the user account and the first token. , The second-stage password, and the device token.

In other implementation aspects, the application login method further includes step (j), using the mobile device to encrypt the user account with an RSA encryption algorithm before storing.

In other embodiments, in step (d), the predetermined condition is that the idle time of the application is less than a preset time, or the application is not logged out of the second-stage operation state.

The effect of the present invention is that each time the application of the mobile device successfully logs in to the first-phase operating state, the cloud server returns the newly generated first token to the mobile device, and Destroy the old first sign. This enables the mobile device to re-encrypt the new first token as the basis for the next quick login, and the cloud server does not store the identity information of a user corresponding to the mobile device, and can achieve two-phase login and fast Sign-in features and higher security.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are represented by the same numbers.

Referring to FIG. 1, a method for logging in an application of the present invention is applicable to a mobile device 1, a cloud server 2, an enterprise server 3, and a push server 4. In this embodiment, the mobile device 1 is a smart phone, the enterprise server 3 is at least one server in a bank, and the server in the bank may be a majority, such as a server at an information office. And a credit card server. The cloud server 2 is a server set up by the bank in the cloud, such as AWS provided by Amazon. The push server 4 is provided by, for example, Google or Apple, but is not limited thereto.

Referring to FIG. 1 and FIG. 2, the application login method includes steps S1 to S10.

In step S1, each time the mobile device 1 executes an application (APP) provided by the bank, it receives a Device Token from the push server 4. The cloud server 2 generates a device token according to an identification code of the mobile device 1 (such as a hardware serial number of a smart phone) and when the application is installed on the mobile device 1. That is, even if the same smartphone is re-installed each time, the cloud server 2 will generate a different device token.

In step S2, when the mobile device 1 executes the application in a first-stage registration state, the mobile device 1 sends a first-stage application message to the cloud server 2 to obtain the cloud server 2 generated A first-stage authentication code, and the first-stage authentication code, and a user account (Account) and a user password related to a user are transmitted to the cloud server 2. When the cloud server 2 confirms that the first-stage authentication code is correct, the user account and the user password are stored in a comparison table, and it is determined that the application registration is successful. At this time, the mobile device 1 does not store the user account and the user password.

In this embodiment, the mobile device 1 transmits the first-stage application message using an email address provided by the user, and the cloud server 2 also transmits the first-stage authentication code to the email. site. The user uses the email address as the user account, and sets and inputs the user password by himself.

In step S3, when the mobile device 1 executes the application and logs in to the first stage for the first time, the user inputs through the mobile device 1 to set the user account (Account) and the user. The password is sent to the cloud server 2. When the cloud server 2 determines that the user account and the user password match according to the comparison table, a first token is generated and the first token is transmitted back to the mobile device 1. At this time, the mobile device 1 does not store the user account and the user password.

In step S4, the mobile device 1 encrypts the user account (Account) with an RSA encryption algorithm and then stores the encrypted account. In this embodiment, the mobile device 1 stores the encrypted user account in a file of a storage unit of the mobile device 1. At this time, the mobile device 1 stores the user account, but does not store the user password.

In step S5, when the mobile device 1 receives the first token (Token) generated by the cloud server 2, the mobile device 1 performs encryption on the first token according to the device token, To save as a keychain data (KeyChain).

In more detail, the mobile device 1 enters the device token into a predetermined hash function (Hash) to generate a key name data (KeyName), and uses the device token with a secure hash algorithm (SHA) Generate a key, and then use the key to encrypt the first token (Advanced Encryption Standard; AES), generate an encrypted first token (EnToken), and finally The key name data and the encrypted first token are stored in the KeyChain.

In this embodiment, the mobile device 1 encrypts the device token with a secure hash algorithm SHA-256 to generate the key, and uses AES-128 of the Advanced Encryption Standard (AES) for encryption to generate The first token after encryption. At this time, the mobile device 1 does not store the user password, but does store the encrypted first token.

Before executing step S6, the user needs to apply for a predetermined financial service at the bank. In this embodiment, the financial service is a credit card, and the server at the credit card has a store related to the user. An identification code (such as an ID card number) and a mobile phone number (such as the door number used by the smart phone).

In step S6, when the mobile device 1 executes the application to establish the password state in the second phase, the mobile device 1 sends a second phase application message to the cloud server 2 to obtain the cloud server 2 generated A second-stage authentication code, and then transmit a second-stage password, the second-stage authentication code, the first token after decryption, the encrypted identity identification code, and the mobile phone number to The cloud server 2.

In this embodiment, the second-stage application message includes the mobile phone number of the mobile device 1 (such as the door number used by the smart phone), and the cloud server 2 will include a text message of the second-stage authentication code. , Return to the mobile device 1. The user uses the mobile device 1 to set and enter the second-stage password by himself.

The mobile device 1 enters the device token into the predetermined hash function (Hash) to generate the key name data (KeyName), and reads the key name data corresponding to the key name data from the key chain data (KeyChain). This encrypted first token (EnToken). The mobile device 1 generates the key by marking the device with a secure hash algorithm (SHA), and then uses the key to decrypt the encrypted first symbol as an advanced encryption standard (AES) to generate decryption. The first token (Token).

The mobile device 1 also generates the key with the device token using a secure hash algorithm (SHA), and then uses the key to decrypt the encrypted first token (EnToken) using the Advanced Encryption Standard (AES), To generate the decrypted first token.

The mobile device 1 encrypts the identity identification code (such as an identity card number) and the mobile phone number (such as a door number used by the smart phone) with an RSA encryption algorithm, and then encrypts the identity code with the second user input The phase authentication code and the decrypted first token are transmitted to the cloud server 2 together.

When the cloud server 2 receives the second-stage password, the second-stage authentication code, and the first token, it transmits the encrypted identity identification code and the mobile phone number to the enterprise server without storing them. 3. When the enterprise server 3 determines that the identification code matches the mobile phone number, it generates a virtual identification code (ARID) and sends it back to the cloud server 2 for storage in the comparison table. At this time, the comparison table stores the user account, the first token, the second-stage password, the device token, the virtual identification code, and the user password corresponding to the user, that is, The cloud server 2 does not store privacy data sufficient to identify the user's true identity, and the mobile device 1 does not store the user password.

In step S7, when the mobile device 1 executes the application in the first-stage login state again (ie, not for the first time), the mobile device 1 decrypts the first token and the decrypted first token. The user account (Account) is transmitted to the cloud server 2. In this embodiment, the mobile device 1 reads the encrypted user account in the file of the storage unit and decrypts it using an RSA encryption algorithm to obtain the user account.

Similarly, the mobile device 1 enters the device token into the predetermined hash function (Hash) to generate the key name data (KeyName), and reads the corresponding key from the key chain data (KeyChain). The encrypted first token (EnToken) of the name data. The mobile device 1 generates the key by marking the device with a secure hash algorithm (SHA), and then uses the key to decrypt the encrypted first symbol as an advanced encryption standard (AES) to generate decryption. The first token (Token).

At step S8, the cloud server 2 judges that the first token (Token) and the user account (Account) match according to the comparison table, and then determines that the application successfully logs in to a first-stage operation state. The newly generated first token is returned to the mobile device 1, and the first token of the lookup table is updated as the new first token. When the mobile device 1 receives the new first token, it is the same as step S5. The mobile device 1 performs encryption on the first token according to the device token to store the first token in the keychain data ( KeyChain). In addition, the mobile device 1 destroys the old first token, that is, the old first token can no longer be used for quick login.

In step S9, when the mobile device 1 executes the application in a second-stage login state, the mobile device 1 decrypts the first token (Token) and the user account (Account) after decryption, and the second The phase password is transmitted to the cloud server 2.

At step S10, the cloud server 2 determines that the application successfully logs in when it determines that the first token, the user account, and the second-stage password match. A second-stage operating state, and the application is allowed to remain in the second-stage operating state under a predetermined condition. In this embodiment, the predetermined condition is that the idle time of the application is less than a preset time (for example, 15 minutes), or the application is not logged out of the second-stage operation state.

In addition, it should be particularly added that each time the mobile device 1 sends the first token to the cloud server 2, the mobile device 1 immediately deletes the first obtained by decryption, which is temporarily stored in its memory. One sign, that is, the old first sign is destroyed and can no longer be used as a quick login to improve the security of the entire system. In addition, although the user password is not stored in the mobile device 1, the first token is encrypted and decrypted, and the updated first token is obtained by the cloud server 2. The characteristics of login can also take into account the overall security.

In addition, the application of the mobile device 1 can execute the operating state in the first stage and the operating state in the second stage, so that the bank can provide services with different permissions for different users, for example, without applying for the bank's The user of the credit card can obtain the push message related to the bank and transmitted through the push server 4 by using the application in the first stage. Users who already have the bank's credit card can use the application to operate in the second phase, and can obtain relevant services (such as virtual assets) corresponding to the user, and the cloud server 2 does not store enough to identify the use Information about the true identity of the individual.

In summary, the cloud server 2 returns the newly generated first token to the mobile device 1 each time the application of the mobile device 1 successfully logs in to the first-phase operating state. Make the mobile device 1 re-encrypt the new first token as the basis for the next quick login, and destroy the old first token, and the cloud server 2 does not store the user corresponding to the mobile device 1 Identity identification data, and can achieve the characteristics of two-stage login and fast login, and have higher security, so it can indeed achieve the purpose of cost invention.

However, the above are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, any simple equivalent changes and modifications made according to the scope of the patent application and the contents of the patent specification of the present invention are still Within the scope of the invention patent.

1‧‧‧ mobile device

2‧‧‧ Cloud Server

3‧‧‧ Enterprise Server

4‧‧‧ Push server

S1 ~ S10‧‧‧step

Other features and effects of the present invention will be clearly presented in the embodiment with reference to the drawings, in which: FIG. 1 is a block diagram illustrating related devices to which the application login method of the present invention is applicable; and FIG. 2 is a flowchart illustrating an embodiment of a method for logging in to an application of the present invention.

Claims (9)

An application login method is applicable to a mobile device and a cloud server, and includes the following steps: (a) The mobile device executes an application in a first-stage login state, and the mobile device decrypts the A first token (Token) and a user account are transmitted to the cloud server; (b) when the cloud server judges that the first token and the user account match according to a comparison table, Furthermore, it is determined that the application successfully logs into a first-stage operating state, and the newly generated first token is returned to the mobile device, and the comparison table is updated; (c) the mobile device executes the application in the A second-stage login state, the mobile device sends the decrypted first token and the user account, and a second-stage password to the cloud server; and (d) the cloud server according to the A comparison table, when determining that the first token, the user account, and the second-stage password match, further determines that the application successfully logs in to a second-stage operating state, and allows the application to be scheduled The operating member held in the state of the second stage. The method for logging in to the application program as described in claim 1, is also applicable to a push server, and further includes the following steps: (e) When the mobile device executes the application program, it receives a request from the push server. Device token; and (f) when the mobile device receives the first token newly generated by the cloud server, the mobile device executes the first token according to the device token Encrypted to store in a KeyChain. The method for logging in to an application program according to claim 2, wherein, in step (f), the mobile device enters the device token into a predetermined hash function (Hash) to generate a key name data (KeyName ), And the device token generates a key with a secure hash algorithm (SHA), and then uses the key to encrypt the first token (Advanced Encryption Standard (AES)) to generate an encryption After the first token (EnToken), the key name data and the encrypted first token are stored in the keychain data (KeyChain). The application login method according to claim 3, wherein, in step (a), the mobile device further enters the device token into the predetermined hash function (Hash) to generate the key name data ( KeyName), and read the encrypted first token (EnToken) corresponding to the key name data from the KeyChain, and the mobile device also signs the device with a secure hash algorithm (SHA) Generate the key, and then use the key to decrypt the encrypted first token (EnToken) by Advanced Encryption Standard (AES) to generate the decrypted first token (Token). The method for logging in the application as described in claim 1, further comprising the following steps: (g) The mobile device executes the application in a first-stage registration state, and the mobile device sends a first-stage application message to The cloud server obtains a first-stage authentication code generated by the cloud server, and then transmits the first-stage authentication code, the user account, and a user password to the cloud server. When the cloud server confirms that the first-stage authentication code is correct, it stores the user account and the user password into the comparison table, and determines that the application registration is successful. The method for logging in the application as described in claim 5, further comprising the following steps: (h) When the mobile device executes the application and logs in to the first stage for the first time, the mobile device changes the user account and The user password is transmitted to the cloud server. When the cloud server determines that the user account and the user password match according to the comparison table, the first token is generated and returned to the action. Device. The method for logging in the application as described in claim 1, is also applicable to an enterprise server, storing an identification code and a mobile phone number related to a user, and the method for logging in the application further includes the following steps: (i ) The mobile device executes the application to establish a password state in a second phase, and the mobile device sends a second phase application message to the cloud server to obtain a second phase certificate generated by the cloud server Code, and then send the second-stage password, the second-stage authentication code, the first token (Token), and the encrypted identity identification code and the mobile phone number to the cloud server, the cloud server When receiving the second-stage password, the second-stage authentication code, and the first token, the encrypted identity identification code and the mobile phone number are directly transmitted to the enterprise server without storing, and the enterprise server When the device judges that the identity identification code is consistent with the mobile phone number, it generates a virtual identification code and sends it back to the cloud server for storage in the comparison table, and corresponds to the user account, the The first token, the second-stage password, and the device token. The method for logging in to an application as described in claim 1, further comprising step (j), using the mobile device to encrypt the user account with an RSA encryption algorithm before storing. The method for logging in an application as described in claim 1, wherein in step (d), the predetermined condition is that the idle time of the application is less than a preset time, or the application does not log out of the second-stage operation status.