TWI675579B - Network authentication system and method - Google Patents

Abstract

The invention provides a network identity verification system and method. The system includes: a user terminal device and an authentication server, wherein the user terminal device generates a user identification code, a terminal password, a first password, and a second password, and encrypts the calculation. To obtain a cloud password, and register the user identification code, the cloud password, and the first password on the authentication server, the user terminal device issues a user identification code and a one-time valid verification code after two encryption operations in response to an identity confirmation request. To the authentication server. After receiving the verification code, the verification server performs a comparison after at least two decryption operations to obtain an identity verification result. In the system and method of the present invention, the password information stored in the cloud is not synchronized between the client and the client to prevent the leakage of one of the passwords and affect the security of user authentication.

Description

   Network identity verification system and method   

The invention relates to a network identity verification system and method. In particular, the invention relates to a network identity verification system and method implemented between a client and a server / cloud.

The popularity of the Internet has made transactions between clients and servers or the cloud more frequent. According to the previous technology, when a client first registers with a server or the cloud for the first time, it is usually required to enter a personal account, password, and even the user's personal information, such as an ID number and date of birth. The server or the cloud stores the initial settings made by the client for the first time registration. When the client makes a login request to the server or the cloud in the future, the identity is verified to the client based on the account number, password, and even the user's personal data.

In order to improve the security of the transaction between the server or the cloud and the client, some servers or the cloud require that the client must use the physical certificate (such as a natural person certificate) and its card reader device as a requirement for the registration process. The login process uses natural person credentials as the client's authentication.

However, there are also cases where the user's personal data is leaked due to hacking on the server or the cloud. This will cause the server or the cloud to unilaterally verify the account, password, and even the user's personal data. Real identity. In addition, although the use of physical credentials and its card reader device as the requirements for registration and login procedures can improve transaction security, it also results in restrictions on client login operations and complicated operating procedures.

One of the objectives of the present invention is to provide a network identity verification system and method based on a client-side encryption with a terminal password and a server-side / cloud-based decryption with a cloud password.

An object of the present invention is to provide a network identity verification system and method for a client to generate a one-time valid password with a terminal password to log in to a server / cloud.

One of the objectives of the present invention is to provide a network identity verification system and method for use in a server / cloud to decrypt a one-time valid password to verify the identity of a client using a cloud password.

In order to achieve one of the above-mentioned objects of the present invention, the present invention proposes a network identity verification system including: a user terminal device, generating a user identification code, a terminal password, a first password and a second password, and encrypting calculations A cloud password is obtained from the terminal password and the second password, and a confirmation reply request is issued in response to an identity confirmation request. The confirmation reply request includes at least: the user identification code, a third password, and a verification code; and The verification server stores the user identification code, the cloud password and the first password corresponding to the user identification code, and receives the confirmation reply request from the user terminal device, and performs the following operations to obtain a verification result: Decrypting the first password and the third password to obtain the second password; Decrypting the cloud password and the second password to obtain the terminal password; Encrypting the terminal password, the first password, and a one-time valid Obtain an operation code; and compare the verification code with the operation code to obtain the verification result.

In order to achieve one of the above objectives of the present invention, the present invention proposes a network identity verification method, which includes: generating a user identification code, a terminal password, a first password, and a second password at a user terminal device, and encrypting the same A cloud password is obtained by calculating the terminal password and the second password, and a confirmation reply request is issued in response to an identity confirmation request. The confirmation reply request includes at least: the user identification code, a third password, and a verification code; the The user terminal device issues a registration request to register the cloud password and the first password corresponding to the user identification code to a verification server based on the user identification code; and the verification server responds to the The confirmation responds to the request and performs the following operations to obtain a verification result: decrypting the first password and the third password to obtain the second password; decrypting the cloud password and the second password to obtain the terminal password; Encrypt the terminal password, the first password and a one-time valid serial number to obtain an operation code; Code and the operation code, to obtain the verification result.

In order to achieve one of the above-mentioned objects of the present invention, the present invention proposes a network identity verification system including: an authentication server, which communicates with a user terminal device via a network, the authentication server includes: a user database, Storing a user identification code, a cloud password and a first password corresponding to the user identification code; a reply module, receiving a confirmation reply request from the user terminal device, and obtaining a verification result, wherein the confirmation reply The request includes at least: the user identification code, a third password, and a verification code; and an encryption and decryption module that performs the following operations: obtained by calculating the first password and the third password according to a second decryption algorithm A second password; calculating the cloud password and the second password to obtain a terminal password according to a first decryption algorithm; and calculating a terminal password, the first password and one time according to a third encryption algorithm An operational code is obtained by valid serial number; wherein, the verification code is compared with the operation code to obtain the verification result.

In order to achieve one of the foregoing objectives of the present invention, the present invention provides a network identity verification method for use in an authentication server. The verification server communicates with a user terminal device via a network. The network identity verification method includes : Registering a user identification code, and a cloud password and a first password corresponding to the user identification code in a user database; and responding to a confirmation reply request from the user terminal device to obtain a verification result, wherein The confirmation reply request includes at least: the user identification code, a third password, and a verification code; wherein obtaining the verification result includes the following operation: calculating the first password and the third password according to a second decryption algorithm A second password is obtained; a cloud password and the second password are calculated according to a first decryption algorithm to obtain a terminal password; a third encryption algorithm is used to calculate the terminal password, the first password, and one by one Obtain an operation code with a secondary valid serial number; and compare the verification code with the operation code to obtain the verification result.

In order to achieve one of the above objectives of the present invention, the present invention proposes a network identity verification system including: a user terminal device, which communicates with an authentication server via a network, the user terminal device includes: a password generation module To generate a user identification code, a terminal password, a first password, and a second password, and calculate the terminal password and the second password to obtain a cloud password according to a first encryption algorithm; a login / registration mode Group, issuing a registration request, and registering the cloud password and the first password corresponding to the user identification code to the authentication server based on the user identification code; a request / reply module, in response to an identity confirmation request, issues a A confirmation reply request is sent to the verification server, causing the verification server to issue a verification result; and an encryption module, in response to the identity confirmation request, performs the following operations: obtaining a one-time valid serial number; according to a second encryption algorithm Method to calculate the first password and the second password to obtain a third password; and to calculate the terminal password according to a third encryption algorithm The first password is valid and the sequence number to obtain a one-time authentication code; wherein the acknowledgment reply to the request at least comprising: the user identification code, the third code with the codes.

In order to achieve one of the above objectives of the present invention, the present invention proposes a network identity verification method for use in a user terminal device. The user terminal device communicates with an authentication server via a network. The network identity verification method includes : Generating a user identification code, a terminal password, a first password, and a second password, and computing the terminal password and the second password to obtain a cloud password according to a first encryption algorithm; based on the user identification code , Registering the cloud password and the first password corresponding to the user identification code to a user database of the authentication server; and in response to an identity confirmation request, performing the following operations: obtaining a one-time valid serial number; according to a A second encryption algorithm calculates the first password and the second password to obtain a third password; and according to a third encryption algorithm, calculates the terminal password, the first password, and the one-time valid serial number to obtain a verification And sending a confirmation reply request, at least sending the user identification code, the third password, and the verification code to the verification server, so that The authentication server sends a verification result.

In order to achieve one of the foregoing objectives of the present invention, the present invention proposes a network identity verification method, including: storing a user identification code, and a cloud password and a first password corresponding to the user identification code in a user database, wherein The cloud password is obtained by computing a terminal password and a second password according to a first encryption algorithm; and in response to a confirmation response request, to receive the user identification code, a third password, and a one-time valid verification code And perform the following steps: calculating the first password and the third password to obtain the second password according to a second decryption algorithm; obtaining the second password by calculating the cloud password and the second password according to a first decryption algorithm The terminal password; calculating a terminal code, the first password, and a one-time valid serial number to obtain an operation code according to a third encryption algorithm; and comparing whether the one-time valid verification code is the same as the operation code.

According to the network identity verification system and method implemented by the present invention, when a user terminal performs identity verification, the operating environment does not need physical credentials (such as natural person verification) and its related reading equipment, and directly utilizes the user's existing mobile terminal device, ie Can perform network authentication with low cost; and can perform authentication anytime and anywhere based on the convenience of mobile terminal devices, without the need to restrict specific venues, and has high mobility; applications installed on mobile terminal devices (Apps Based on a single operating procedure, the mobile terminal device can quickly complete the entire identity verification process with high convenience.

In addition, based on the following characteristics, even if the data of the authentication server or mobile terminal device is stolen, it does not affect the security of user identity verification and has high security: (i) The system and method of the present invention are on the client side and the authentication server side. Store the terminal password and the cloud password obtained by encrypting the terminal password separately. The data of the two are not synchronized. (ii) The second password generated by the system and method of the present invention is stored only on the client side, and not on the authentication server side, and when the identity verification is performed, the second password is encrypted from the client side and transmitted to the authentication server side as The cloud password is used for decryption, so even if the cloud password of the authentication server or the terminal password of the client is stolen, the identity verification cannot be performed without the second password. (iii) The system and method of the present invention utilizes a one-time valid serial number, so that the verification code is different each time the identity verification is performed, cannot be reused, and is not stored in the client or the verification server first, and is generated only when the identity verification is performed. Obtain a one-time valid serial number to generate a verification code, and then send it to the verification server for identity verification. (iv) The system and method of the present invention send a confirmation reply request to the verification server only after the user terminal has performed two encryption operations, and the verification server performs a comparison after two decryption operations and one encryption operation to obtain the verification result. . (v) When the system and method of the present invention performs identity verification comparison on the verification server side, it compares the verification code that has been encrypted once on the user side with the operation code that has been encrypted and decrypted on the verification server side, rather than directly Compare passwords that are not encrypted and stored on the client or authentication server. (vi) After the system and method of the present invention complete the identity verification, the client and the authentication server both update the first password, so that each identity verification procedure uses a different first password for calculation.

10‧‧‧ authentication server

11‧‧‧User Database

12‧‧‧Login / Register Module

13‧‧‧Encryption and decryption module

14‧‧‧ Reply Module

20‧‧‧User terminal device

21‧‧‧ Apps

22‧‧‧Login / Register Module

23‧‧‧Password generation module

24‧‧‧ Encryption Module

25‧‧‧Request / Reply Module

30‧‧‧Web Server

100, 200, 300‧‧‧ Network authentication methods

101 ~ 104, 201 ~ 206, 301 ~ 309‧‧‧ steps

FIG. 1A is a structural diagram of a network authentication system according to the present invention.

FIG. 1B is a structural diagram of another network authentication system according to the present invention.

The second figure is a block diagram of a user terminal device of the system of the present invention.

The third figure is a block diagram of the authentication server of the system of the present invention.

The fourth figure is a flowchart of the network identity verification method of the present invention.

The fifth figure is a flowchart of the network identity verification method used in the user terminal device of the present invention.

The sixth figure is a flowchart of the network identity verification method used in the present invention for the verification server.

The seventh diagram A is a message transmission diagram of the system of the present invention as shown in the first diagram A.

The seventh diagram B is a message transmission diagram of the system of the present invention as shown in the first diagram B.

First, please refer to FIG. 1A, which is a structural diagram of a network authentication system according to the present invention. In this embodiment of the invention, a network identity verification system includes: a user terminal device 20 and an authentication server 10, wherein the user terminal device 20 is preferably a mobile communication device. An application (App) is installed on the user terminal device 20 to connect to the authentication server 10. The application program of the user terminal device 20 will generate a set of associated passwords. The set of associated passwords includes a user identification code user_id, a terminal password key_A, a first password key_B, and a second password Hide_no, and an encryption calculation is performed to obtain a cloud Password key_A '. The user terminal device 20 sends a registration request to the authentication server 10, and registers the user identification code user_id, the cloud password key_A ', and the first password key_B to the authentication server 10 for identity verification. The authentication server 10 stores the cloud password key_A 'and the first password key_B corresponding to the user identification code user_id in a user database 11 based on the user identification code user_id, wherein the user identification code user_id is preferably a A mobile phone door number or an international mobile equipment identity number (IMEI) of a mobile phone or a unique serial number.

Please refer to FIG. 7A together for a message transmission diagram of the system of the present invention as shown in FIG. After the user terminal device 20 installs the application program, it sends a registration request to the authentication server 10 in the registration process to transmit a set of authentication passwords, so that the authentication server 10 stores the set of passwords in the user database 11. When the user terminal device 20 or the client personal computer wants to log in to a website server 30, the user terminal device 20 issues a login request to the website server 30, and the login operation of the website server 30 is issued in response to the login request An identity confirmation request is sent to the user terminal device 20 and the authentication server 10. After receiving the identity confirmation request from the website server 30, the user terminal device 20 generates a one-time valid verification code AC after two encryption operations in a single operation procedure, and then issues a confirmation response based on the user identification code user_id. A password for authentication is requested to be transmitted to the authentication server 10. In addition, after the verification server 10 receives the identity confirmation request from the web server 30, the verification procedure waits for the confirmation response request from the user terminal device 20 to receive the one-time valid verification code AC and verify After two decryption operations and one encryption operation in the program, the comparison is performed to obtain a verification result. Based on the user identification code user_id, the authentication server 10 returns the authentication result to the website server 30 that sends an identity confirmation request, so as to determine whether to accept the user terminal device 20 or the client based on the login operation of the website server 30. PC login.

Please refer to FIG. 1B, which is a structural diagram showing another network authentication system of the present invention. In this embodiment of the invention, a network identity verification system includes: a user terminal device 20 and an authentication server 10, wherein the user terminal device 20 is preferably a mobile communication device. An application (App) is installed on the user terminal device 20 to connect to the authentication server 10. The application program of the user terminal device 20 will generate a set of associated passwords. The set of associated passwords includes a user identification code user_id, a terminal password key_A, a first password key_B, and a second password Hide_no, and an encryption calculation is performed to obtain a cloud. Password key_A '. The user terminal device 20 sends a registration request to the authentication server 10, and registers the user identification code user_id, the cloud password key_A ', and the first password key_B to the authentication server 10 for identity verification. The authentication server 10 stores the cloud password key_A 'and the first password key_B corresponding to the user identification code user_id in a user database 11 based on the user identification code user_id, wherein the user identification code user_id is preferably a A mobile phone door number or an international mobile equipment identity number (IMEI) of a mobile phone or a unique serial number.

Please refer to FIG. 7B together for a message transmission diagram of the system of the present invention as shown in FIG. 1B. After the user terminal device 20 installs the application program, it sends a registration request to the authentication server 10 in the registration process to transmit a set of authentication passwords, so that the authentication server 10 stores the set of passwords in the user database 11. When the user terminal device 20 or the client personal computer wants to log in to the authentication server 10, the user terminal device 20 issues a login request to the authentication server 10, and the login operation of the authentication server 10 is issued in response to the login request An identity confirmation request is issued to the user terminal device 20. After receiving the identity verification request from the verification server 10, the user terminal device 20 generates a one-time valid verification code AC after two encryption operations in a single operation procedure, and then issues a confirmation response based on the user identification code user_id. A password for authentication is requested to be transmitted to the authentication server 10. The verification program of the verification server 10 responds to the confirmation response request sent by the user terminal device 20 to receive the one-time valid verification code AC, and then performs two decryption operations and one encryption operation in the verification program to perform comparison. Obtain a verification result. The authentication server 10 determines whether to accept the login of the user terminal device 20 or the client personal computer based on the verification result.

In the different embodiment shown in FIG. 1B, after the user terminal device 20 sends a login request to the authentication server 10, it can send a confirmation reply request to the authentication server 10 for identity verification, without issuing a login request. It waits for the identity confirmation request from the verification server 10 before executing the confirmation reply request.

In the above embodiment, the identity confirmation request is a command for prompting the user terminal device 20 to issue a reply confirmation request to the authentication server 10. In the embodiment shown in FIG. 1A, the identity confirmation request submitted by the web server 30 should include a user identification code user_id. Because the verification server 10 receives the reply confirmation request sent by the user terminal device 20 based on the user identification code user_id, it needs to reply the verification result of the user identification code user_id to the web server that issued the identity confirmation request.

Referring to the second figure, a block diagram of a user terminal device of the system of the present invention is shown. The user terminal device 20 of the system of the present invention is preferably a smart phone, such as Apple's iPhone or Samsung's Galaxy. The user terminal device 20 downloads and installs an application program 21 which will make the user terminal device 20 a necessary device for network authentication. The user terminal device 20 executes the application program 21 to implement the following modules: a login / registration module 22, a password generation module 23, an encryption module 24, and a request / reply module 25. The login / registration module 22 enables the user terminal device 20 to establish a communication connection with a preset authentication server 10. When the user terminal device 20 communicates with the authentication server 10 for the first time, the login / registration module 22 enters a registration procedure and issues a registration request to the authentication server 10, and a password generation module is used in the registration procedure. 23 Generate and store a set of associated passwords. The set of associated passwords includes a user identification code user_id, a terminal password Key_A, a first password Key_B, and a second password Hide_no; the encryption module 24 according to a first encryption algorithm Or, a first encryption algorithm Fn11 calculates the terminal password Key_A and the second password Hide_no to obtain a cloud password Key_A ', that is, Key_A' = Fn11 {Key_A, Hide_no}. The registration request is based on the user identification code user_id, and registers the cloud password key_A 'and the first password key_B corresponding to the user identification code user_id to the authentication server 10.

In the embodiment shown in FIGS. 1A and 1B, when the user terminal device 20 logs in to a web server 30 or an authentication server 10, the login / registration module 22 enables the user terminal device 20 After establishing a communication connection with the web server 30 or the authentication server 10, a login request is issued, and the login request includes the account and password set by the user. After that, the request / reply module 25 will receive an identity confirmation request to decide whether to execute a single action procedure, as shown in the fifth figure. In response to the identity confirmation request, the encryption module 24 obtains a third password Key_B 'and a one-time valid verification code AC after two encryption calculations. The request / reply module 25 sends a confirmation reply request to the verification server 10 to The transmission includes at least the user identification code user_id, the third password Key_B ', and the one-time valid verification code AC, so that the verification server 10 performs the user's network identity verification.

Please refer to the third figure, which shows a block diagram of the authentication server of the system of the present invention. The authentication server 10 of the system of the present invention includes a user database 11 which stores a user identification code user_id registered from the user terminal device 20, and the cloud password key_A 'and the cloud password corresponding to the user identification code user_id. The first password key_B. The authentication server 10 executes application software to implement the following modules: a login / registration module 12, an encryption / decryption module 13 and a reply module 14. The login / registration module 12 stores the received user identification code user_id and the cloud password key_A 'and the first password key_B corresponding to the user identification user_id in response to a registration request issued by the user terminal device 20. Database 11.

In the embodiment shown in FIG. 1A, when the user terminal device 20 or the client personal computer wants to log in to a web server 30, the web server 30 sends an identity confirmation request to the user terminal device 20 in response to the login request. With authentication server 10. The reply module 14 will receive the identity confirmation request and will wait to receive the confirmation reply request from the user terminal device 20 to perform the identity verification procedure as shown in the sixth figure. The encryption and decryption module 13 undergoes two decryption operations and one After the encryption operation is performed, the verification result is compared. The reply module 14 returns the verification result to the website server 30 that sends the identity confirmation request, so that the website server 30 can decide whether to accept the user terminal device 20 or the user. On a personal computer.

In the embodiment shown in FIG. 1B, when the user terminal device 20 or the client personal computer wants to log in to the authentication server 10, the login / registration module 12 of the authentication server 10 issues an identity confirmation in response to the login request. Requested to the user terminal device 20. The reply module 14 will wait to receive a confirmation reply request from the user terminal device 20 to perform the identity verification procedure as shown in the sixth figure. The encryption / decryption module 13 will be verified after two decryption operations and one encryption operation. result. The authentication server 10 determines whether to accept the login of the user terminal device 20 or the client personal computer based on the verification result.

Please refer to the fourth figure, which shows a flowchart of the network authentication method of the present invention. In the embodiment shown in FIG. 1A and FIG. 1B, the network authentication method 100 used in the network authentication system of the present invention includes: Step 101, a user terminal device 20 installs an application program (APP) Generate a set of related passwords, including a user identification code user_id, a terminal password key_A, a first password key_B and a second password Hide_no, and register them to the authentication server 10, so that the user database 11 is stored from the user terminal device 20 The registered user identification code user_id, and the cloud password key_A 'and the first password key_B corresponding to the user identification code user_id.

In step 102, after the user terminal device 20 issues a login request, the user terminal device 20 will receive an identity confirmation request from the web server 30 in response to the login request, as shown in the first diagram A, or from the authentication server 10 The identity confirmation request issued in response to the login request is shown in the first figure B. Step 103: In response to the identity confirmation request, the user terminal device 20 executes a single operation procedure as shown in the fifth figure to issue a confirmation response request to the verification server 10 to transmit at least the user identification code user_id and the third password Key_B '. With the one-time valid verification code AC, the verification server 10 is caused to perform user network identity verification. In the last step 104, the verification server 10 responds to the verification result in response to the identity verification request after executing the identity verification procedure as shown in FIG. 6 due to the confirmation reply request.

Please refer to the fifth figure, which shows a flow chart of the network authentication method of the present invention applied to a user terminal device. In the embodiment of the present invention, when the user terminal device 20 responds to the identity confirmation request from the website server 30 shown in FIG. 1A or from the verification server 10 shown in FIG. 1B, the user terminal device 20 will be prompted. The executed application uses a network authentication method 200 as shown in the fifth figure, which includes the following steps: Step 201, the request / reply module 25 receives from the web server 30 shown in the first A or from the first B The figure shows an identity confirmation request issued by the verification server 10, and the identity confirmation request may or may not include a user identification code user_id. In step 202, the request / reply module 25 determines whether the user is instructed to execute a single operation procedure by the human-machine interface of the user terminal device 20. If so, execute step 203; if not, wait for the user to issue an instruction. If the order is issued or the user does not execute, the request / reply module 25 sends an unidentified message in response to the identity confirmation request.

The single operation procedure includes steps 203 to 206. In different embodiments of the present invention, in step 202, the user can execute a single operation procedure by operating a human-machine interface provided by the user terminal device 20, and the human-machine interface may be a virtual key displayed on a touch screen. , Or the home button of a mobile phone, or a fingerprint recognition sensing interface (such as Touch ID), or a face recognition sensing interface (such as Face ID), or an iris recognition sensing interface, or a voiceprint recognition sensing interface, etc. To detect a single action by the user.

With continued reference to the fifth figure, in step 203, the request / reply module 25 finds the corresponding terminal password key_A, the first password Key_B, and the second password Hide_no according to the user identification code user_id. Then in step 204, the encryption module 24 calculates the first password Key_B and the second password Hide_no according to a second encryption algorithm or a second encryption algorithm function Fn21 to obtain a third password Key_B ', that is, Key_B' = Fn21 {Key_B, Hide_no}. Then, in step 205, the encryption module 24 calculates the terminal password key_A, the first password Key_B, and the one-time valid code based on a one-time valid serial number X and according to a third encryption algorithm or a third encryption algorithm function Fn3. The serial number X is obtained by a one-time valid verification code AC, that is, AC = Fn3 {key_A, Key_B, X}, where the one-time valid serial number X is a random value or a time-related serial number. Finally, in step 206, the request / reply module 25 responds to the identity confirmation request to issue a confirmation reply request, and transmits at least the user identification code user_id, the third password Key_B ', and the verification code AC to the verification server 10. In different embodiments of the present invention, the first encryption algorithm Fn11 and the second encryption algorithm Fn21 may be the same or different.

In addition, in different embodiments of the present invention, the encryption module 24 obtains the one-time valid serial number X in different ways, and determines whether the confirmation / reply request sent by the request / reply module 25 transmits the one-time valid serial number X. For example, in a single action procedure performed in response to an identity confirmation request, the one-time valid serial number X is generated by the password generation module 23 to be provided to the encryption module 24 to calculate the one-time valid verification code AC, and a request / reply module The confirmation reply request issued by 25 will transmit the one-time valid serial number X to the authentication server 10; in the embodiment shown in the first figure A, the website server 30 generates the response to the login request issued by the user terminal device 20 The one-time valid serial number X is sent to the user terminal device 20 and the authentication server 10 when the identity confirmation request is sent through the web server 30, so that the request / reply mode of the user terminal device 20 is made. The group 25 obtains the one-time valid serial number X by receiving the identity confirmation request to provide the encryption module 24 to calculate the one-time valid verification code AC. The confirmation / reply request sent by the request / reply module 25 does not need to transmit the one-time confirmation. A valid serial number X is given to the authentication server 10; in the embodiment shown in FIG. 1B, the authentication server 10 is generated in response to a login request issued by the user terminal device 20. When the one-time valid serial number X is sent through the authentication server 10 to confirm the identity, the one-time valid serial number X is transmitted to the user terminal device 20, so that the request / reply module 25 of the user terminal device 20 receives the identity through Confirm the request, and obtain the one-time valid serial number X to provide the encryption module 24 to calculate the one-time valid verification code AC. The confirmation / reply request issued by the request / reply module 25 does not need to send the one-time valid serial number X to the Authentication server 10.

In a further embodiment shown in the fifth figure of the present invention, after step 206, the method 200 of the present invention further includes: generating a new first password key_B by the password generation module 23 to replace the original first password key_B, and Send the new first password key_B to the authentication server 10 to replace the originally registered first password key_B, or the request / reply module 25 receives a new first password key_B generated by the authentication server 10 to Replaces the original first password key_B of the user terminal device 20.

Please refer to FIG. 6, which shows a flowchart of the network authentication method used in the present invention for the authentication server. In the embodiment shown in FIG. 1A of the present invention, when the authentication server 10 responds to an identity confirmation request from the web server 30, the application software executed by the authentication server 10 is caused to use as shown in FIG. A network identity verification method 300 includes the following steps: Step 301: The reply module 14 receives an identity confirmation request from the web server 30, and the identity confirmation request includes a user identification code user_id. In step 302, the reply module 14 determines whether a confirmation reply request from the user terminal device 20 is received, and if yes, executes step 303; In response to the confirmation reply request, the reply module 14 sends an unidentified message in response to the identity confirmation request.

Continuing to refer to the sixth figure, in step 303, the reply module 14 receives the confirmation reply request from the user terminal device 20, and obtains the user identification code user_id, the third password Key_B ', the one-time valid serial number X, and the verification. Code AC, where the one-time valid serial number X is generated in the user terminal device 20. In different embodiments of the present invention, if the one-time valid serial number X is generated by the web server 30 and transmitted to the verification server 10 through the identity confirmation request, the confirmation response request of the user terminal device 20 need not include the one-time response The valid serial number X, or if the one-time valid serial number X is generated by the verification server 10 and transmitted to the user terminal device 20 through the identity confirmation request to calculate the one-time valid verification code AC, the user terminal device 20's confirmation reply request It is also not necessary to include the one-time valid serial number X.

With continued reference to the sixth figure, in step 304, the reply module 14 searches the user database 11 for the cloud password key_A 'and the first password key_B corresponding to the user identification code user_id from the user database 11. Then in step 305, the encryption / decryption module 13 calculates the third password Key_B 'and the first password Key_B according to a second decryption algorithm or a second decryption calculation function Fn22 to obtain a second password Hide_no, that is, Hide_no = Fn22 {Key_B ', Key_B}. Then in step 306, the encryption / decryption module 13 calculates the cloud password key_A 'and the second password Hide_no according to a first decryption algorithm or a first decryption calculation function Fn12 to obtain a terminal password key_A, that is, key_A = Fn12 { key_A ', Hide_no}. Then in step 307, the encryption / decryption module 13 calculates the terminal password key_A, the first password Key_B, and the one-time valid serial number X to obtain an operation code AC according to the third encryption algorithm or the third encryption algorithm function Fn3. ', That is AC' = Fn3 {key_A, Key_B, X}. Following step 308, the reply module 14 compares the operation code AC 'obtained in step 307 with the verification code AC transmitted by the user terminal device 20 to obtain a verification result. If the verification result shows that the operation code AC 'is the same as the verification code AC, it means that the user is authenticated, that is, the first password Key_B stored in the user terminal device 20 and the user database 11 stored in the verification server 10 correspond to the user identification. The first password Key_B of the code user_id is the same. Conversely, if the verification result shows that the operation code AC 'is different from the verification code AC, it means that the user has not passed the identity verification. Finally, in step 309, the reply module 14 responds to the verification result obtained in step 308 to the web server 30 in response to the identity confirmation request, so that the web server 30 can decide whether to accept the login of the user terminal device 20 or the client personal computer.

Continuing the sixth figure, in the embodiment shown in the first figure B of the present invention, when the identity confirmation request sent by the verification server 10 is sent to the user terminal device 20, the application software executed by the verification server 10 is using the software such as The network authentication method 300 shown in the sixth figure does not need to perform step 301, and in step 309, the login / registration module 12 determines whether to accept the user terminal device 20 or the client terminal according to the verification result obtained in step 308. PC login.

In a further embodiment shown in the sixth figure of the present invention, after step 309, the method 300 of the present invention further includes: the reply module 14 generates a new first password key_B to replace the corresponding user identification stored in the user database 11 The original first password key_B of the code user_id, and transmits the new first password key_B to the user terminal device 20 to replace the original first password key_B, or the reply module 14 receives a new password generated by the user terminal device 20 The first password key_B corresponding to the original password key_B stored in the user database 11 corresponding to the user identification code user_id.

Claims (20)

    A network identity verification system includes: an authentication server communicating with a user terminal device via a network, including: a user database, storing a user identification code, and a cloud password corresponding to the user identification code and A first password; a reply module that receives a confirmation reply request from the user terminal device to obtain a verification result, wherein the confirmation reply request includes at least: the user identification code, a third password, and a verification code ; And an encryption and decryption module, performing the following operations: calculating the first password and the third password to obtain a second password according to a second decryption algorithm; calculating the cloud password according to a first decryption algorithm And a second password to obtain a terminal password; and a third encryption algorithm to calculate the terminal password, the first password, and a one-time valid serial number to obtain an operation code; wherein, comparing the verification code with The operation code to obtain the verification result.         A network identity verification system includes: a user terminal device that communicates with an authentication server via a network, and includes: a password generation module that generates a user identification code, a terminal password, a first password, and a A second password and a cloud password obtained by computing the terminal password and the second password according to a first encryption algorithm; a login / registration module that issues a registration request and will correspond to the user based on the user identification code The cloud password and the first password of the identification code are registered in a user database of the authentication server; a request / reply module responds to an identity confirmation request by issuing a confirmation reply request to the authentication server, which causes the authentication The server sends a verification result; and an encryption module, in response to the identity confirmation request, performs the following operations: obtains a one-time valid serial number; calculates the first password and the second password according to a second encryption algorithm Obtaining a third password; and obtaining a third password by calculating the terminal password, the first password, and the one-time valid serial number according to a third encryption algorithm Authentication code; wherein the acknowledgment reply to the request at least comprising: the user identification code, the third code with the codes.         The network identity verification system according to item 1 or 2 of the scope of patent application, wherein the one-time valid serial number is a random value or a time-related serial number, and the one-time valid serial number is generated by the user terminal device and transmitted To the verification server, or generated by the verification server and transmitted to the user terminal device for generating the verification code, or generated by a web server and transmitted to the verification server or the user terminal device.         According to the network identity verification system described in the first or second scope of the patent application, wherein the verification server includes a login / registration module, the login / registration module receives a registration request from the user terminal device, and obtains the registration request. The user identification code, the cloud password and the first password are stored in the user database, and the login / registration module accepts a login request from the user terminal device, so that the reply module receives the user terminal device. Reply to this confirmation request.         The network identity verification system according to item 1 or 2 of the scope of patent application, wherein the verification server generates a new first password to replace the first password corresponding to the user identification code in the user database, and Send to the user terminal device to replace the original first password, or the user terminal device generates a new first password to replace the original first password, and sends to the authentication server to replace the user database The first password corresponding to the user identification code.         According to the network identity verification system described in item 1 or 2 of the patent application scope, wherein the cloud password is stored in the verification server, and the terminal password is stored in the user terminal device.         The network authentication system according to item 1 or 2 of the scope of patent application, wherein the first password and the second password are passwords generated on the user terminal device, and the third password is based on the first password and The second password is a password that has undergone an encryption calculation on the user terminal device.         The network identity verification system as described in claim 1 or 2, wherein the terminal password and the first password are passwords generated on the user terminal device, and the verification code is based on the terminal password and the first password. The password is a password that has undergone an encryption calculation on the user terminal device.         According to the network identity verification system described in the first scope of the patent application, wherein the cloud password is obtained by the user terminal device calculating the terminal password and the second password according to a first encryption algorithm; the third password is The user terminal device calculates the first password and the second password according to a second encryption algorithm; and the verification code is the user terminal device calculates the terminal password, the first password, and the first password according to a third encryption algorithm. The password is obtained with the one-time valid serial number.         The network identity verification system described in item 2 of the scope of patent application, wherein the login / registration module sends a login request to the verification server, so that the request / reply module receives an identity confirmation request from the verification server , And issue the confirmation reply request to the authentication server; or the login / registration module sends a login request to a web server, so that the request / reply module receives the identity confirmation request from the web server and sends The confirmation response request is sent to the authentication server.         A network authentication method is used in an authentication server. The authentication server communicates with a user terminal device via a network. The network authentication method includes: registering a user identification code and corresponding to the user identification code. A cloud password and a first password in a user database; and responding to a confirmation response request from the user terminal device to obtain a verification result, wherein the confirmation response request includes at least: the user identification code, a first Three passwords and a verification code; obtaining the verification result includes the following operations: computing the first password and the third password to obtain a second password according to a second decryption algorithm; and obtaining a second password according to a first decryption algorithm Method, calculating the cloud password and the second password to obtain a terminal password; calculating the terminal password, the first password, and a one-time valid serial number to obtain an operation code according to a third encryption algorithm; and comparing The verification code and the operation code obtain the verification result.         A network authentication method is used for a user terminal device. The user terminal device communicates with an authentication server via a network. The network authentication method includes: generating a user identification code, a terminal password, a first A password and a second password, and calculate a terminal password and the second password to obtain a cloud password according to a first encryption algorithm; based on the user identification code, the cloud password corresponding to the user identification code and the cloud password The first password is registered in a user database of the authentication server; and in response to an identity confirmation request, the following operations are performed: obtaining a one-time valid serial number; and calculating the first password and the one according to a second encryption algorithm A third password is obtained from the second password; a verification code is obtained by computing the terminal password, the first password, and the one-time valid serial number according to a third encryption algorithm; and sending a confirmation reply request to at least the user The identification code, the third password and the verification code are sent to the verification server, so that the verification server sends a verification result.         The method for network identity verification according to item 11 or 12 of the scope of patent application, wherein the one-time valid serial number is a random value or a time-related serial number, and the one-time valid serial number is generated by the user terminal device and transmitted To the verification server, or generated by the verification server and transmitted to the user terminal device for generating the verification code, or generated by a web server and transmitted to the verification server or the user terminal device.         The network identity verification method described in claim 11 or claim 12, further comprising: the verification server receives a registration request from the user terminal device, and obtains the user identification code, the cloud password, and the first password And stored in the user database, and the authentication server accepts a login request from the user terminal device, and then receives the confirmation reply request from the user terminal device.         The method for network identity verification according to item 11 or 12 of the scope of patent application, further comprising: the verification server generates a new first password to replace the first password corresponding to the user identification code in the user database And send to the user terminal device to replace the original first password, or the user terminal device generates a new first password to replace the original first password, and sends to the authentication server to replace the user The first password corresponding to the user identification code in the database.         The network identity verification method according to item 11 or 12 of the scope of patent application, wherein the cloud password is stored in the verification server, and the terminal password is stored in the user terminal device; and the first password and the second password Is a password generated on the user terminal device, and the third password is a password that undergoes an encryption calculation on the user terminal device according to the first password and the second password; and the terminal password and the first password are on the The password generated by the user terminal device, and the verification code is a password that undergoes an encryption calculation on the user terminal device according to the terminal password and the first password.         The network identity verification method according to item 11 of the scope of patent application, wherein the cloud password is obtained by the user terminal device calculating the terminal password and the second password according to a first encryption algorithm; the third password is The user terminal device calculates the first password and the second password according to a second encryption algorithm; and the verification code is the user terminal device calculates the terminal password, the first password, and the first password according to a third encryption algorithm. The password is obtained with the one-time valid serial number.         The network identity verification method as described in claim 12 of the patent application scope, further comprising: the user terminal device sends a login request to the verification server to receive the identity confirmation request from the verification server, and sends the confirmation reply Request to the authentication server; or the user terminal device sends a login request to a web server to receive an identity confirmation request from the web server, and sends the confirmation reply request to the authentication server.         A network identity verification method includes: storing a user identification code, and a cloud password and a first password corresponding to the user identification code in a user database, wherein the cloud password is calculated according to a first encryption algorithm Obtain a terminal password and a second password; and respond to a confirmation response request to receive the user identification code, a third password, and a one-time valid verification code, and perform the following steps: according to a second decryption algorithm To calculate the first password and the third password to obtain the second password; to calculate the cloud password and the second password to obtain the terminal password according to a first decryption algorithm; to calculate the terminal password according to a third encryption algorithm The terminal password, the first password, and a one-time valid serial number are used to obtain an operation code; and whether the one-time valid verification code is the same as the operation code.         The network identity verification method according to item 19 of the scope of patent application, wherein the third password is obtained by calculating the first password and the second password according to a second encryption algorithm; or the cloud password is stored in a An authentication server, and the terminal password is stored in a user terminal device; or the terminal password, the first password, and the one-time valid serial number are generated on the user terminal device, and the one-time valid authentication code is based on the terminal password A one-time valid password that the first password and the one-time valid serial number have undergone an encryption calculation in the user terminal device; or the one-time valid serial number is generated by the user terminal device or a web server and transmitted to the verification server, Or it is generated by the verification server and transmitted to the household terminal device for generating the one-time valid verification code.