TWI745026B - Authentication system and method - Google Patents

Abstract

An authentication system includes: a database storing a first telecommunication data; and a first server accessing the database, the first server receiving device address data from a user device, and according to the The device address data is associated with the first telecommunication data from the database; wherein the first server encodes the first telecommunication data and a time stamp data to generate a verification data, and the first server The verification data is stored in the database, and the verification data is sent to the user device; wherein the first server is communicatively connected to the database.

Description

Authentication system and method

The present invention relates to an authentication system and method, and more particularly to an authentication system and method that can authenticate a user device or user identity.

At present, most authentication systems used on user devices (such as mobile phones) require the user to enter an account and/or password for device or identity verification. However, this authentication method requires the user to write down the account and password at any time, which is extremely inconvenient for the user. In addition, it is known that a universal one-time password (OPT) is used to check the device user, but such an authentication mechanism still lacks real-name authentication, that is, to identify the true identity of the device user. In view of this, there will be a need for an authentication system and method for real-name authentication of a user device or user identity without entering an account or password.

In order to solve the above-mentioned problems, one idea of the present invention is to provide an authentication system and method for authenticating a user device or user identity without entering an account or password.

Based on the aforementioned concept, the present invention provides an authentication system, including: a database storing a first telecommunication data; and a first server accessing the database, the first server receiving a data from a user device Device address data, and correlate the first telecommunication data from the database according to the device address data; wherein the first server encodes the first telecommunication data and a time stamp data to generate a verification data , The first server stores the verification data in the database, and sends the verification data to the user device; wherein the first server communicates with the database.

In a preferred embodiment of the present invention, the time stamp data indicates a time when the first server receives the device address data from the user device.

In a preferred embodiment of the present invention, the first telecommunication data includes a door number data.

In a preferred embodiment of the present invention, the database stores an identity data, and the authentication system further includes: a second server for accessing the database, the second server receiving the authentication from the user device Data, a telecommunication number data and a first identity verification data, the second server determines whether to generate an authentication success data based on the verification data, the telecommunication number data, the identity data and the first identity verification data; The second server communicates with the database.

In a preferred embodiment of the present invention, the second server does not receive the authentication data and/or the authentication data from the user device within a predetermined time after the authentication data is generated by the first server. The first identity verification data generates a verification failure data.

In a preferred embodiment of the present invention, the first identity verification data is encoded data; wherein the second server encodes the identity data stored in the database to generate a second identity verification Data, the second server generates based on the first identity verification data conforming to the second identity verification data, and the verification data received from the user device conforms to the verification data stored in the database, The authentication success data; wherein the second server did not decode the first identity verification data.

In a preferred embodiment of the present invention, the second server transmits a second telecommunication data stored in the database to the user device or a third server based on the authentication success data.

In a preferred embodiment of the present invention, the second telecommunications data includes at least one of a telecommunications application data, a payment record data, and an agreement data.

According to the object of the present invention, an authentication method is further provided, which includes: receiving a device address data from a user device by a first server of an authentication system; A first telecommunication data is associated with a database of the authentication system; the first server encodes the first telecommunication data and the time stamp data to generate a verification data; the first server verifies the data Data is stored in the database; and the first server transmits the verification data to the user device; wherein the first server is in communication with the database, and the first server accesses the database.

In a preferred embodiment of the present invention, the time stamp data indicates a time when the first server receives the device address data from the user device.

In a preferred embodiment of the present invention, the first telecommunication data includes a door number data.

In a preferred embodiment of the present invention, the authentication method further includes: receiving the authentication data, a telecommunication number data and a first identity authentication data from the user device by a second server of the authentication system; And the second server determines whether to generate an authentication success data according to the verification data, the telecommunication number data, the first identity verification data, and an identity data stored in the database; wherein the second server communicates with The database, and the second server accesses the database.

In a preferred embodiment of the present invention, the authentication method further includes: the second server does not receive the authentication data from the user device within a predetermined time after the first server generates the authentication data. The verification data and/or the first identity verification data generates a verification failure data.

In a preferred embodiment of the present invention, the authentication method further includes: encoding the identity data stored in the database by the second server to generate a second identity verification data; and The second server generates the authentication success data based on that the first identity verification data matches the second identity verification data, and the verification data received from the user device matches the verification data stored in the database; The first identity verification data is encoded data; wherein the second server does not decode the first identity verification data.

In a preferred embodiment of the present invention, the authentication method further includes: sending, by the second server, a second telecommunication data stored in the database to the user device or a The third server.

In a preferred embodiment of the present invention, the second telecommunications data includes at least one of a telecommunications application data, a payment record data, and an agreement data.

The foregoing aspects and other aspects of the present invention will be more clarified based on the detailed description of the following non-limiting specific embodiments and with reference to the accompanying drawings.

Please refer to the first figure, which illustrates a system architecture diagram of a specific embodiment of the authentication system according to the present invention. As shown in the embodiment shown in the first figure, the authentication system 100 includes a database 110 and a first server 120. The server 120 is in communication with the database 110, and the first server 120 can access the database 110. The database 110 stores a plurality of address data (the plurality of address data includes the device address data of the user device 900) and a plurality of telecommunication data (the plurality of telecommunication data includes the first data associated with the device address data). Telecommunications data), each address data is respectively associated with one of the plurality of telecommunications data. In this way, when the first server 120 receives the device address data from the user device 900, the first server 120 can associate the first telecommunication data from the database 110 according to the device address data. The first server 120 then encodes the first telecommunication data and a time stamp data to generate verification data. Then, the first server 120 sends the verification data to the user device 900 to complete the device verification process (or address reversal check process), and the first server 120 stores the verification data generated by it in the database 110 (For the convenience of the following description, the verification data sent to the user device 900 can also be referred to as the first verification data, and the verification data stored in the database 110 can also be referred to as the second verification data). Among them, the verification data (or the first verification data) can be regarded as a device authentication success data. Preferably, the first server 120 irreversibly encodes the first telecommunication data and the time stamp data through a Message-Digest Algorithm (MD5) to generate verification data. Since MD5 is an irreversible encryption method, even if the verification data is intercepted or transmitted to other devices, there is no risk of outflow of the first telecommunication data.

In different embodiments, the user device 900 may be a mobile communication device (for example, a mobile phone), and the user device 900 may be communicatively connected (for example, via a network) to the first server 120, and the time stamp data may indicate the first server 120 The time when a server 120 receives the device address data from the user device 900, or the time stamp data can indicate the time when the user device 900 sends the device address data to the first server 120, but it is not limited to this . The first telecommunications data may include at least one of house number data, card number data, tariff data, and Internet access authority data. Among them, the door number data indicates the door number of the user device 900, the tariff data indicates the tariff used by the user device 900 (such as network tariff, call tariff, etc.), and the Internet access data indicates the Internet access authorization of the user device 900 (For example, whether the user device 900 can use the Internet function, and the available network usage, etc.). In a specific embodiment, the authentication system 100 may include one or more processors, and implement the database 110 and the first server 120 in a cooperative manner of hardware and software.

Please refer to the second figure, which illustrates a system architecture diagram of a specific embodiment of the authentication system according to the present invention. As shown in the embodiment in the first figure, the authentication system 200 includes a database 210, a first server 220, and a second server.器230. The first server 220 is in communication with the database 210, and the first server 220 can access the database 210. The second server 230 is communicatively connected to the database 210, and the second server 230 can access the database 210. The database 210 stores a plurality of address data (the plurality of address data includes the device address data of the user device 900), and a plurality of telecommunication data (the plurality of telecommunication data includes the first data associated with the device address data). Telecommunications data) and multiple user identification data (identity data is included in the multiple user identification data). Each address data is respectively associated with one of the plurality of telecommunication data, and each user identity data is respectively associated with one of the plurality of telecommunication data. In this way, when the first server 220 receives the device address data from the user device 900, the first server 220 can associate the first telecommunication data from the database 210 according to the device address data. The first server 220 then encodes the first telecommunication data and a time stamp data to generate verification data. Then, the first server 220 sends the verification data to the user device 900 to complete the device verification process. The first server 220 also stores the verification data generated by it in the database 210 (for the convenience of the following description, The verification data transmitted to the user device 900 may also be referred to as the first verification data, and the verification data stored in the database 210 may also be referred to as the second verification data). Various implementations of the first server 220 may refer to the first server 120 in the first figure.

After the first server 220 completes the device authentication process, the second server 230 can receive the verification data (this verification data is the first verification data), the telecommunication number data, and the first identity verification data (preferably) from the user device 900 Specifically, the first identity verification data is that the user inputs a user identity data to the user device 900 during the authentication process, and the user device 900 encodes the user identity data to generate the first identity verification data ), the second server 230 determines based on the verification data (the verification data can be the first verification data and/or the second verification data), the telecommunication number data, the first identity verification data, and the identity data stored in the database 210 Whether to generate a successful authentication data. Preferably, the verification data generated by the first server 220 may be time-sensitive, and the second server 230 may be based on a predetermined time after the verification data is generated by the first server 220 (the length of the predetermined time may vary according to requirements). In the preset), the verification data (this verification data is the first verification data) and/or the first identity verification data are not received from the user device 900, and a verification failure data is generated to indicate that this authentication has failed. This approach can prevent a third party who is not the user from repeatedly inputting different identification data within a predetermined period of time to try to pass the authentication.

Preferably, the second server 230 does not need to decode the first verification data when verifying the first verification data. Instead, the second server 230 combines the second verification data stored in the database 210 with the user The first verification data received by the device 900 is compared to complete the verification of the first verification data. When the first verification data matches the second verification data, it means that the first verification data has passed the verification. Preferably, the second server 230 does not need to decode the first identity verification data when verifying the first identity verification data. Instead, the second server 230 encodes the identity data stored in the database 210. In order to generate a second identity verification data. The encoding method used by the second server 230 for generating the second identity verification data is exactly the same as the encoding method used by the first server 220 for generating the first identity verification data. For example, both of them use the same advanced encryption standard 256 (Advanced). Encryption Standard 256, AES 256) for encoding. Therefore, the second identity verification data generated by the second server 230 will be exactly the same as the first identity verification data generated by the first server 220. In this way, the second server 230 only needs to determine whether the first identity verification data conforms to the second identity verification data, and then the first identity verification data can be verified without decoding the first identity verification data. In addition, the second server 230 can match the second identity verification data based on the first identity verification data, and the verification (this verification data is the first verification data) received from the user device 900 is consistent with the data stored in the database 210 The verification data (this verification data is the second verification data), and the verification success data is generated, and the identity verification process is completed. If the first identity verification data does not match the second identity verification data, or the first verification data received from the user device 900 does not match the second verification data stored in the database 210, it means that the authentication has failed. At this time, the second server 230 will generate authentication failure data based on whether the first verification data does not meet the second verification data, or the first identity verification data does not meet the second identity verification data. It should be understood that this method of generating the second identity verification data by the second server 230 does not need to decode the first identity verification data, so it can avoid the outflow of the user identity data obtained after the first identity verification data is decoded. Cause information security risks.

After the identity authentication process is completed, the second server 230 may send the second telecommunication data stored in the database 210 to the user device 900 based on the authentication success data. In different embodiments, since the authentication system or method of the present invention is applied to an application on the user device 900, the second server 230 can store the second data in the database 210 based on the authentication success data. The telecommunication data is sent to the user device 900, or the second server 230 can send the second telecommunication data stored in the database 210 to a third server managed by the administrator of the application based on the authentication success data (Not shown in the picture). The third server can be communicatively connected (for example, through a network through communication) to the second server 230, and the user device 900 may be communicatively connected (for example, through a network through which communication is connected) to the first server 220 and/or the second server. Server 230. The second telecommunications data may include at least one of a telecommunications application data, a payment record data, and an agreement data, but it is not limited to this. The telecommunications application information can, for example, record the user's personal or appointed processing when applying for the door number, or for example, record the processing store when the application number is applied (the store can include directly-operated stores, franchised stores, distribution stores or online stores) , But not limited to this. The payment record data may, for example, record the user's usage/payment time length for this door number, whether the payment is normal, whether there is a late payment record, etc., but it is not limited to this. The agreement data may, for example, record the terms of use agreed by the user or the version number of the terms of use or the time when the user clicks to agree to the terms, but it is not limited to this. In a specific embodiment, the authentication system 200 may include one or more processors, and implement the database 210, the first server 220, and the second server 230 in a cooperative manner of hardware and software.

Please refer to the third figure, which illustrates a flowchart of a specific embodiment of the authentication method according to the present invention. As shown in the embodiment shown in the third figure, the authentication method 300 starts at step 310 and is used by the first server of the authentication system. The recipient device receives device address data. Then, step 320 is executed, and the first server associates the first telecommunication data from the database of the authentication system according to the device address data. The first server is in communication with the database, and the first server can access the database. Preferably, the database stores a plurality of address data (the plurality of address data includes the device address data of the user device 900) and a plurality of telecommunication data (the plurality of telecommunication data includes the device address data associated with the device The first telecommunication data), each address data is respectively associated with one of the plurality of telecommunication data. In this way, when the first server receives the device address data from the user device, the first server can associate the first telecommunication data from the database according to the device address data.

Then, step 330 is executed to encode the first telecommunication data and the time stamp data by the first server to generate verification data. Preferably, the first server 120 encodes the first telecommunication data and the time stamp data through a message digest algorithm (MD5) to generate verification data. Since MD5 is an irreversible encryption method, even if the verification data is intercepted or transmitted to other devices, there is no risk of outflow of the first telecommunication data. Then, step 340 is executed to store the verification data in the database by the first server. Then, step 350 is executed to send the verification data to the user device from the first server, so as to complete the device verification process. Among them, the verification data can be regarded as a device verification success data. In different embodiments, the user device may be a mobile communication device (such as a mobile phone, but not limited to this), and the time stamp data may indicate the time when the first server received the device address data from the user device, or The time stamp data can indicate the time when the user device sends the device address data to the first server, but it is not limited to this. The first telecommunications data may include at least one of house number data, card number data, tariff data, and Internet access authority data.

Please refer to the fourth figure, which illustrates a flowchart of a specific embodiment of the authentication method according to the present invention. As shown in the embodiment shown in the fourth figure, the authentication method 400 includes step 310 to step 350 in the third figure, and Step 350 is followed by step 410, where the second server of the authentication system receives the verification data, the telecommunication number data, and the first identity verification data from the user device. The second server is in communication with the database, and the second server can access the database. Preferably, the first identity verification data is that the user inputs a user identity data to the user device during the authentication process, and the user device encodes the user identity data to generate the first identity verification data.

After step 410 is executed, step 420 is then executed, and the second server determines whether to generate authentication success data based on the verification data, the telecommunication number data, the first identity verification data, and the identity data stored in the database. In a specific embodiment, the verification data may be time-sensitive, and the verification method 400 may further include the second server based on it within a predetermined time (for example, ten minutes) after the first server generates the first verification data, The verification data and/or the first identity verification data are not received from the user device, and a verification failure data is generated to indicate the failure of this authentication.

In a specific embodiment, the authentication method 400 may further include a step of encoding the identity data stored in the database by the second server to generate second identity verification data, and the second server based on the first identity The verification data conforms to the second identity verification data, and the verification data received from the user device conforms to the verification data stored in the database, and the steps of generating the authentication success data. The first identity verification data is encoded data, and the second server does not decode the first identity verification data. Preferably, the encoding method used by the second server to generate the second identity verification data is exactly the same as the encoding method used by the first server to generate the first identity verification data (for example, both use the same advanced encryption standard AES 256). Code). Therefore, the second identity verification data generated by the second server will be exactly the same as the first identity verification data generated by the first server. In this way, the second server only needs to determine whether the first identity verification data conforms to the second identity verification data, and then the first identity verification data can be verified without decoding the first identity verification data. In a specific embodiment, the authentication method 400 may further include the second server transmitting the second telecommunication data stored in the database to the user device based on the authentication success data generated by the second server. The second telecommunications information includes at least one of telecommunications application information, payment record information, and agreement terms information.

So far, the user authentication system and method of the present invention have been described by the above description and drawings. However, it should be understood that the specific embodiments of the present invention are for illustrative purposes only, and various changes can be made without departing from the scope and spirit of the patent application of the present invention, and should be included in the patent scope of the present invention. Therefore, the specific embodiments described in this specification are not intended to limit the present invention, and the true scope and spirit of the present invention are disclosed in the scope of the following patent applications.

100: authentication system 110: database 120: The first server 200: authentication system 210: database 220: The first server 230: second server 300: authentication method 310~350: Step 400: authentication method 410~420: steps 900: User device

The first figure is a system architecture diagram of a specific embodiment of the authentication system of the present invention.

The second figure is a system architecture diagram of a specific embodiment of the authentication system of the present invention.

The third figure is a flowchart of a specific embodiment of the authentication method of the present invention.

The fourth figure is a flowchart of a specific embodiment of the authentication method of the present invention.

without

200: authentication system

210: database

220: The first server

230: second server

900: User device

Claims (10)

An authentication system includes: a database storing a first telecommunication data and an identity data of a user; and a first server accessing the database, the first server receiving a data from a user device Device address data, and associate the first telecommunication data from the database according to the device address data, wherein the first server encodes the first telecommunication data and a time stamp data to generate a first Authentication data, the first server sends the first authentication data to the user device, the time stamp data indicates a time when the first server receives the device address data from the user device; a second A server that receives the first authentication data, the telecommunication data, and a self-input first identity authentication data on the user device from the user device, and the second server uses the data based on the first authentication data The corresponding identity data in the database is encrypted to generate a second identity verification data, and the second server determines whether or not based on at least the first verification data, the telecommunication data, the first identity verification data, and the second identity verification data. An authentication success data is generated, wherein the first identity verification data has not been decrypted by the second server, and the second identity verification data is obtained by encrypting the identity data of the database by the second server. The authentication system according to claim 1, wherein the first telecommunication data includes a house number data. The authentication system according to claim 1, wherein the second server does not receive the authentication data and/or the authentication data from the user device within a predetermined time after the authentication data is generated by the first server The first identity verification data generates a verification failure data. The authentication system according to claim 1, wherein the second server transmits a second telecommunication data stored in the database to the user device or a third server based on the authentication success data. The authentication system according to claim 4, wherein the second telecommunications data includes at least one of a telecommunications application data, a payment record data, and an agreement data. An authentication method includes: receiving a device address data from a user device by a first server of an authentication system; and associating from a database of the authentication system by the first server according to the device address data Out a first telecommunication data and an identity data of a user; the first server encodes the first telecommunication data and a time stamp data to generate a first verification data, wherein the time stamp data indicates A time when the first server receives the device address data from the user device; the first server sends the first authentication data to the user device; and the second server receives the device address data from the user device Receiving the first verification data, the telecommunication data, and a self-input first identity verification data on the user device, the second server based on the first verification data corresponds to the database The identity data is encrypted to generate a second identity verification data, the first identity verification data is data encrypted by the user device; the second server is based on at least the first verification data, the telecommunication data, and the first identity The verification data and the second identity verification data determine whether to generate an authentication success data, wherein the first identity verification data is not decoded by the second server, and the second identity verification data is obtained from the database by the second server Your identity data is encrypted. The authentication method according to claim 6, wherein the first telecommunication data includes a door number data. The authentication method according to claim 6, further comprising: the second server does not receive the authentication data from the user device within a predetermined time after the first server generates the authentication data, and /Or the first identity verification data generates a verification failure data. The authentication method according to claim 6, further comprising: sending, by the second server, a second telecommunication data stored in the database to the user device or a third server based on the authentication success data . The authentication method according to claim 6, wherein the second telecommunications data includes at least one of a telecommunications application data, a payment record data, and an agreement data.

Images