WO2018040760A1 - 服务器、终端及其授权码的验证方法 - Google Patents

服务器、终端及其授权码的验证方法 Download PDF

Info

Publication number
WO2018040760A1
WO2018040760A1 PCT/CN2017/092946 CN2017092946W WO2018040760A1 WO 2018040760 A1 WO2018040760 A1 WO 2018040760A1 CN 2017092946 W CN2017092946 W CN 2017092946W WO 2018040760 A1 WO2018040760 A1 WO 2018040760A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization code
identity information
verified
service
terminal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/092946
Other languages
English (en)
French (fr)
Inventor
叶川
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
JRD Communication Shenzhen Ltd
Original Assignee
JRD Communication Shenzhen Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by JRD Communication Shenzhen Ltd filed Critical JRD Communication Shenzhen Ltd
Publication of WO2018040760A1 publication Critical patent/WO2018040760A1/zh
Priority to US16/261,563 priority Critical patent/US20190158486A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/65—Environment-dependent, e.g. using captured environmental data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/68—Gesture-dependent or behaviour-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/082—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying multi-factor authentication

Definitions

  • the present invention relates to the field of data security technologies, and in particular, to a server, a terminal, and a verification method thereof.
  • a terminal such as a mobile phone
  • a terminal such as a mobile phone
  • the password is easily leaked and is stolen by criminals.
  • the criminal can monitor the user's keyboard, mouse, touch screen and other input devices through the network Trojan, and obtain the password input by the user. Once the password is leaked, it will cause huge losses to the user's privacy and property security.
  • the technical problem to be solved by the present invention is to provide a server, a terminal and a verification method for the authorization code thereof, which can use different authentication methods for the authorization code according to the identity information of the service, prevent the user account information from being stolen, and improve the security of the user account. Sex.
  • a technical solution adopted by the present invention is to provide a method for verifying an authorization code, the method comprising: receiving, by the server, an authorization code to be verified and identity information of a service sent by the terminal; determining whether the identity information satisfies the setting If the condition is that the authorization code to be verified is the first authorization code preset by the service or the second authorization code associated with the first authorization code, the verification of the authorization code to be verified is passed; if not, the content to be verified is determined.
  • the authorization code is only the first authorization code preset by the service, the verification of the authorization code to be verified is passed.
  • the identity information includes at least one of identity information of the terminal, identity information of the user, or identity information associated with the service.
  • the method further includes: receiving user settings sent by the terminal, the user setting a setting condition including the identity information of the service, the first authorization code, and the second authorization code; and checking and saving the user settings.
  • the setting condition of the identity information is preset identity information; determining whether the identity information satisfies the setting condition comprises: determining whether the identity information matches the preset identity information.
  • another technical solution adopted by the present invention is to provide a method for verifying an authorization code, the method comprising: when the terminal requests a service, acquiring the identity information and the authorization code to be verified input by the user; The authorization code and the identity information are sent to the server, so that the server determines that the identity information meets the set condition and the authorization code to be verified is the first authorization code preset by the service or the second authorization code associated with the first authorization code, or When it is determined that the identity information does not meet the set condition and the authorization code to be verified is only the first authorization code preset by the service, the verification of the authorization code to be verified is passed.
  • the identity information includes at least one of identity information of the terminal, identity information of the user, or identity information associated with the service.
  • the method further includes: receiving a setting condition of the identity information of the service set by the user, a first authorization code, and a second authorization code; and encrypting the user setting by using an asymmetric encryption algorithm, and sending the solution to the server, so that the server is used by the server. Settings for inspection and saving.
  • another technical solution adopted by the present invention is to provide a method for verifying an authorization code, the method comprising: obtaining, by a terminal, an authorization code and identity information to be verified by a user when requesting a service; and determining identity information. Whether the setting condition is met; if yes, when it is determined that the authorization code to be verified is the first authorization code preset by the service or the second authorization code associated with the first authorization code, the verification of the authorization code to be verified is passed; if not, then When it is determined that the authorization code to be verified is only the first authorization code preset by the service, the verification of the authorization code to be verified is passed.
  • a server includes: a communication module, configured to receive an authorization code and identity information to be verified for a service sent by the terminal; and a determining module, configured to determine Whether the identity information satisfies the setting condition; the verification module is configured to: when the judgment result of the determining module is yes, and when the to-be-verified authorization code is the first authorization code preset by the service or the second authorization code associated with the first authorization code, The verification module is further configured to verify the authorization code to be verified; the verification module is further configured to: when the determination result of the determination module is negative, and when the authorization code to be verified is only the first authorization code preset by the service, the verification of the authorization code to be verified is passed.
  • another technical solution adopted by the present invention is to provide a terminal, where the terminal includes: an obtaining module, configured to acquire identity information and a user-entered authentication code to be verified when requesting a service; and a communication module, And sending the to-be-verified authorization code and the identity information to the server, so that the server determines that the identity information meets the set condition, and the to-be-verified authorization code is a first authorization code preset by the service or a second authorization associated with the first authorization code.
  • the verification of the authorization code to be verified is passed.
  • the authentication method of the authorization code of the present invention includes: the server receives the authorization code to be verified and the identity information of the service sent by the terminal; and determines whether the identity information satisfies the setting condition; And determining, when determining that the authorization code to be verified is the first authorization code preset by the service or the second authorization code associated with the first authorization code, verifying the authorization code to be verified; if not, determining that the authorization code to be verified is only When the first authorization code is preset for the service, the verification of the authorization code to be verified is passed.
  • different authentication methods can be used for the authorization code according to the identity information of the service, thereby preventing the user account information from being stolen and improving the security of the user account.
  • FIG. 1 is a schematic flow chart of a first embodiment of a method for verifying an authorization code according to the present invention
  • FIG. 2 is a schematic flow chart of a second embodiment of a method for verifying an authorization code according to the present invention
  • FIG. 3 is a schematic flowchart of a third embodiment of a method for verifying an authorization code according to the present invention.
  • FIG. 4 is a schematic structural view of a first embodiment of a server according to the present invention.
  • Figure 5 is a schematic structural view of a second embodiment of the server of the present invention.
  • FIG. 6 is a schematic structural diagram of an embodiment of a terminal of the present invention.
  • FIG. 1 is a schematic flowchart of a first embodiment of a method for verifying an authorization code according to the present invention, where the method includes:
  • S11 The server receives the to-be-verified authorization code and identity information of the service sent by the terminal.
  • the service is an authorization service initiated by the user at the terminal, including account login, modification of user information, password and other privacy operations, financial operations such as payment and transfer, and transaction operations of virtual items on the network.
  • the authorization code to be verified of the service is an authorization code input by the terminal, and the authorization code may be a character string or a gesture symbol input by the user through a keyboard, a mouse, a touch screen, or the like, or may be a sound signal input through a voice receiver. .
  • the identity information of the service includes at least one of identity information of the terminal, identity information of the user, or identity information associated with the service.
  • the identifier information of the terminal may be a terminal model, a network IP address, or the like. If the terminal is a mobile phone, the identifier information of the terminal may also be a mobile phone serial number, a user information associated with a SIM card (ie, a mobile phone number) in the mobile phone, and the like. .
  • the identity information of the user may be identity information verified by the user by inputting identity card information, password protection problem, or the like, or may be identity information determined by inputting identification information such as fingerprints and voices.
  • the identity information of the service association is the identity information that is matched when the service is authorized by the user. For example, if the user logs in to an account, the identity information associated with the service is the identity information of the user to which the account belongs.
  • the identity information of the service may also be a combination of two or three of the identity information of the terminal, the identity information of the user, or the identity information associated with the service.
  • the identity information of the service may be the matching information of the identity information of the service association and the identity information of the terminal.
  • the setting condition may be arbitrarily set according to different requirements.
  • the setting condition here may be the IP address of the account login.
  • the terminal obtains the account and password input by the user, the account, the password, and the IP address of the terminal network are sent to the server, and the server determines whether the IP address is a common IP address for the account login.
  • the account login is used as an example, and the setting condition may also be a mobile phone number.
  • the terminal After obtaining the account and password input by the user, the terminal sends the account number, the password, and the mobile phone number of the terminal SIM card to the server, and the server determines whether the mobile phone number is the common mobile phone number registered by the account.
  • the identity information of the service satisfies the set condition, whether the authorization code to be verified input by the user is the first authorization code preset by the service or the second authorization code, the verification of the authorization code to be verified is passed.
  • the method includes:
  • the server receives the user setting sent by the terminal, and the user sets a setting condition including the identity information of the service, a first authorization code, and a second authorization code; and checks and saves the user setting.
  • the setting condition of the identity information may be preset identity information. Then, S12 can be specifically: determining whether the identity information matches the preset identity information.
  • the identity information preset by an account is the login mobile phone number A, then in S12, it is determined whether the mobile phone number that the user logs into the account matches A.
  • FIG. 2 is a schematic flowchart diagram of a second implementation manner of a method for verifying an authorization code according to the present invention, where the method includes:
  • the identity information includes at least one of identity information of the terminal, identity information of the user, or identity information associated with the service.
  • the identity information includes a combination of two or three of identity information of the terminal, identity information of the user, or identity information associated with the service.
  • S22 Send the to-be-verified authorization code and the identity information to the server, so that the server determines that the identity information meets the set condition, and the to-be-verified authorization code is a first authorization code preset by the service or a second authorization associated with the first authorization code.
  • the verification of the authorization code to be verified is passed.
  • the method may further include:
  • the user settings are encrypted using an asymmetric encryption algorithm and sent to the server to enable the server to verify and save the user settings.
  • This embodiment is based on the first embodiment, and the method performed by the terminal corresponding to the server is similar in principle, and details are not described herein again.
  • the user when registering an account, the user sets a first authorization code, a second authorization code, and identity information (including at least the user's phone number) associated with the account.
  • the first authorization code is a relatively complex real password
  • the second authorization code is a relatively simple password instead of the first authorization code.
  • the first authorization code must be a combination of uppercase and lowercase letters plus a number
  • the second authorization code can be a purely numeric password, for example, 123456.
  • the account number and the relatively simple second authorization code can be input, and the mobile phone A sends the account number, the password, and the mobile phone number of the mobile phone A to the server.
  • the server verifies, the mobile phone number is determined to be the account registration.
  • the mobile phone number entered is determined to be safe for the login environment of the account, the second authorization code is verified.
  • the criminal numerator acquires the account number and the second authorization code by a certain means when the user logs in, and when logging in through the mobile phone B, the account number, the password, and the mobile phone number of the mobile phone B are sent to the server, and the server determines the time when verifying.
  • the mobile phone number is not the mobile phone number entered when the account is registered. If the login environment of the account is determined to be unsafe, the second authorization code is not verified.
  • the first authorization code can be input.
  • the server is authenticated, the first authorization code is verified regardless of the environment of the terminal.
  • the method for verifying the authorization code of the embodiment includes: the server receiving the to-be-verified authorization code and the identity information of the service sent by the terminal; determining whether the identity information satisfies the setting condition; if yes, determining the authorization code to be verified When the first authorization code preset for the service or the second authorization code associated with the first authorization code is used, the verification of the authorization code to be verified is passed; if not, the first authorization to determine the authorization code to be verified is only the first authorization of the service. When the code is coded, the verification of the authorization code to be verified is passed. In the above manner, different authentication methods can be used for the authorization code according to the identity information of the service, thereby preventing the user account information from being stolen and improving the security of the user account.
  • FIG. 3 is a schematic flowchart diagram of a third embodiment of a method for verifying an authorization code according to the present invention, where the method includes:
  • the terminal When requesting the service, the terminal acquires the authorization code and identity information to be verified input by the user.
  • the user sets the first unlock password and the second unlock password in advance, and sets a setting condition: whether the unlocked location is within a specified range (eg, the user's home, company, or other frequent place).
  • a specified range eg, the user's home, company, or other frequent place.
  • the mobile phone When the user is in the designated location, the mobile phone can be unlocked regardless of whether the first unlocking password and the second unlocking password are used, and when the user's mobile phone is stolen or other circumstances are not unlocked at the designated location, the first unlocking password can only be used. Unlock.
  • FIG. 4 is a schematic structural diagram of a first embodiment of a server according to the present invention, where the server includes:
  • the communication module 41 is configured to receive the to-be-verified authorization code and identity information of the service sent by the terminal.
  • the determining module 42 is configured to determine whether the identity information meets the set condition.
  • the verification module 43 is configured to: when the determination result of the determination module is yes, and when the authorization code to be verified is the first authorization code preset by the service or the second authorization code associated with the first authorization code, pass the authorization code to be verified verification.
  • the verification module 43 is further configured to: when the determination result of the determination module is negative, and when the authorization code to be verified is only the first authorization code preset by the service, pass the verification of the authorization code to be verified.
  • FIG. 5 is a schematic structural diagram of a second embodiment of a server according to the present invention.
  • the server includes a processor 51, a memory 52, and a communication module 53.
  • the processor 51, the memory 52, and the communication module 53 are connected by a bus.
  • the memory 52 is used to store system files, application software, and preset identity information, authorization codes, and the like.
  • the communication module 53 is configured to receive the to-be-verified authorization code and identity information of the service sent by the terminal.
  • the processor 51 is configured to perform the following steps:
  • Determining whether the identity information satisfies the setting condition if yes, when determining that the authorization code to be verified is the first authorization code preset by the service or the second authorization code associated with the first authorization code, the verification of the authorization code to be verified is passed; Otherwise, when it is determined that the authorization code to be verified is only the first authorization code preset by the service, the verification of the authorization code to be verified is passed.
  • the identity information includes at least one of identity information of the terminal, identity information of the user, or identity information associated with the service.
  • the communication module 53 is further configured to receive user settings sent by the terminal, where the user sets a setting condition including the identity information of the service, a first authorization code, and a second authorization code; the memory 53 is further configured to check the user settings. And save.
  • the disclosed method and apparatus may be implemented in other manners.
  • the device implementations described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated units of the other embodiments described above may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods of the various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read only memory (ROM, Read-Only) Memory, random access memory (RAM), disk or optical disk, and other media that can store program code.
  • FIG. 6 is a schematic structural diagram of an embodiment of a terminal according to the present invention, where the terminal includes:
  • the obtaining module 61 is configured to obtain the identity information and the authorization code to be verified input by the user when requesting the service;
  • the communication module 62 is configured to send the to-be-verified authorization code and the identity information to the server, so that the server determines that the identity information meets the set condition and the authorization code to be verified is the first authorization code preset by the service or is associated with the first authorization code.
  • the second authorization code is used, or when it is determined that the identity information does not satisfy the set condition and the authorization code to be verified is only the first authorization code preset by the service, the verification of the authorization code to be verified is passed.
  • server and the terminal are both a server and a terminal based on an implementation method of the authentication method of the authorization code, and the implementation principles and steps are similar, and details are not described herein again.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Power Engineering (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Animal Behavior & Ethology (AREA)
  • General Health & Medical Sciences (AREA)
  • Human Computer Interaction (AREA)
  • Social Psychology (AREA)
  • Environmental & Geological Engineering (AREA)
  • Telephonic Communication Services (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本发明公开了一种服务器、终端及其授权码的验证方法，该方法包括：服务器接收终端发送的业务的待验证授权码和身份信息；判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。通过上述方式，本发明能够根据业务的身份信息对授权码采用不同的验证方式，防止用户账户信息被盗，提高了用户账户的安全性。

Description

服务器、终端及其授权码的验证方法
【技术领域】
本发明涉及数据安全技术领域，特别是涉及一种服务器、终端及其授权码的验证方法。
【背景技术】
目前互联网的应用场景越来越多，各类账号、密码的使用也越来越频繁，特别是与金融、财金、隐私相关的账号密码，在登录或支付时有都需要输入安全的授权（确认）密码，授权密码通常是由字母、数字、符号组合形成的字符串。
用户在终端（如手机）输入密码时往往很容易被旁边的人所看见和记住，密码很容易泄露，从而被不法分子所窃取利用。另外，即使用户独自输入密码，不法分子也可以通过网络木马监控用户的键盘、鼠标、触摸屏等输入设备，并获取到用户输入的密码。密码一旦泄露，会给用户的隐私、财产安全造成巨大的损失。
在现有技术中，一般是通过隐藏密码显示（或将密码显示为*号等特殊符号），或者打乱数字的排列等方式，但效果不佳，仍然具有被盗取密码的风险。
【发明内容】
本发明主要解决的技术问题是提供一种服务器、终端及其授权码的验证方法，能够根据业务的身份信息对授权码采用不同的验证方式，防止用户账户信息被盗，提高了用户账户的安全性。
为解决上述技术问题，本发明采用的一个技术方案是：提供一种授权码的验证方法，该方法包括：服务器接收终端发送的业务的待验证授权码和身份信息；判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
其中，身份信息包括终端的标识信息、用户的身份信息、或业务关联的身份信息中的至少一个。
其中，还包括：接收终端发送的用户设置，用户设置包括业务的身份信息的设定条件、第一授权码以及第二授权码；对用户设置进行检验和保存。
其中，身份信息的设定条件为预设的身份信息；判断身份信息是否满足设定条件，包括：判断身份信息与预设的身份信息是否匹配。
为解决上述技术问题，本发明采用的另一个技术方案是：提供一种授权码的验证方法，该方法包括：终端在请求业务时，获取身份信息和用户输入的待验证授权码；将待验证授权码和身份信息发送给服务器，以使服务器在判断身份信息满足设定条件且待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，或在判断身份信息不满足设定条件且待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
其中，身份信息包括终端的标识信息、用户的身份信息、或业务关联的身份信息中的至少一个。
其中，还包括：接收用户设置的与业务的身份信息的设定条件、第一授权码以及第二授权码；将用户设置采用非对称加密算法进行加密后，发送给服务器，以使服务器对用户设置进行检验和保存。
为解决上述技术问题，本发明采用的另一个技术方案是：提供一种授权码的验证方法，该方法包括：终端在请求业务时，获取用户输入的待验证授权码和身份信息；判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
为解决上述技术问题，本发明采用的另一个技术方案是：提供一种服务器，该服务器包括：通信模块，用于接收终端发送的业务的待验证授权码和身份信息；判断模块，用于判断身份信息是否满足设定条件；验证模块，用于在判断模块的判断结果为是，且在待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；验证模块还用于在判断模块的判断结果为否，且在待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
为解决上述技术问题，本发明采用的另一个技术方案是：提供一种终端，该终端包括：获取模块，用于在请求业务时，获取身份信息和用户输入的待验证授权码；通信模块，用于将待验证授权码和身份信息发送给服务器，以使服务器在判断身份信息满足设定条件且待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，或在判断身份信息不满足设定条件且待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
本发明的有益效果是：区别于现有技术的情况，本发明的授权码的验证方法包括：服务器接收终端发送的业务的待验证授权码和身份信息；判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。通过上述方式，能够根据业务的身份信息对授权码采用不同的验证方式，防止用户账户信息被盗，提高了用户账户的安全性。
【附图说明】
图1是本发明授权码的验证方法第一实施方式的流程示意图；
图2是本发明授权码的验证方法第二实施方式的流程示意图；
图3是本发明授权码的验证方法第三实施方式的流程示意图；
图4是本发明服务器第一实施方式的结构示意图；
图5是本发明服务器第二实施方式的结构示意图；
图6是本发明终端一实施方式的结构示意图。
【具体实施方式】
参阅图1，图1是本发明授权码的验证方法第一实施方式的流程示意图，该方法包括：
S11：服务器接收终端发送的业务的待验证授权码和身份信息。
其中，该业务为用户在终端发起的授权业务，包括账号登录，修改用户信息、密码等隐私操作，付款、转账等金融操作，以及网络虚拟物品的交易操作等。
其中，该业务的待验证授权码为终端接收用户输入的授权码，该授权码可以是用户通过键盘、鼠标、触摸屏等输入的字符串或手势符号，也可以是通过语音接收器输入的声音信号。
可选的，该业务的身份信息包括终端的标识信息、用户的身份信息、或业务关联的身份信息中的至少一个。
具体地，终端的标识信息可以是终端型号、网络IP地址等，若该终端为手机，则终端的标识信息还可以是手机串号、手机中SIM卡（即手机号）所关联的用户信息等。用户的身份信息可以是用户通过输入身份证信息、密码保护问题等方式验证的身份信息，也可以是通过录入指纹、声音等身份识别信息判断得到的身份信息。业务关联的身份信息即用户所需要授权的业务注册时所匹配的身份信息；例如，用户登录一个账号，则业务关联的身份信息即该账号所属用户的身份信息。
可选的，业务的身份信息也可以是终端的标识信息、用户的身份信息、或业务关联的身份信息中的两个或三个的组合。
例如，业务的身份信息可以是业务关联的身份信息与终端的标识信息的匹配信息。
S12：判断身份信息是否满足设定条件。
其中，该设定条件可以是根据不同的需求来任意设置的。
以登录账号为例，这里的设定条件可以是账号登录的IP地址。终端获取用户输入的账号、密码后，将账号、密码以及终端网络的IP地址均发送给服务器，服务器则判断该IP地址是否为该账号登录的常用IP地址。
同样以账号登录为例，设定条件还可以是手机号码。终端获取用户输入的账号、密码后，将账号、密码以及终端SIM卡的手机号均发送给服务器，服务器则判断该手机号是否为该账号登录的常用手机号。
其中，在S12的判断结果为是时，进行S13；在S12的判断结果为否时，进行S14。
S13：在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证。
即在业务的身份信息满足设定条件时，不论用户输入的待验证授权码是该业务预设的第一授权码，还是第二授权码，均通过该待验证授权码的验证。
S14：在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
即在业务的身份信息不满足设定条件时，只有在用户输入的待验证授权码是该业务预设的第一授权码时，才通过该待验证授权码的验证；而在用户输入的待验证授权码是该业务预设的第二授权码时，不通过该待验证授权码的验证。
可以理解的，该业务预设的第一授权码和第二授权码均是由用户预先设置的，在其他实施方式中，该方法包括：
服务器接收终端发送的用户设置，用户设置包括业务的身份信息的设定条件、第一授权码以及第二授权码；以及对用户设置进行检验和保存。
其中，身份信息的设定条件可以为预设的身份信息。那么，S12可以具体为：判断身份信息与预设的身份信息是否匹配。
例如，某一账户预设的身份信息为登录手机号为A，那么在S12中，则判断用户登录该账户的手机号是否与A相匹配。
参阅图2，图2是本发明授权码的验证方法第二实施方式的流程示意图，该方法包括：
S21：终端在请求业务时，获取身份信息和用户输入的待验证授权码。
可选的，身份信息包括终端的标识信息、用户的身份信息、或业务关联的身份信息中的至少一个。
可选的，身份信息包括终端的标识信息、用户的身份信息、或业务关联的身份信息中的两个或三个的组合。
S22：将待验证授权码和身份信息发送给服务器，以使服务器在判断身份信息满足设定条件且待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，或在判断身份信息不满足设定条件且待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
可选的，在S21之前，还可以包括：
接收用户设置的与业务的身份信息的设定条件、第一授权码以及第二授权码；以及
将用户设置采用非对称加密算法进行加密后，发送给服务器，以使服务器对用户设置进行检验和保存。
可以理解的，以上步骤仅仅是在初始设置或者需要对身份信息进行修改时才执行，而不是每次均需要执行。
本实施方式是基于第一实施方式，与服务器对应的终端所执行的方法，其实施的原理类似，这里不再赘述。
下面以一具体的例子，对上述两种实施方式进行详细说明：
首先，用户在注册账号时，设置与该账号关联的第一授权码、第二授权码，以及身份信息（至少包括用户的电话号码）。其中，第一授权码是一个较为复杂的真实密码，而第二授权码是作为替代第一授权码的一个较为简单的密码。例如，第一授权码必须是大小写字母组合并加上数字的一个密码，而第二授权码可以是一个纯数字密码，例如，123456。
当用户在手机A登录时，可以输入账号和较为简单的第二授权码，手机A则向服务器发送账号、密码以及该手机A的手机号，服务器在验证时，判断该手机号即为账号注册时输入的手机号，认定账号的登录环境安全，则通过该第二授权码的验证。
假设不法分子在用户登录时通过一定的手段获取到了该账号和第二授权码，并通过手机B登录时，则向服务器发送账号、密码以及该手机B的手机号，服务器在验证时，判断该手机号不是账号注册时输入的手机号，认定账号的登录环境不安全，则不通过该第二授权码的验证。
另外，若用户需要通过其他设备来登录账号时，可以输入较为复杂的第一授权码，服务器在验证时，无论终端处于何种环境，均通过该第一授权码的验证。
区别于现有技术，本实施方式的授权码的验证方法包括：服务器接收终端发送的业务的待验证授权码和身份信息；判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。通过上述方式，能够根据业务的身份信息对授权码采用不同的验证方式，防止用户账户信息被盗，提高了用户账户的安全性。
参阅图3，图3是本发明授权码的验证方法第三实施方式的流程示意图，该方法包括：
S31：终端在请求业务时，获取用户输入的待验证授权码和身份信息。
S32：判断身份信息是否满足设定条件。
S33：若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证。
S34：若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
不同于上述两种实施方式，本实施的所有步骤均在终端完成，是用于不需要联网操作的授权码验证方法，可以用于手机解锁、单机应用的密码等。
例如，用户预先设置了第一解锁密码和第二解锁密码，并设置了设定条件：解锁的位置是否为指定范围内（例如用户的家庭、公司或其他常去的地方）。
当用户在指定位置，无论使用第一解锁密码和第二解锁密码均能对手机进行解锁，而当由于用户手机被盗或其他情况造成的不在指定位置解锁，则只能使用第一解锁密码进行解锁。
参阅图4，图4是本发明服务器第一实施方式的结构示意图，该服务器包括：
通信模块41，用于接收终端发送的业务的待验证授权码和身份信息。
判断模块42，用于判断身份信息是否满足设定条件。
验证模块43，用于在判断模块的判断结果为是，且在待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证。
验证模块43还用于在判断模块的判断结果为否，且在待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
参阅图5，图5是本发明服务器第二实施方式的结构示意图，该服务器包括处理器51、存储器52以及通信模组53。
可选的，该处理器51、存储器52以及通信模组53通过一条总线连接。
存储器52用于存储系统文件、应用软件以及预设的身份信息、授权码等。
通信模组53用于接收终端发送的业务的待验证授权码和身份信息。
处理器51用于执行以下步骤：
判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
可选的，身份信息包括终端的标识信息、用户的身份信息、或业务关联的身份信息中的至少一个。
可选的，通信模组53还用于接收终端发送的用户设置，用户设置包括业务的身份信息的设定条件、第一授权码以及第二授权码；存储器53还用于对用户设置进行检验和保存。
在本发明所提供的几个实施方式中，应该理解到，所揭露的方法以及设备，可以通过其它的方式实现。例如，以上所描述的设备实施方式仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施方式方案的目的。
另外，在本发明各个实施方式中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述其他实施方式中的集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备（可以是个人计算机，服务器，或者网络设备等）或处理器（processor）执行本发明各个实施方式所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、磁碟或者光盘等各种可以存储程序代码的介质。
参阅图6，图6是本发明终端一实施方式的结构示意图，该终端包括：
获取模块61，用于在请求业务时，获取身份信息和用户输入的待验证授权码；
通信模块62，用于将待验证授权码和身份信息发送给服务器，以使服务器在判断身份信息满足设定条件且待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，或在判断身份信息不满足设定条件且待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
可以理解的，上述服务器和终端的实施方式均是基于授权码的验证方法的实施方式的服务器和终端，其实施的原理和步骤类似，这里不再赘述。
以上所述仅为本发明的实施方式，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (13)

  1. 一种授权码的验证方法，其中，包括：
    服务器接收终端发送的用户设置，所述用户设置包括身份信息的设定条件、第一授权码以及第二授权码；
    对所述用户设置进行检验和保存；
    接收终端发送的业务的待验证授权码和身份信息；
    判断所述身份信息是否满足所述设定条件；
    若是，则在判断所述待验证授权码为所述业务预设的第一授权码或与所述第一授权码关联的第二授权码时，通过所述待验证授权码的验证；
    若否，则在判断所述待验证授权码仅为所述业务预设的第一授权码时，通过所述待验证授权码的验证；
    其中，所述身份信息包括所述终端的标识信息、用户的身份信息、或所述业务关联的身份信息中的至少一个。
  2. 根据权利要求1所述的验证方法，其中，
    所述身份信息的设定条件为预设的身份信息；
    所述判断所述身份信息是否满足设定条件，包括：
    判断所述身份信息与所述预设的身份信息是否匹配。
  3. 根据权利要求1所述的验证方法，其中，
    所述终端为手机，所述终端的标识信号为所述手机的手机号码。
  4. 一种授权码的验证方法，其中，包括：
    终端在请求业务时，获取身份信息和用户输入的待验证授权码；
    将所述待验证授权码和所述身份信息发送给服务器，以使所述服务器在判断所述身份信息满足设定条件且所述待验证授权码为所述业务预设的第一授权码或与所述第一授权码关联的第二授权码时，或在判断所述身份信息不满足设定条件且所述待验证授权码仅为所述业务预设的第一授权码时，通过所述待验证授权码的验证。
  5. 根据权利要求4所述的验证方法，其中，
    所述身份信息包括所述终端的标识信息、用户的身份信息、或所述业务关联的身份信息中的至少一个。
  6. 根据权利要求5所述的验证方法，其中，
    所述终端为手机，所述终端的标识信号为所述手机的手机号码。
  7. 根据权利要求4所述的验证方法，其中，还包括：
    接收用户设置的与所述业务的身份信息的设定条件、第一授权码以及第二授权码；
    将所述用户设置采用非对称加密算法进行加密后，发送给所述服务器，以使所述服务器对所述用户设置进行检验和保存。
  8. 根据权利要求7所述的验证方法，其中，
    所述身份信息的设定条件为预设的身份信息；
    所述服务器判断所述身份信息是否满足设定条件，具体为：
    所述服务器判断所述身份信息与所述预设的身份信息是否匹配。
  9. 一种服务器，其中，包括通信模组以及处理器；
    所述通信模组用于接收终端发送的业务的待验证授权码和身份信息；
    所述处理器用于执行以下步骤：
    判断身份信息是否满足设定条件；若是，则在判断待验证授权码为业务预设的第一授权码或与第一授权码关联的第二授权码时，通过待验证授权码的验证；若否，则在判断待验证授权码仅为业务预设的第一授权码时，通过待验证授权码的验证。
  10. 根据权利要求9所述的服务器，其中，还包括存储器；
    所述通信模组还用于接收终端发送的用户设置，所述用户设置包括身份信息的设定条件、第一授权码以及第二授权码；
    所述处理器用于对所述用户设置进行验证；
    所述存储器用于对所述用户设置进行保存。
  11. 根据权利要求10所述的服务器，其中，
    所述身份信息的设定条件为预设的身份信息；
    所述处理器还用于判断所述身份信息与所述预设的身份信息是否匹配。
  12. 根据权利要求9所述的服务器，其中，
    所述身份信息包括所述终端的标识信息、用户的身份信息、或所述业务关联的身份信息中的至少一个。
  13. 根据权利要求12所述的服务器，其中，
    所述终端为手机，所述终端的标识信号为所述手机的手机号码。
PCT/CN2017/092946 2016-08-29 2017-07-14 服务器、终端及其授权码的验证方法 Ceased WO2018040760A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/261,563 US20190158486A1 (en) 2016-08-29 2019-01-30 Method for authorization code verification and server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610754745.6A CN106453243B (zh) 2016-08-29 2016-08-29 服务器、终端及其授权码的验证方法
CN201610754745.6 2016-08-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/261,563 Continuation US20190158486A1 (en) 2016-08-29 2019-01-30 Method for authorization code verification and server

Publications (1)

Publication Number Publication Date
WO2018040760A1 true WO2018040760A1 (zh) 2018-03-08

Family

ID=58091507

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/092946 Ceased WO2018040760A1 (zh) 2016-08-29 2017-07-14 服务器、终端及其授权码的验证方法

Country Status (3)

Country Link
US (1) US20190158486A1 (zh)
CN (1) CN106453243B (zh)
WO (1) WO2018040760A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106453243B (zh) * 2016-08-29 2019-11-29 捷开通讯(深圳)有限公司 服务器、终端及其授权码的验证方法
CN110942556A (zh) * 2019-12-27 2020-03-31 合肥美的智能科技有限公司 无人零售终端的认证方法、服务端和客户端
CN112969181A (zh) * 2021-03-26 2021-06-15 中国联合网络通信集团有限公司 终端应急解锁方法、系统、移动终端及存储介质
CN113205194A (zh) * 2021-04-29 2021-08-03 深圳市中兴系统集成技术有限公司 一种基于授权码的作业安全卡控方法
CN115664865B (zh) * 2022-12-27 2023-05-12 深圳巨隆基科技有限公司 一种验证数据传输方法、系统、计算机设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102880820A (zh) * 2012-08-14 2013-01-16 东莞宇龙通信科技有限公司 一种移动终端应用程序访问方法及移动终端
US20140068702A1 (en) * 2012-08-31 2014-03-06 Avaya Inc. Single sign-on system and method
CN105142143A (zh) * 2015-10-22 2015-12-09 上海斐讯数据通信技术有限公司 一种验证方法及其系统
CN105450666A (zh) * 2015-12-30 2016-03-30 百度在线网络技术（北京）有限公司 一种登录验证方法和装置
CN106453243A (zh) * 2016-08-29 2017-02-22 捷开通讯(深圳)有限公司 服务器、终端及其授权码的验证方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9608988B2 (en) * 2009-02-03 2017-03-28 Inbay Technologies Inc. Method and system for authorizing secure electronic transactions using a security device having a quick response code scanner
CN103297408B (zh) * 2012-03-02 2016-04-06 腾讯科技（深圳）有限公司 登录方法和装置以及终端、网络服务器
CN103793636B (zh) * 2012-11-01 2017-12-22 华为技术有限公司 一种设备及保护设备隐私的方法
CN103532971B (zh) * 2013-10-24 2017-01-25 北京星网锐捷网络技术有限公司 基于二维码的认证方法、装置和系统
CN104318186B (zh) * 2014-09-28 2017-03-15 厦门美图移动科技有限公司 一种密码切换方法、设备和终端
CN105227320B (zh) * 2015-10-28 2020-01-10 腾讯科技（深圳）有限公司 一种授权方法、服务器、终端及系统
CN105468947A (zh) * 2015-11-27 2016-04-06 北京金山安全软件有限公司 一种信息处理方法、装置及电子设备
CN105515846B (zh) * 2015-12-01 2019-10-18 浙江宇视科技有限公司 基于客户端的nvr配置方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102880820A (zh) * 2012-08-14 2013-01-16 东莞宇龙通信科技有限公司 一种移动终端应用程序访问方法及移动终端
US20140068702A1 (en) * 2012-08-31 2014-03-06 Avaya Inc. Single sign-on system and method
CN105142143A (zh) * 2015-10-22 2015-12-09 上海斐讯数据通信技术有限公司 一种验证方法及其系统
CN105450666A (zh) * 2015-12-30 2016-03-30 百度在线网络技术（北京）有限公司 一种登录验证方法和装置
CN106453243A (zh) * 2016-08-29 2017-02-22 捷开通讯(深圳)有限公司 服务器、终端及其授权码的验证方法

Also Published As

Publication number Publication date
US20190158486A1 (en) 2019-05-23
CN106453243A (zh) 2017-02-22
CN106453243B (zh) 2019-11-29

Similar Documents

Publication Publication Date Title
WO2017057899A1 (ko) 일회용 난수를 이용하여 인증하는 통합 인증 시스템
WO2018040760A1 (zh) 服务器、终端及其授权码的验证方法
WO2018124857A1 (ko) 블록체인 기반의 모바일 아이디를 이용하여 사용자를 비대면 인증하는 방법, 단말 및 이를 이용한 서버
WO2018194378A1 (ko) 블록체인 기반의 토큰 아이디를 이용하여 카드 사용을 승인하는 방법 및 이를 이용한 서버
WO2014026442A1 (zh) 身份认证装置及其方法
CN109417553A (zh) 经由内部网络监视来检测使用泄漏证书的攻击
WO2013048102A2 (ko) 보안이 강화된 클라우드 시스템 및 그에 의한 보안 관리 방법
WO2011118871A1 (ko) 휴대단말기를 이용한 인증 방법 및 시스템
WO2018124856A1 (ko) 블록체인 데이터베이스를 통해 모바일 아이디를 이용하여 사용자를 인증하는 방법, 단말 및 이를 이용한 서버
CN102667799B (zh) 访问控制系统和认证服务器系统
WO2018216988A1 (ko) 다중 사용자의 인증요소를 조합하여 보안키를 생성하는 보안인증시스템 및 보안인증방법
CN101588352A (zh) 一种确保操作环境安全的方法及系统
TWM595792U (zh) 跨平台授權存取資源的授權存取系統
WO2013085217A1 (ko) 다수의 중계 서버를 갖는 보안관리 시스템 및 보안관리 방법
WO2018026109A1 (ko) 네트워크를 사용하여 게이트에 대한 액세스 허용 여부를 결정하는 방법, 서버 및 컴퓨터 판독 가능한 기록 매체
WO2018216991A1 (ko) 다중 사용자의 인증요소를 조합하여 보안키를 생성하는 보안인증방법
WO2020117020A1 (ko) 생체 정보 기반의 pki 키 생성 방법 및 이를 이용한 키 생성 장치
CN117411671A (zh) 一种基于IPv6的终端身份认证方法及装置
CN108667801A (zh) 一种物联网接入身份安全认证方法及系统
WO2020159328A1 (ko) 인증 정보 처리 방법 및 장치와 인증 정보 처리 방법 장치를 포함한 사용자 단말
WO2023127977A1 (ko) 블록체인 기반 인증 및 거래 시스템
CN101867588A (zh) 一种基于802.1x的接入控制系统
WO2012169752A2 (ko) 접속 시도 기기 인증 시스템 및 방법
CN111698253A (zh) 一种计算机网络安全系统
CN101621503A (zh) 应用于虚拟专用网络架构下的身份识别系统与方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17845063

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17845063

Country of ref document: EP

Kind code of ref document: A1