WO2018108062A1 - 身份验证方法、装置及存储介质 - Google Patents

身份验证方法、装置及存储介质 Download PDF

Info

Publication number
WO2018108062A1
WO2018108062A1 PCT/CN2017/115566 CN2017115566W WO2018108062A1 WO 2018108062 A1 WO2018108062 A1 WO 2018108062A1 CN 2017115566 W CN2017115566 W CN 2017115566W WO 2018108062 A1 WO2018108062 A1 WO 2018108062A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
client
seed
token
server
Prior art date
Application number
PCT/CN2017/115566
Other languages
English (en)
French (fr)
Inventor
袁丽娜
郝允允
李轶峰
陈云云
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201611162210.6A external-priority patent/CN108234412B/zh
Priority claimed from CN201611162274.6A external-priority patent/CN108234113B/zh
Priority claimed from CN201611161452.3A external-priority patent/CN108234409B/zh
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018108062A1 publication Critical patent/WO2018108062A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present application relates to the field of identity verification, and in particular, to an authentication method, apparatus, and storage medium.
  • the embodiment of the present application discloses an identity verification method, apparatus, and storage medium.
  • An embodiment of the present application provides an identity verification method, which is applied to a first client, where the method includes:
  • the verification result is that the verification server obtains by comparing whether the first verification seed corresponds to the first token, the first token Is generated by the second client in response to the confirmation instruction of the verification message, and sent to the verification server, where the second client stores a second verification seed, and the account number and the second verification seed. Correspondence.
  • the embodiment of the present application further provides an identity verification apparatus, which is applied to the first client, and includes:
  • the memory having a machine readable instruction module executable by the processor; the machine readable instruction module comprising:
  • An account obtaining module configured to obtain an account of the second client in response to the identity verification instruction of the second client;
  • a first verification seed query module configured to query, according to the account, a first verification seed corresponding to the account, where the first client stores the first verification seed, and the account number and the first a verification seed corresponding relationship;
  • a verification message generating module configured to generate a verification message according to the account
  • a verification message sending module configured to send the first verification seed and the verification message to the verification server
  • a verification result obtaining module configured to obtain a verification result, and determine, according to the verification result, whether the second client verifies the verification; the verification result is that the verification server obtains whether the first verification seed corresponds to the first token
  • the first token is generated by the second client in response to the confirmation instruction of the verification message and sent to the verification server, where the second client stores the second verification seed, and the account Correspondence relationship with the second verification seed.
  • the embodiment of the present application further provides an identity verification method, which is applied to a second client, where the method includes:
  • the verification server receives the verification message sent by the first client and provides the verification message to the second client, where the message identifier is allocated by the verification server a message identifier corresponding to the verification message;
  • the user instructions including a confirmation instruction responsive to the verification message
  • the verification server Transmitting the message identifier and the first token to an authentication server, so that the verification server obtains the verification result, and sends the verification result to the first client; the verification result is that the verification server passes the verification first verification And obtaining, by the identifier, whether the seed is corresponding to the first token, where the first verification seed is queried by the verification server from the verification server by using the message identifier.
  • the embodiment of the present application further provides an identity verification apparatus, which is applied to a second client, where the apparatus includes:
  • the memory having a machine readable instruction module executable by the processor; the machine readable instruction module comprising:
  • a message obtaining module configured to obtain a message identifier and a verification message, where the verification server receives the verification message sent by the first client, and provides the verification message to the second client, where the message identifier is a message identifier corresponding to the verification message allocated by the verification server;
  • a display module configured to display the verification message
  • a user instruction monitoring module configured to detect a user instruction, where the user instruction includes a confirmation instruction in response to the verification message
  • a second verification seed obtaining module configured to acquire a second verification seed
  • a token generating module configured to generate a first token according to the second verification seed
  • a transmission module configured to transmit the message identifier and the first token to the verification server, so that the verification server obtains the verification result, and sends the verification result to the first client;
  • the verification result is the verification server Obtained by verifying whether the first verification seed corresponds to the first token, the first verification seed is queried by the verification server from the verification server by using the message identifier.
  • An embodiment of the present application further provides an identity verification method, where the method includes:
  • the first client obtains an account of the second client in response to the identity verification instruction of the second client, and queries the first verification seed corresponding to the account according to the account;
  • the second client generates a first token according to the second verification seed and provides the first token to the first client;
  • the first client obtains the first token generated by the second client, and transmits the first verification seed and the first token to an authentication server;
  • the verification server obtains an inspection by verifying whether the first verification seed corresponds to the token Verify the result and send the verification result to the first client;
  • the first client obtains the verification result, and determines, according to the verification result, whether the second client passes the verification.
  • the embodiment of the present application further provides an identity verification method, which is applied to a first client, where the method includes:
  • the verification result is that the verification server passes Verifying whether the first verification seed is obtained corresponding to the first token.
  • the embodiment of the present application further provides an identity verification method, which is applied to a second client, where the method includes:
  • Generating a first token according to the second verification seed and providing the first token to the first client where the first client obtains the second client in response to the identity verification instruction of the second client Querying a first verification seed corresponding to the account according to the account; transmitting the first verification seed and the first token to an authentication server to obtain a verification result, wherein the verification server passes the verification first Verifying whether the seed corresponds to the first token to obtain a verification result, and sending the verification result to the first client; and the first client determines, according to the verification result, whether the second client passes the verification.
  • the embodiment of the present application further provides an identity verification apparatus, which is applied to a first client, where the apparatus includes:
  • the memory having a machine readable instruction module executable by the processor; the machine readable instruction module comprising:
  • An account obtaining module configured to obtain an account of the second client in response to the identity verification instruction of the second client;
  • a first verification seed query module configured to query, according to the account, a first verification seed corresponding to the account
  • a token obtaining module configured to acquire a first token generated by the second client
  • a combined sending module configured to transmit the first verification seed and the first token to an authentication server
  • a verification result obtaining module configured to obtain a verification result from the verification server, and determine, according to the verification result, whether the second client verifies the verification; the verification result is that the verification server verifies the first verification seed and the Whether the first token corresponds to the acquisition.
  • the embodiment of the present application further provides an identity verification apparatus, which is applied to a second client, where the apparatus includes:
  • a verification seed obtaining module configured to acquire a second verification seed
  • a token generating module configured to generate a first token according to the second verification seed, and provide the first token to the first client, where the first client is responsive to the identity of the second client a verification instruction, obtaining an account of the second client; querying the first verification seed corresponding to the account according to the account; transmitting the first verification seed and the first token to an authentication server to obtain a verification result, where The verification server obtains a verification result by verifying whether the first verification seed corresponds to the first token, and sends the verification result to the first client; the first client determines the Whether the second client passes the verification.
  • the embodiment of the present application further provides a non-transitory computer readable storage medium, where the machine readable instructions are stored, and the machine readable instructions are executable by a processor.
  • the verification result is that the verification server obtains by comparing whether the first verification seed corresponds to the first token, the first token Is generated by the second client in response to the confirmation instruction of the verification message, and sent to the verification server, where the second client stores a second verification seed, and the account number and the second verification seed. Correspondence.
  • the embodiment of the present application further provides a non-transitory computer readable storage medium storing machine readable instructions, the machine readable instructions being executable by a processor to perform the following operations:
  • the verification server receives the verification message sent by the first client and provides the verification message to the second client, where the message identifier is allocated by the verification server a message identifier corresponding to the verification message;
  • the user instructions including a confirmation instruction responsive to the verification message
  • the verification server Transmitting the message identifier and the first token to an authentication server, so that the verification server obtains the verification result, and sends the verification result to the first client; the verification result is that the verification server passes the verification first verification Whether the seed corresponds to the first token
  • the first verification seed is queried by the verification server from the verification server by using the message identifier.
  • the embodiment of the present application further provides a non-transitory computer readable storage medium storing machine readable instructions, the machine readable instructions being executable by a processor to perform the following operations:
  • the verification result is that the verification server passes Verifying whether the first verification seed is obtained corresponding to the first token.
  • the embodiment of the present application further provides a non-transitory computer readable storage medium storing machine readable instructions, the machine readable instructions being executable by a processor to perform the following operations:
  • Generating a first token according to the second verification seed and providing the first token to the first client where the first client obtains the second client in response to the identity verification instruction of the second client Querying a first verification seed corresponding to the account according to the account; transmitting the first verification seed and the first token to an authentication server to obtain a verification result, wherein the verification server passes the verification first Verifying whether the seed corresponds to the first token to obtain a verification result, and sending the verification result to the first client; and the first client determines, according to the verification result, whether the second client passes the verification.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a verification server cluster provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of an identity binding method provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of a method for obtaining a first verification seed according to an embodiment of the present application
  • FIG. 6 is a schematic diagram of naming a seed obtained by a user according to an embodiment of the present application.
  • FIG. 7 is a flowchart of a token generation algorithm provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of a time correction method provided by an embodiment of the present application.
  • FIG. 11 is a flowchart of an identity verification method provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of an interface for inputting a token provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of an interface of a user selection token provided by an embodiment of the present application.
  • FIG. 14 is a flowchart of another identity verification method according to an embodiment of the present application.
  • 15 is a schematic diagram of a page for generating a second verification barcode provided by an embodiment of the present application.
  • 16 is a schematic diagram of an interface for displaying a verification message according to an embodiment of the present application.
  • 17 is a flowchart of another identity verification method provided by an embodiment of the present application.
  • FIG. 18 is a block diagram of an identity verification apparatus according to an embodiment of the present application.
  • 19 is a block diagram of related modules for performing a binding process according to an embodiment of the present application.
  • FIG. 20 is a block diagram of another identity verification apparatus according to an embodiment of the present application.
  • 21 is a block diagram of a token generating module provided by an embodiment of the present application.
  • 22 is a block diagram of a module related to time correction provided by an embodiment of the present application.
  • FIG. 23 is a schematic structural diagram of an identity verification system according to an embodiment of the present application.
  • FIG. 24 is another schematic structural diagram of an identity verification system according to an embodiment of the present application.
  • 25 is another schematic structural diagram of an identity verification system according to an embodiment of the present application.
  • FIG. 26 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 27 is a schematic structural diagram of a server according to an embodiment of the present application.
  • the secret security issue consists of questions selected by the user and corresponding answers.
  • the security issue is not very convenient, and is often used as a secondary authentication method, such as to retrieve passwords and set other secrets.
  • the secret security problem uses a static password, which is easy to cause security risks.
  • the security card can be regarded as a two-dimensional matrix, each matrix contains a series of numbers, and each security card has a unique identifier, which is between the value of the matrix and the identifier of each user. A correspondence.
  • the user queries the security card information according to the server prompt, and manually enters the security information according to the server requirements. Complete the verification process.
  • the secret security card uses a static password, so there is a risk of screen captures and files being stolen, and it is not easy to carry.
  • Secure Mailbox Similar to the secret security issue, the security mailbox is not very convenient, and is often used as a secondary authentication method, such as to retrieve passwords and set other secrets. Mailbox cracking is difficult and can cause security risks.
  • Secret security mobile phone The security of the mobile phone is better. It mainly verifies the identity by verifying the SMS verification code sent to the mobile phone, and is widely used in sensitive operations such as registration, consumption, transfer, and confidentiality. However, the secret mobile phone uses SMS downlink verification, which will result in operating costs paid to the operator, and the confidential mobile phone has the risk of loss and replacement.
  • Digital certificate A digitally signed document containing public key owner information and public key, which is mainly used for website authentication and is not universal to a large user group.
  • Face verification A biometric technology based on human facial feature information for identity verification. Personal identification is performed by verifying the face, but face verification involves sensitive privacy information of the user, and thus its use environment is limited.
  • Fingerprint verification refers to the line created by the unevenness of the skin on the front side of the finger end of a person. The lines are regularly arranged to form different patterns. The identification is performed by comparing the detailed feature points of different fingerprints. It is widely used to open mobile phones, open APP, consumer and other fields. Similar to face verification, fingerprint verification involves sensitive privacy information of users, and therefore its use environment is limited.
  • Iris Verification The iris is an annular portion between the black pupil and the white sclera that includes a number of interlaced spots, filaments, crowns, stripes, crypts, and the like. After the iris is formed in the fetal development stage, it will remain unchanged throughout the life course. Iris verification has high hardware requirements and is generally used in locations that require a high degree of confidentiality. And iris verification involves sensitive privacy information of users, so its use environment is limited.
  • the secret security policy, the secret security card and the security email are static passwords, which are easy to cause security risks.
  • the digital certificate, face verification, fingerprint verification and iris verification use environment are limited, and it is not easy to promote and apply.
  • the mobile phone has the problem of the operation cost and the risk of the loss of the mobile phone. Therefore, the embodiment of the present application provides a low-risk, wide-ranging, low-cost, and non-existent mobile phone loss risk authentication method and corresponding device based on the token method.
  • the token used in the embodiment of the present application is a software token, which can be obtained according to a seed for authenticating a user identity and a preset token generation algorithm.
  • the embodiment of the present application may provide one or more authentication methods for the user, including but not limited to dynamic password verification, scan code verification, and one-click login.
  • FIG. 1 shows a schematic diagram of an implementation environment provided by an embodiment of the present application.
  • the implementation environment includes a first terminal 120, an authentication server 140, and a second terminal 160.
  • the first client 120 runs a first client.
  • the first terminal 120 can be a mobile phone, a tablet computer, a television set, a laptop portable computer, and a desktop computer. It can also be a server, a server cluster composed of several servers, or a cloud computing service center.
  • the verification server 140 can be an authentication server, a server cluster composed of several servers, or a cloud computing service center.
  • a second client is running in the second terminal 160.
  • the second terminal 160 can be a cell phone, a tablet, a laptop portable computer, a desktop computer, and the like.
  • the verification server 140 can establish a communication connection with the first terminal 120 and the second terminal 160 through the communication network, respectively.
  • the network can be either a wireless network or a wired network.
  • the first client may be any client that has a User Interface (UI) interface, needs to authenticate the identity of the user who uses the first client, and can communicate with the authentication server 140.
  • the first client may be a video service class server or client, a cable television server or client, a security service server Or client, instant messaging server or client, mailbox service server or client, game service server or client, payment service server or client, e-commerce service server or client, and so on.
  • the second client may be any client that has a user interface (UI) interface, needs to log in to the first client, and can communicate with the authentication server 140.
  • the second client can be a mobile client, a tablet client, a multimedia client, and the like.
  • the terminal device when a client running in the terminal device is used to implement the function of the first client side in the example of the method of the present application, the terminal device serves as the first terminal; when the client running in the terminal device is used to implement When the function of the second client side in the method example of the present application, the terminal device acts as the second terminal.
  • the verification server 140 when the verification server 140 is a cluster architecture, the verification server 140 may include a communication server 142, a seed management server 144, an authentication server 146, and a verification message management server 148.
  • the communication server 142 is configured to provide communication services with the first client and the second client, and provides communication services between the three servers of the seed management server 144, the authentication server 146, and the authentication message management server 148.
  • the seed management server 144, the authentication server 146, and the verification message management server 148 can also communicate freely through the intranet.
  • the seed management server 144 is configured to issue a seed to the first client and perform management of the seed of the authentication server.
  • the authentication server 146 is configured to verify the identity of the second client that needs to log in to the first client.
  • the verification message management server 148 is configured to manage the verification message sent by the first client.
  • a communication connection can be established between the above various servers through a communication network.
  • the network can be either a wireless network or a wired network.
  • FIG. 3 is a flowchart of an identity binding method provided by an embodiment of the present application. This method can be applied to the implementation environment shown in FIG.
  • the method ie, the identity binding process
  • the method can include the following steps.
  • Step 301 The second client issues a binding instruction to the first client in response to the user operation.
  • FIG. 4 shows the user interface of the second client in the identity binding process.
  • the second client may issue a binding instruction to the first client by acquiring a uniform resource locator of the first client.
  • Step 302 The first client acquires an account of the user in response to the binding instruction.
  • the user account may be applied to the first client in advance by the user, and in step 302, the user inputs a pre-applied account to the first client, where the first client You can get the user's account.
  • the first client before the identity binding process starts, the first client is requested to apply for an account and a corresponding password is set; the first client performs relevant legality verification on the account and the password; After the verification is passed, the first client records the correspondence between the account and the password, and prompts the user to enter the identity binding process by using an interface display or a voice prompt, and directly obtains the user's account in step 302.
  • Step 303 The first client allocates a first verification seed to the account.
  • FIG. 5 shows a flow chart of a method for obtaining a first verification seed.
  • the method includes:
  • Step 3031 Acquire an unused seed set, and the unused seeds are all from an authentication server.
  • the first client obtains a batch of seeds from the verification server in advance, and manages the acquired seeds. Specifically, the seed is sent by the verification server to the first client through a secure channel.
  • the seed forms a binding relationship (correspondence relationship) with other users' accounts after being acquired, the seed is a used seed, and if the seed does not form a binding relationship (correspondence relationship) with any account after being acquired, The seed is an unused seed. All unused seeds constitute an unused seed collection.
  • Step 3032 Select one seed in the unused seed set as the first verification seed allocated to the account.
  • the first client may select one of the unused seeds as the first verification seed according to a preset seed selection algorithm, or randomly select one of the unused seed sets as the first verification seed.
  • Step 304 The first client generates a second verification seed corresponding to the first verification seed, and provides the second verification seed to the second client.
  • the first client generates the same seed as the first verification seed and uses the seed as the second verification seed.
  • the method of providing the second verification seed to the second client includes, but is not limited to, the following method:
  • the first client directly sends the second verification seed to the second client;
  • the first client generates a first verification barcode according to the second verification seed.
  • the first verification barcode is a two-dimensional code or barcode that can be scanned by the second client.
  • the second client obtains the second verification seed by scanning the two-dimensional code (the first verification barcode), and acquires the token in step 305, where the token is a dynamic password.
  • the first client generates a first verification barcode according to the second verification seed and other optional information.
  • the first verification barcode is a two-dimensional code or strip that can be scanned by the second client. Shape code.
  • the optional information may be a user account and/or a verification seed generation time.
  • the first verification barcode may be generated in an encrypted manner according to a preset encryption algorithm, and correspondingly, the second verification is performed by the second client by using a preset decryption algorithm.
  • the barcode is decrypted.
  • Step 305 The second client obtains a second verification seed, generates a token according to the second verification seed, and provides the token to the first client.
  • the seed obtained by the second client is the second verification seed, and generates a token according to a preset token generation algorithm and the second verification seed.
  • Methods of providing the token to the first client include, but are not limited to, the following methods:
  • the second client directly sends the token to the first client
  • the second client generates a binding verification code according to the token.
  • the binding verification code is a two-dimensional code or barcode that can be scanned by the first client.
  • Step 306 The first client sends the first verification seed and the token to the verification server.
  • step 307 the verification server obtains the verification result.
  • the verification server may verify whether the first verification seed has a legal correspondence with the token according to a preset token verification algorithm, that is, verify whether the first verification seed corresponds to the token, thereby obtaining a verification result.
  • the token verification algorithm and the token generation algorithm are related algorithms, and can be obtained by the verification server and the second client through negotiation.
  • Step 308 the verification server sends the verification result to the first client.
  • Step 309 The first client determines whether the verification is passed. If the verification succeeds, the first client stores the first verification seed, and the first verification seed and the second client account. Correspondence.
  • the seed obtained by the second client in step 305 is the verification seed generated by the first client. Specifically, the seed obtained by the second client is the same as the first verification seed.
  • the second client stores the obtained seed corresponding to the first verification seed, and the obtained seed is the second verification seed. Further, corresponding to the case of (2) (3) of step 304, in order to facilitate the second client to store the obtained seed, the second client may further verify whether the acquired first verification barcode contains a user account. If yes, the correspondence between the user account and the obtained seed (ie, the correspondence between the first client and the seed) is stored after the identity binding is successful; if not, the user is allowed to The resulting seeds are named and the correspondence between the nomenclature and the obtained seeds is stored. Please refer to FIG. 6, which shows a schematic diagram named by the user for the obtained seed, and the binding number is the obtained seed.
  • the first client may also notify the user that the identity binding process is successfully executed by using an interface display or a voice output.
  • the embodiment of the present application provides a method for performing identity binding before identity verification, where the method enables the first client to obtain a binding relationship between a legitimate user and a seed, which is a prerequisite for subsequent token authentication.
  • the identity binding method has no limitation on the first client, and therefore can be adapted to provide an identity binding service for multiple first clients.
  • the token generation algorithm can include:
  • step S1 a seed for generating a token is obtained.
  • step S2 the local current system time is obtained.
  • step S3 the token is obtained according to a preset hash algorithm.
  • the current system time may be obtained according to the current system time.
  • Time parameters For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;
  • the seed and the time parameter are actual parameters of the hash algorithm.
  • the token in the embodiment of the present application is composed of six digits.
  • FIG. 8 illustrates a token verification algorithm.
  • the server side token verification algorithm provided by the embodiment of the present application may include:
  • Step S110 Acquire a seed to be verified and a token to be verified.
  • Step S120 Acquire a local current system time.
  • Step S130 obtaining a target token according to a preset hash algorithm.
  • the time parameter corresponding to the current system time may be obtained according to the current system time. For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;
  • the seed and the time parameter are actual parameters of the hash algorithm.
  • the hash algorithm is the same as the hash algorithm in step S3.
  • Step S140 determining whether the target token is the same as the token to be verified.
  • step S150 if yes, the verification is passed.
  • the target token is the same as the token to be verified, indicating the seed to be verified and generating the to-be-tested
  • the seed of the token is the same seed, that is, the seed to be verified has a legal correspondence with the token to be verified, and therefore, the verification is passed.
  • Step S160 if no, the verification fails.
  • the above token verification algorithm has a small probability that the verification result may be unreliable.
  • the value of the second unit of the current system time of the token obtained by the second client in S3 is 59, and the obtained token is transmitted to the verification server for 2 seconds, then When the verification server verifies the token, the second unit of the current system time of the verification server is 01, and the time parameter obtained when the S130 is executed by the second client is inconsistent, which inevitably causes the verification to fail.
  • This verification failure is only caused by the time problem and is not related to the seed. It can be seen that the verification result is unreliable. This situation can only be re-verified, which affects the user experience and wastes the processing resources of the client and the server. .
  • FIG. 9 illustrates another token verification algorithm.
  • Another server-side token verification algorithm provided by the embodiment of the present application includes:
  • Step S210 Acquire a seed to be verified and a token to be verified.
  • Step S220 Acquire a local current system time.
  • Step S230 obtaining a first target token and a second target token according to a preset hash algorithm.
  • the time parameter corresponding to the current system time may be obtained according to the current system time. For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;
  • the first target token is obtained by using the seed and the time parameter as actual parameters of the hash algorithm, and the last time parameter of the seed and the time parameter is used as the actual of the hash algorithm.
  • the parameter gets the second target token.
  • the hash algorithm is the same as the hash algorithm in step S3.
  • Step S240 determining whether the first target token is the same as the token to be verified.
  • step S250 if yes, the verification is passed.
  • Step S260 if no, determining whether the second target token is the same as the token to be verified.
  • step S270 if yes, the verification is passed.
  • Step S280 if no, the verification fails.
  • This token verification algorithm can largely avoid the situation that the verification result is unreliable, thereby improving the user experience and avoiding waste of processing resources of the client and the server caused by re-authentication.
  • the verification may be performed according to the verification.
  • the current system time of the server performs time verification on the second client to avoid unreliable verification results due to the synchronization between the current system time of the verification server and the current system time of the second client.
  • correction methods there are four types of correction methods:
  • the verification server actively pushes the first time to the second client periodically or irregularly, and the first time is the current system time when the verification server is pushed.
  • the verification server actively pushes the first time to the first client periodically or irregularly, the first time is the current system time when the verification server is pushed; and then the first client immediately takes the initiative to the second client. Push the first time.
  • the verification server sends the first time to the first client, where the first time is the current system when the verification server is transmitting. The time is then; the first time is actively sent by the first client to the second client during the interaction between the first client and the second client.
  • the verification server sends the first time to the second client, where the first time is the current system time when the verification server is transmitting.
  • FIG. 10 illustrates a time correction method of the second client, including:
  • Step T1 acquiring a first time from the verification server; the first time is a current system time of the verification server;
  • Step T2 acquiring a local second time; the second time is a current local system time at the moment of acquiring the first time;
  • Step T3 calculating a difference between the first time and the second time
  • step T4 the difference is stored.
  • step S3 a time correction value is first obtained from the current system time acquired in step S2 and the difference value stored in step T4, and then the time parameter is obtained from the time correction value.
  • the embodiment of the present application provides a time correction method, which can prevent the verification result from being unreliable due to the unsynchronization between the current system time of the verification server and the current system time of the second client, thereby further improving the reliability of the verification result and improving the user experience. To avoid waste of processing resources of the client and server caused by re-authentication.
  • the token generation algorithm and the token verification algorithm used in the embodiments of the present application have other forms.
  • the token relationship can be used to complete the legal relationship between the seed and the token. The verification can be done, and will not be described here.
  • the embodiment Based on the token generation algorithm and the token verification algorithm having the corresponding relationship, the embodiment provides an identity verification method based on the successful execution of the identity binding process.
  • the authentication method can be performed by inputting a token, swiping, or one-click login
  • the method for the authentication is not limited to the first client and the second client. Therefore, the authentication method can be used in various application scenarios, such as verifying the user identity before a sensitive operation such as a payment class, or can be used for The user identity is verified before the password is changed, the user information is lost, and the identity of the user is verified when the first client requests a loss report. Further, the authentication method can also be applied to one or more first clients.
  • FIG. 11 illustrates an authentication method, including:
  • Step 401 The first client acquires an account in response to the identity verification instruction.
  • the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.
  • the first client also shows the user an interface for inputting a token.
  • the first client is used as a security center, and can be used to input a token generated by the second verification seed corresponding to the security center.
  • the first client may also verify the identity of the user according to the stored user data, that is, perform account verification to verify the validity of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present application can be used in combination with other identity verification methods.
  • Step 402 The first client queries, according to the account, a first verification seed corresponding to the account.
  • the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.
  • Step 403 The second client generates a token according to the second verification seed and provides the token to the first client.
  • the second client generates a second verification seed and token generation algorithm according to the local storage. Generate a token. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token.
  • the user inputs the token to the first client, and the input page is FIG. 12 .
  • a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.
  • FIG. 13 shows an interface for a user to select a token.
  • the second client in the binding process can store multiple correspondences, that is, the correspondence between the seed and the first client corresponding to the seed, and the first seed is taken as an example, which corresponds to the webpage mailbox, and is generated.
  • the token is 787246; for example, the second seed corresponds to the security center, and the generated token is 896332. After the user selects the token and presses the OK button, the token can be sent to the first client.
  • Step 404 The first client obtains the token and transmits the first verification seed and the token to an authentication server.
  • step 405 the verification server obtains the verification result.
  • the verification server may verify, according to the token verification algorithm, whether the first verification seed corresponds to the token, thereby obtaining a verification result.
  • the token verification algorithm of the server and the second client token generation algorithm have an algorithm corresponding to the algorithm, and may be obtained by the verification server and the second client through negotiation.
  • Step 406 The verification server sends the verification result to the first client.
  • Step 407 The first client determines whether the verification is passed, and if the verification passes, the identity verification passes.
  • the second verification seed stored by the second client in step 403 is the same as the first verification seed corresponding to the account of the user in the first client.
  • step 408 if the verification fails, the identity verification fails.
  • the identity verification method provided by the embodiment of the present application can be applied to multiple applications, and each application (the first client) does not affect each other, thereby solving the problem in the prior art. Security center, the operation is cumbersome and the user experience is poor.
  • the verification server does not store the correspondence between the account in the first client and the first verification seed, and is only responsible for generating the seed and verifying the correspondence between the seed and the token, thereby not involving each application (the first client) Sensitive data fully guarantees the data security of the first client.
  • the authentication server provides an authentication service for the first client without requiring the first client to disclose its data privacy to the authentication server.
  • FIG. 14 illustrates another authentication method, including:
  • Step 501 The first client acquires an account in response to the identity verification instruction.
  • the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.
  • the first client may also verify the identity of the user according to the stored user data, that is, perform account verification to verify the validity of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present application can be used in combination with other identity verification methods.
  • Step 502 The first client queries, according to the account, a first verification seed corresponding to the account.
  • the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.
  • Step 503 The first client generates a verification message according to the account.
  • the verification message may include a verification message generation time and the account number.
  • the content of the verification message may be “XXX time, XXX account performs XXX operation, Please confirm if you are operating.”
  • Step 504 The first client sends the first verification seed and the verification message to the verification server.
  • Step 505 The verification server acquires the first verification seed and the verification message, and generates a corresponding message identifier.
  • the server also needs to maintain the verification message, such as adding, inserting, and deleting the verification message.
  • the verification server stores the first verification seed and the verification message, and generates a message identifier according to a preset message identifier generation algorithm, where the message identifier corresponds to the verification message, and the message identifier There is also a one-to-one correspondence with the first verification seed.
  • the message identifier generation algorithm may be generated in the order of receiving the verification message, or may be generated according to the time when the verification message is received, or may be based on the time and verification of receiving the verification message.
  • the sender identifier of the message (the identifier of the first client, which carries the identifier during communication with the authentication server) is generated.
  • Step 506 The verification server sends the message identifier to the first client.
  • Step 507 The first client acquires the message identifier and provides the message identifier to the second client.
  • FIG. 15 shows a generation page of the second verification barcode.
  • the first client generates a second verification barcode according to the message identifier, and the second client obtains a message identifier by scanning and parsing the second verification barcode, and the second verification barcode may be a two-dimensional code or a barcode.
  • the message identifier may also be directly sent by the first client to the second client.
  • Step 508 The second client acquires a verification message corresponding to the message identifier from the verification server according to the message identifier.
  • the verification message is displayed by the second client, please refer to FIG. 16, which shows an interface of the second client displaying the verification message. If the user is the person and wants to continue the authentication, click "I am operating", that is, send a confirmation command to the second client; otherwise, click "reject", then the second client directly informs the verification server that the authentication process ends. Correspondingly, the authentication server notifies the first client that the authentication failed, and the authentication process ends.
  • Step 509 The second client generates a token according to the second verification seed in response to the confirmation instruction, and transmits the token and the message identifier to the verification server.
  • the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token. In another embodiment, a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.
  • step 510 the verification server obtains the verification result.
  • the verification server queries the first verification seed according to the message identifier obtained from the second client, and verifies whether the first verification seed has a legal correspondence relationship with the token according to the token verification algorithm, thereby obtaining a verification result.
  • the token verification algorithm of the server and the token generation algorithm of the second client are algorithms corresponding to each other, and may be obtained by the verification server and the second client through negotiation.
  • Step 511 The verification server sends the verification result to the first client.
  • step 512 the first client determines whether the verification is passed, and if the verification passes, the identity verification passes.
  • the second verification seed stored by the second client in step 509 is the same as the first verification seed corresponding to the account of the user in the first client.
  • step 513 if the verification fails, the identity verification fails.
  • This embodiment provides another authentication method different from the method of inputting a token, which enriches the authentication method and avoids the user inputting the token manually, which makes the identity verification more convenient, thereby improving the user experience.
  • FIG. 17, illustrates another authentication method, including:
  • Step 601 The first client acquires an account in response to the identity verification instruction.
  • the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.
  • the first client may also verify the identity of the user according to the stored user data, that is, perform account verification to verify the validity of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present application can be used in combination with other identity verification methods.
  • Step 602 The first client queries, according to the account, a first verification seed corresponding to the account.
  • the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.
  • Step 603 The first client generates a verification message according to the account.
  • the verification message may include a verification message generation time and the account number.
  • the content of the verification message may be “XXX time, XXX account performs XXX operation, please confirm whether it is operated by itself”.
  • Step 604 The first client sends the first verification seed and the verification message to the verification server, and requests a server push operation from the verification server.
  • Step 605 The verification server acquires the first verification seed and the verification message, and generates a corresponding message identifier.
  • the server also needs to maintain the verification message, such as adding, inserting, and deleting the verification message.
  • the verification server stores the first verification seed and the verification message, and generates a message identifier according to a preset message identifier generation algorithm, where the message identifier corresponds to the verification message, and the message identifier There is also a one-to-one correspondence with the first verification seed.
  • the message identifier generation algorithm may be generated in the order of receiving the verification message, or may be generated according to the time when the verification message is received, or may be based on the time and verification of receiving the verification message.
  • the sender identifier of the message (the identifier of the first client, which carries the identifier during communication with the authentication server) is generated.
  • Step 606 The verification server pushes the message identifier and the verification message to the second client in response to the request of the server push operation.
  • HTTP hypertext transfer protocol
  • Step 607 The second client acquires the message identifier and the verification message.
  • the verification message is displayed by the second client, please refer to FIG. 16, which shows an interface of the second client displaying the verification message. If the user is the person and wants to continue the authentication, click "I am operating", that is, send a confirmation command to the second client; otherwise, click "reject", then the second client directly informs the verification server that the authentication process ends. Correspondingly, the authentication server notifies the first client that the authentication failed, and the authentication process ends.
  • Step 608 The second client generates a token according to the second verification seed in response to the confirmation instruction, and transmits the token and the message identifier to the verification server.
  • the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is the second verification. a seed; a token is obtained according to the second verification seed; if the second client stores a plurality of seeds, the user selects one as the second verification seed, and generates a token. In another embodiment, a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.
  • step 609 the verification server obtains the verification result.
  • the verification server queries the first verification seed according to the message identifier obtained from the second client, and verifies whether the first verification seed has a legal correspondence relationship with the token according to the token verification algorithm, thereby obtaining a verification result.
  • the algorithm that the server token verification algorithm and the second client token generation algorithm have a corresponding relationship may be obtained by the verification server and the second client through negotiation.
  • Step 610 The verification server sends the verification result to the first client.
  • step 611 the first client determines whether the verification is passed, and if the verification passes, the identity verification passes.
  • the second verification seed stored by the second client in step 608 is the same as the first verification seed corresponding to the account of the user in the first client.
  • step 612 if the verification fails, the identity verification fails.
  • the identity verification method provided in this embodiment is a one-key login verification method, that is, the user only needs to send a confirmation instruction to the second client, and does not need to perform other operations.
  • the method in this embodiment is more convenient and the user experience is better.
  • the identity verification method if the user performs the function of the second client by using the mobile phone, after the mobile phone is lost, the user may apply to the first client to use the new mobile phone for identity binding or verification, as long as the new one is new.
  • the mobile phone can perform the functions of the second client.
  • the identity binding method and the identity verification method provided by the embodiments of the present application are all implemented based on software tokens, and do not depend on specific hardware devices, which is more common than the current ones.
  • the method of using the secret mobile phone for authentication has the significant advantage of being free from the loss of the mobile phone and low operating cost; in addition, compared with other common authentication methods, it has significant safety factor, low cost and wide application range. Advantage.
  • FIG. 18 shows a block diagram of an identity verification apparatus, which can implement the functions of the first client in the above method example, and the functions can be implemented by hardware or by corresponding software implementation by hardware.
  • the device can include:
  • the account obtaining module 701 is configured to obtain an account. Steps 302, 401, 501, and 601 can be performed to perform the method embodiments.
  • the first verification seed query module 702 is configured to query, according to the account, a first verification seed corresponding to the account. It can be used to perform steps 402, 502, and 602 of the method embodiments.
  • the verification message generating module 703 is configured to generate an authentication message according to the account. It can be used to perform steps 503 and 603 of the method embodiment.
  • the verification message sending module 704 is configured to send the first verification seed and the verification message to the verification server. It can be used to perform steps 504 and 604 of the method embodiment.
  • the verification result obtaining module 705 is configured to obtain the verification result. It can be used to perform steps 308, 406, 511, and 610 of the method embodiments.
  • FIG. 19 shows a block diagram of related modules included in the apparatus for performing a binding process:
  • the first verification seed obtaining module 706 is configured to obtain a first verification seed. It can be used to perform step 303 of the method embodiment.
  • the seed generation module 707 is configured to generate a seed corresponding to the first verification seed. It can be used to perform step 304 of the method embodiment.
  • the token obtaining module 708 is configured to acquire a token generated by the second client. Can be used for Steps 305 and 403 of the method embodiment are performed.
  • the combination sending module 709 is configured to send the first verification seed and the token to the verification server. It can be used to perform steps 306 and 404 of the method embodiment.
  • the first verification seed storage module 710 is configured to: after the verification result obtaining module 705 obtains the verification result, if the verification is passed, storing the first verification seed, and the corresponding relationship between the first verification seed and the second client. It can be used to perform step 309 of the method embodiment.
  • the token acquisition module 708 and the combined transmission module 709 can also be used in the identity verification process.
  • the device may further include:
  • the seed sending module 711 is configured to send the seed to the second client. It can be used to perform step 305 of the method embodiment.
  • the device may further include:
  • the first verification barcode generating module 712 is configured to generate a first verification barcode according to the seed. It can be used to perform step 305 of the method embodiment.
  • the device may further include:
  • the message identifier obtaining module 713 is configured to obtain a message identifier corresponding to the verification message sent by the verification server. It can be used to perform step 506 of the method embodiment.
  • the device may further include:
  • the message identifier sending module 714 is configured to send the message identifier. It can be used to perform step 507 of the method embodiment.
  • the device may further include:
  • the second verification barcode generating module 715 is configured to generate a second verification barcode according to the message identifier. It can be used to perform step 507 of the method embodiment.
  • the device may further include:
  • the requesting module 716 is configured to request a server push operation from the verification server. Can be used for Step 604 of the method embodiment.
  • the first verification seed obtaining module 706 includes:
  • a collection obtaining unit 7061 configured to acquire an unused seed set, where the unused seeds are all from an authentication server;
  • the selecting unit 7062 is configured to randomly select one seed in the unused seed set as the first verification seed.
  • FIG. 20 illustrates an identity verification apparatus, which may be used to implement the functions of the second client in the above method example, and the functions may be implemented by hardware, or may be implemented by hardware.
  • the device can include:
  • the message obtaining module 801 is configured to obtain a message identifier and a verification message. It can be used to perform steps 507, 508, and 607 of the method embodiments.
  • the display module 802 is configured to display a verification message.
  • the user instruction monitoring module 803 is configured to detect a user instruction, and the user instruction includes a confirmation instruction.
  • the second verification seed obtaining module 804 is configured to obtain a second verification seed. It can be used to perform steps 403, 509 and 608 of the method embodiment.
  • the token generation module 805 is configured to generate a token. It can be used to perform steps 305, 403, 509 and 608 of the method embodiment.
  • the transmission module 806 is configured to transmit the message identifier and the token to the verification server. It can be used to perform steps 509 and 608 of the method embodiment.
  • the device may further include:
  • the verification seed obtaining module 807 is configured to obtain a verification seed. It can be used to perform step 305 of the method embodiment.
  • the second verification seed storage module 809 is configured to store the second verification seed. can be use on Step 309 of the method embodiment is performed.
  • the device may further include:
  • the combination storage module 810 is configured to store a correspondence between the second verification seed and the first client. It can be used to perform step 309 of the method embodiment.
  • FIG. 21 shows a block diagram of a token generation module, which includes:
  • the time parameter obtaining unit 8051 is configured to obtain a time parameter according to the current system time. It can be used to perform steps S2 and S3 of the method embodiment.
  • the token calculation unit 8052 is configured to calculate a token according to a preset hash algorithm. It can be used to perform step S3 of the method embodiment.
  • FIG. 22 shows a block diagram of a module related to time correction, including:
  • the first time obtaining module 811 is configured to acquire the first time from the verification server. It can be used to perform step T1 of the method embodiment.
  • the second time acquisition module 812 is configured to acquire the local second time. It can be used to perform step T2 of the method embodiment.
  • the difference calculation module 813 is configured to calculate a difference between the first time and the second time. It can be used to perform step T3 of the method embodiment.
  • the difference storage module 814 is configured to store the difference. It can be used to perform step T4 of the method embodiment.
  • the time parameter obtaining unit 8051 includes:
  • the time correction value calculation module 80511 is configured to calculate a time correction value according to the current system time and the difference.
  • the time parameter obtaining module 80512 is configured to obtain a time parameter according to the time correction value.
  • the message obtaining module 801 may further include:
  • the message identifier obtaining unit 8011 is configured to obtain a message identifier from the first client.
  • the verification message obtaining unit 8012 is configured to acquire the verification message from the verification server according to the message identifier.
  • the message identifier obtaining unit 8011 may further include:
  • the second verification barcode obtaining module 80211 is configured to obtain a second verification barcode.
  • the parsing module 80112 is configured to parse the second verification barcode to obtain a message identifier.
  • the message obtaining module 801 may further include:
  • the direct obtaining unit 8013 is configured to directly acquire the message identifier and the verification message pushed by the verification server.
  • An exemplary embodiment of the present application further provides an identity verification system, as shown in FIG. 23, the system includes a first client 901, a second client 902, and an authentication server 903;
  • the first client 901 obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server.
  • 903 Obtain a message identifier from the verification server 903.
  • the second client 902 obtains the message identifier from the first client 901; acquires a verification message corresponding to the message identifier from the verification server 903 according to the message identifier; and in response to the confirmation instruction to the verification message, Generating a token according to the second verification seed, and transmitting the token and the message identifier to the verification server 903;
  • the verification server 903 queries the first verification seed according to the message identifier obtained from the second client 902; obtains a verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result To the first client 901;
  • the first client 901 acquires a verification result from the verification server 903.
  • the first client 901 and the second client 902 may be the identity verification device described above.
  • An exemplary embodiment of the present application further provides an identity verification system. As shown in FIG. 24, the system includes a first client 1001, a second client 1002, and an authentication server 1003.
  • the first client 1001 obtains an account in response to the authentication command, and queries a first verification seed corresponding to the account according to the account; obtains a token generated by the second client 1002; and the first verification seed and the The token is transmitted to the verification server 1003 and the verification result is obtained;
  • the second client 1002 generates a token according to the second verification seed and enables the token to be obtained by the first client 1001;
  • the verification server 1003 obtains a verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first client 1001.
  • the first client 1001 and the second client 1002 may be the identity verification device described above.
  • An exemplary embodiment of the present application further provides an identity verification system, as shown in FIG. 25, the system includes a first client 1101, a second client 1102, and an authentication server 1103;
  • the first client 1101 acquires an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server. 1103, and requesting a server push operation from the verification server 1103;
  • the verification server 1103 generates a message identifier corresponding to the first verification seed and the verification message, and pushes the message identifier and the verification message to the second client 1102;
  • the second client 1102 generates a token according to the second verification seed in response to the confirmation instruction of the verification message, and transmits the token and the message identifier to the verification server 1103;
  • the verification server 1103 identifies the query based on the message obtained from the second client 1102. a first verification seed; obtaining a verification result by verifying whether the first verification seed has a legal correspondence with the token, and transmitting the verification result to the first client 1101;
  • the first client 1101 acquires a verification result from the verification server 1103.
  • the first client 1101 and the second client 1102 may be the identity verification device described above.
  • FIG. 26 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
  • the terminal is configured to implement the functions of the first client or the second client in the identity verification method provided in the foregoing embodiment.
  • the terminal may include an RF (Radio Frequency) circuit 2610, a memory 2620 including one or more computer readable storage media, an input unit 2630, a display unit 2640, a sensor 2650, an audio circuit 2660, and a WiFi (wireless fidelity,
  • the Wireless Fidelity module 2670 includes a processor 2680 having one or more processing cores, and a power supply 2690 and the like. It will be understood by those skilled in the art that the terminal structure shown in FIG. 26 does not constitute a limitation to the terminal, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements. among them:
  • the RF circuit 2610 can be used for receiving and transmitting signals during and after receiving or transmitting information, in particular, receiving downlink information of the base station and then processing it by one or more processors 2680; in addition, transmitting data related to the uplink to the base station.
  • RF circuitry 2610 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a user Module (SIM) card, transceiver, coupler, LNA (Low Noise Amplifier), duplexer, etc.
  • SIM user Module
  • RF circuitry 2610 can also communicate with the network and other devices via wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.
  • GSM Global System of Mobile communication
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • e-mail Short Messaging Service
  • the memory 2620 can be used to store software programs and modules, and the processor 2680 executes various functional applications and data processing by running software programs and modules stored in the memory 2620.
  • the memory 2620 may mainly include a storage program area and an storage data area, wherein the storage program area may store an operating system, an application required for the function, and the like; the storage data area may store data or the like created according to the use of the terminal.
  • memory 2620 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, memory 2620 can also include a memory controller to provide access to memory 2620 by processor 2680 and input unit 2630.
  • Input unit 2630 can be used to receive input numeric or character information, as well as to generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls.
  • input unit 2630 can include touch-sensitive surface 2631 and other input devices 2632.
  • Touch-sensitive surface 2631 also known as a touch display or touchpad, can collect touch operations on or near the user (such as a user using a finger, stylus, etc., on any suitable object or accessory on touch-sensitive surface 2631 or The operation near the touch-sensitive surface 2631) and driving the corresponding connecting device according to a preset program.
  • the touch-sensitive surface 2631 can include two portions of a touch detection device and a touch controller.
  • the touch detection device detects the user The touch orientation, and detecting the signal brought by the touch operation, transmitting the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and sends it to the processor 2680, and can The command sent by the processor 2680 is received and executed.
  • the touch sensitive surface 2631 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 2630 can also include other input devices 2632.
  • other input devices 2632 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • Display unit 2640 can be used to display information entered by the user or information provided to the user as well as various graphical user interfaces of the terminal, which can be composed of graphics, text, icons, video, and any combination thereof.
  • the display unit 2640 may include a display panel 2641.
  • the display panel 2641 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like.
  • the touch-sensitive surface 2631 can cover the display panel 2641, and when the touch-sensitive surface 2631 detects a touch operation thereon or nearby, it is transmitted to the processor 2680 to determine the type of the touch event, and then the processor 2680 according to the touch event The type provides a corresponding visual output on display panel 2641.
  • touch-sensitive surface 2631 and display panel 2641 are implemented as two separate components to implement input and input functions, in some embodiments, touch-sensitive surface 2631 can be integrated with display panel 2641 for input. And output function.
  • the terminal may also include at least one type of sensor 2650, such as a light sensor, motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 2641 according to the brightness of the ambient light, and the proximity sensor may close the display panel 2641 when the terminal moves to the ear. And / or backlight.
  • the gravity acceleration sensor can detect various directions.
  • the magnitude of the acceleration (usually three axes), the magnitude and direction of gravity can be detected at rest, and can be used to identify the attitude of the terminal (such as horizontal and vertical screen switching, related games, magnetometer attitude calibration), vibration recognition related functions (such as Pedometer, tapping, etc.; other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which are also configurable in the terminal, are not described herein.
  • An audio circuit 2660, a speaker 2661, and a microphone 2662 can provide an audio interface between the user and the terminal.
  • the audio circuit 2660 can transmit the converted electrical data of the received audio data to the speaker 2661, and convert it into a sound signal output by the speaker 2661; on the other hand, the microphone 2662 converts the collected sound signal into an electrical signal, and the audio circuit 2660 After receiving, it is converted to audio data, and then processed by the audio data output processor 2680, transmitted to the terminal, for example, via the RF circuit 2610, or the audio data is output to the memory 2620 for further processing.
  • the audio circuit 2660 may also include an earbud jack to provide communication of the peripheral earphones with the terminal.
  • WiFi is a short-range wireless transmission technology
  • the terminal can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 2670, which provides wireless broadband Internet access for users.
  • FIG. 26 shows the WiFi module 2670, it can be understood that it does not belong to the necessary configuration of the terminal, and may be omitted as needed within the scope of not changing the essence of the application.
  • the processor 2680 is the control center of the terminal, connecting various portions of the entire terminal using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 2620, and recalling data stored in the memory 2620. Performing various functions and processing data of the terminal to perform overall monitoring on the terminal.
  • the processor 2680 can include one or more processing cores; in some embodiments, the processor 2680 can integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, the user Interfaces, applications, etc., the modem processor primarily handles wireless communications. Can It is understood that the above described modem processor may also not be integrated into the processor 2680.
  • the terminal also includes a power source 2690 (such as a battery) that powers the various components.
  • the power source can be logically coupled to the processor 2680 through a power management system to manage charging, discharging, and power consumption through the power management system. Management and other functions.
  • the power supply 2690 can also include any one or more of a DC or AC power source, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.
  • the terminal may further include a camera, a Bluetooth module, and the like, and details are not described herein again.
  • the display unit of the terminal is a touch screen display
  • the terminal further includes a memory, and one or more programs, wherein one or more programs are stored in the memory and configured to be processed by one or more
  • the program executes one or more programs that include instructions for executing the authentication method of the first client or the second client described above.
  • FIG. 27 is a schematic structural diagram of a server provided by an embodiment of the present application.
  • the server is used to implement the authentication method of the server provided in the above embodiment. Specifically:
  • the server 2700 includes a central processing unit (CPU) 2701, a system memory 2704 including a random access memory (RAM) 2702 and a read only memory (ROM) 2703, and a system bus 2705 that connects the system memory 2704 and the central processing unit 2701.
  • the server 2700 also includes a basic input/output system (I/O system) 2706 that facilitates transfer of information between various devices within the computer, and mass storage for storing the operating system 2713, applications 2714, and other program modules 2715.
  • I/O system basic input/output system
  • the basic input/output system 2706 includes a display 2708 for displaying information and an input device 2709 such as a mouse or keyboard for user input of information.
  • the display 2708 and the input device 2709 are both connected to the central processing unit 2701 via an input/output controller 2710 connected to the system bus 2705.
  • the basic input/output system 2706 also Input and output controller 2710 can be included for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus. Similarly, input/output controller 2710 also provides output to a display screen, printer, or other type of output device.
  • the mass storage device 2707 is connected to the central processing unit 2701 by a mass storage controller (not shown) connected to the system bus 2705.
  • the mass storage device 2707 and its associated computer readable medium provide non-volatile storage for the server 2700. That is, the mass storage device 2707 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.
  • the computer readable medium can include computer storage media and communication media.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.
  • Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices.
  • RAM random access memory
  • ROM read only memory
  • EPROM Erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • the server 2700 can also be operated by a remote computer connected to the network through a network such as the Internet. That is, the server 2700 can be connected to the network 2712 through a network interface unit 2711 connected to the system bus 2705, or can also be connected to other types of networks or remote computer systems (not shown) using the network interface unit 2711. .
  • the memory also includes one or more programs, the one or more programs being stored in a memory and configured to be executed by one or more processors.
  • the one or more programs described above include instructions for executing the method of the server described above.
  • a non-transitory computer readable computer comprising instructions a storage medium, such as a memory including instructions, which may be executed by a processor of the terminal to perform various steps in the above method embodiments, or the instructions are executed by a processor of the server to perform various steps on the background server side in the above method embodiment.
  • the non-transitory computer readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.
  • a plurality as referred to herein means two or more.
  • "and/or” describing the association relationship of the associated objects, indicating that there may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately.
  • the character "/" generally indicates that the contextual object is an "or" relationship.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Abstract

本申请实施例公开了一种身份验证方法和装置。该方法包括：响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；根据所述账号生成验证消息；将所述第一验证种子和所述验证消息发送至验证服务器；获取验证结果并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与第一令牌是否对应获得，所述第一令牌是由第二客户端响应于所述验证消息的确认指令生成并发送给所述验证服务器的。

Description

身份验证方法、装置及存储介质
本申请要求于2016年12月15日提交中国专利局、申请号为201611162210.6，发明名称为“身份验证方法与装置”的中国专利申请、于2016年12月15日提交中国专利局、申请号为201611161452.3，发明名称为“身份验证方法与装置”的中国专利申请、以及于2016年12月15日提交中国专利局、申请号为201611162274.6，发明名称为“身份验证方法、装置与系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及身份验证领域，尤其涉及身份验证方法、装置与存储介质。
发明背景
随着互联网的高速发展，移动社交、网上购物、游戏等互联网业务已经深入到生活各个方面，个人账户在互联网的价值越来越高。同时个人密码泄漏、网络钓鱼、盗号木马、社会工程学等情况导致网络账号被盗的风险也越来越高。传统的用户设置登录密码的方式很容易通过暴力尝试、键盘截取、截屏等方式破解，为此仅仅通过验证密码不足以证明用户的合法性。
为了保护账号安全，用户需要在多种账号体系设置密码保护措施，比如为淘宝账号绑定淘宝安全中心，QQ账号绑定QQ安全中心等，若用户同时使用多个应用，则需要绑定多个安全中心。
发明内容
本申请实施例公开了一种身份验证方法、装置和存储介质。
本申请实施例提供了一种身份验证方法，应用于第一客户端，所述方法包括：
响应于第二客户端的身份验证指令，获取第二客户端的账号；
根据所述账号查询与所述账号对应的第一验证种子，其中所述第一客户端中存储有所述第一验证种子，以及所述账号与所述第一验证种子的对应关系；
根据所述账号生成验证消息；
将所述第一验证种子和所述验证消息发送至验证服务器；
获取验证结果并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与第一令牌是否对应获得，所述第一令牌是由第二客户端响应于所述验证消息的确认指令生成并发送给所述验证服务器的，所述第二客户端中存储有第二验证种子，以及所述账号与所述第二验证种子的对应关系。
本申请实施例还提供了一种身份验证装置，应用于第一客户端，包括：
处理器；
与所述处理器相连接的存储器；所述存储器中存储有可由所述处理器执行的机器可读指令模块；所述机器可读指令模块包括：
账号获取模块，用于响应于第二客户端的身份验证指令，获取第二客户端的账号；
第一验证种子查询模块，用于根据所述账号查询与所述账号对应的第一验证种子，其中所述第一客户端中存储有所述第一验证种子，以及所述账号与所述第一验证种子的对应关系；
验证消息生成模块，用于根据所述账号生成验证消息；
验证消息发送模块，用于向验证服务器发送所述第一验证种子和验证消息；
验证结果获取模块，用于获取验证结果并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与第一令牌是否对应获得，所述第一令牌是由第二客户端响应于所述验证消息的确认指令生成并发送给所述验证服务器的，所述第二客户端中存储有第二验证种子，以及所述账号与所述第二验证种子的对应关系。
本申请实施例还提供了一种身份验证方法，应用于第二客户端，所述方法包括：
获取消息标识以及验证消息；其中，所述验证服务器接收第一客户端发送的所述验证消息并将所述验证消息提供给所述第二客户端，所述消息标识为所述验证服务器分配的与所述验证消息对应的消息标识；
显示所述验证消息并监测用户指令，所述用户指令包括响应于所述验证消息的确认指令；
响应于确认指令，获取第二验证种子并根据所述第二验证种子生成第一令牌；
将所述消息标识和所述第一令牌传输至验证服务器，以使得验证服务器得到验证结果，并将验证结果发送给第一客户端；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应而获得的，所述第一验证种子为所述验证服务器通过所述消息标识从所述验证服务器中查询到的。
本申请实施例还提供了一种身份验证装置，应用于第二客户端，所述装置包括：
处理器；
与所述处理器相连接的存储器；所述存储器中存储有可由所述处理器执行的机器可读指令模块；所述机器可读指令模块包括：
消息获取模块，用于获取消息标识和验证消息；其中，所述验证服务器接收第一客户端发送的所述验证消息并将所述验证消息提供给所述第二客户端，所述消息标识为所述验证服务器分配的与所述验证消息对应的消息标识；
显示模块，用于显示所述验证消息；
用户指令监测模块，用于检测用户指令，所述用户指令包括响应于所述验证消息的确认指令；
第二验证种子获取模块，用于获取第二验证种子；
令牌生成模块，用于根据所述第二验证种子生成第一令牌；
传输模块，用于将所述消息标识和所述第一令牌传输至验证服务器，以使得验证服务器得到验证结果，并将验证结果发送给第一客户端；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应而获得的，所述第一验证种子为所述验证服务器通过所述消息标识从所述验证服务器中查询到的。
本申请实施例还提供了一种身份验证方法，所述方法包括：
第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；
所述第二客户端根据第二验证种子生成第一令牌并将所述第一令牌提供给所述第一客户端；
所述第一客户端得到第二客户端生成的所述第一令牌，将所述第一验证种子与所述第一令牌传输至验证服务器；
所述验证服务器通过验证第一验证种子与所述令牌是否对应获得验 证结果，并将所述验证结果发送至第一客户端；
所述第一客户端获取所述验证结果，并根据所述验证结果确定所述第二客户端是否验证通过。
本申请实施例还提供了一种身份验证方法，应用于第一客户端，所述方法包括：
响应于第二客户端的身份验证指令，获取第二客户端的账号；
根据所述账号查询与所述账号对应的第一验证种子；
获取第二客户端生成的第一令牌；
将所述第一验证种子与所述第一令牌传输至验证服务器并获取验证结果，并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得。
本申请实施例还提供了一种身份验证方法，应用于第二客户端，所述方法包括：
得到第二验证种子；
根据所述第二验证种子生成第一令牌并将所述第一令牌提供给第一客户端得到，其中所述第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；将所述第一验证种子与所述第一令牌传输至验证服务器以获取验证结果，其中所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；所述第一客户端根据所述验证结果确定所述第二客户端是否通过验证。
本申请实施例还提供了一种身份验证装置，应用于第一客户端，所述装置包括：
处理器；
与所述处理器相连接的存储器；所述存储器中存储有可由所述处理器执行的机器可读指令模块；所述机器可读指令模块包括：
账号获取模块，用于响应于第二客户端的身份验证指令，获取第二客户端的账号；
第一验证种子查询模块，用于根据所述账号查询与所述账号对应的第一验证种子；
令牌获取模块，用于获取第二客户端生成的第一令牌；
组合发送模块，用于将所述第一验证种子与所述第一令牌传输至验证服务器；
验证结果获取模块，用于获取来自验证服务器的验证结果，并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得。
本申请实施例还提供了一种身份验证装置，应用于第二客户端，所述装置包括：
验证种子获取模块，用于获取第二验证种子；
令牌生成模块，用于根据所述第二验证种子生成第一令牌并将所述第一令牌提供给所述第一客户端，其中所述第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；将所述第一验证种子与所述第一令牌传输至验证服务器以获取验证结果，其中所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；所述第一客户端根据所述验证结果确定所述第二客户端是否通过验证。
本申请实施例还提供了一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以 完成以下操作：
响应于第二客户端的身份验证指令，获取第二客户端的账号；
根据所述账号查询与所述账号对应的第一验证种子，其中所述第一客户端中存储有所述第一验证种子，以及所述账号与所述第一验证种子的对应关系；
根据所述账号生成验证消息；
将所述第一验证种子和所述验证消息发送至验证服务器；
获取验证结果并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与第一令牌是否对应获得，所述第一令牌是由第二客户端响应于所述验证消息的确认指令生成并发送给所述验证服务器的，所述第二客户端中存储有第二验证种子，以及所述账号与所述第二验证种子的对应关系。
本申请实施例还提供了一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成以下操作：
获取消息标识以及验证消息；其中，所述验证服务器接收第一客户端发送的所述验证消息并将所述验证消息提供给所述第二客户端，所述消息标识为所述验证服务器分配的与所述验证消息对应的消息标识；
显示所述验证消息并监测用户指令，所述用户指令包括响应于所述验证消息的确认指令；
响应于确认指令，获取第二验证种子并根据所述第二验证种子生成第一令牌；
将所述消息标识和所述第一令牌传输至验证服务器，以使得验证服务器得到验证结果，并将验证结果发送给第一客户端；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应而获 得的，所述第一验证种子为所述验证服务器通过所述消息标识从所述验证服务器中查询到的。
本申请实施例还提供了一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成以下操作：
响应于第二客户端的身份验证指令，获取第二客户端的账号；
根据所述账号查询与所述账号对应的第一验证种子；
获取第二客户端生成的第一令牌；
将所述第一验证种子与所述第一令牌传输至验证服务器并获取验证结果，并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得。
本申请实施例还提供了一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成以下操作：
得到第二验证种子；
根据所述第二验证种子生成第一令牌并将所述第一令牌提供给第一客户端得到，其中所述第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；将所述第一验证种子与所述第一令牌传输至验证服务器以获取验证结果，其中所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；所述第一客户端根据所述验证结果确定所述第二客户端是否通过验证。
附图简要说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它附图。
图1是本申请实施例提供的实施环境的示意图；
图2是本申请实施例提供的验证服务器集群示意图；
图3是本申请实施例提供的身份绑定方法的流程图；
图4是本申请实施例提供的身份绑定流程的用户界面；
图5是本申请实施例提供的第一验证种子的得到方法流程图；
图6是本申请实施例提供的用户为得到的种子命名的示意图；
图7是本申请实施例提供的令牌生成算法流程图；
图8是本申请实施例提供的令牌验证算法流程图；
图9是本申请实施例提供的另一种令牌验证算法流程图；
图10是本申请实施例提供的时间校正方法流程图；
图11是本申请实施例提供的身份验证方法流程图；
图12是本申请实施例提供的用于输入令牌的界面示意图；
图13是本申请实施例提供的用户选择令牌的界面示意图；
图14是本申请实施例提供的另一种身份验证方法流程图；
图15是本申请实施例提供的第二验证条码的生成页面示意图；
图16是本申请实施例提供的显示验证消息的界面示意图；
图17是本申请实施例提供的另一种身份验证方法流程图；
图18是本申请实施例提供的身份验证装置的框图；
图19是本申请实施例提供的用于进行绑定流程的相关模块的框图；
图20是本申请实施例提供的另一种身份验证装置的框图；
图21是本申请实施例提供的令牌生成模块的框图；
图22是本申请实施例提供的与时间校正相关的模块框图；
图23是本申请实施例提供的身份验证系统的结构示意图；
图24是本申请实施例提供的身份验证系统的另一结构示意图；
图25是本申请实施例提供的身份验证系统的又一结构示意图；
图26是本申请实施例提供的终端的结构示意图；
图27是本申请实施例提供的服务器的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动的前提下所获得的所有其他实施例，都属于本申请保护的范围。
身份验证方式主要有以下几种，密保问题、密保卡、安全邮箱、密保手机、数字证书、人脸验证、指纹验证以及虹膜验证，下述为对这些身份验证方式的简要分析：
密保问题：密保问题是由用户选定的问题及对应答案组成。密保问题的便捷性不强，通常作为辅助的身份验证方法，比如用于找回密码和设置其它密保。密保问题采用静态密码，易引起安全风险。
密保卡：密保卡可以视作一个二维矩阵，每个矩阵中包含一系列数字，同时每张密保卡都有一个唯一标识，该标识与矩阵的数值、每个用户的标识之间都有一个对应关系。在用于验证用户身份时，由用户按照服务器提示查询密保卡信息，并按照服务器要求，手动输入密保信息以 完成验证过程。密保卡采用静态密码，因此有截屏和文件被盗取的风险，且不易携带。
安全邮箱：与密保问题类似，安全邮箱的便捷性不强，通常作为辅助的身份验证方法，比如用于找回密码和设置其它密保。邮箱破解难度低，易引起安全风险。
密保手机：密保手机安全性较好，其主要通过验证发送到手机上的短信验证码验证身份，被广泛运用到注册，消费，转账，改密等敏感操作。但是，密保手机采用短信下行验证的方式，会产生向运营商支付的运营成本，并且密保手机有丢失和更换风险。
数字证书：是一个经证书授权中心数字签名的包含公开密钥拥有者信息以及公开密钥的文件，其主要应用于网站的身份验证，对广大的用户群体不具有普适性。
人脸验证：基于人的脸部特征信息进行身份验证的一种生物识别技术。通过验证人脸来进行个人身份的鉴定，但是人脸验证涉及用户的敏感隐私信息，因此，其使用环境受到限制。
指纹验证：指纹是指人的手指末端正面皮肤上凸凹不平产生的纹线。纹线有规律的排列形成不同的纹型。通过比较不同指纹的细节特征点来进行鉴别。被广泛应用到开启手机，开启APP，消费等领域。与人脸验证类似，指纹验证涉及用户的敏感隐私信息，因此，其使用环境受到限制。
虹膜验证：虹膜是位于黑色瞳孔和白色巩膜之间的圆环状部分，其包括很多相互交错的斑点、细丝、冠状、条纹、隐窝等的细节特征。虹膜在胎儿发育阶段形成后，在整个生命历程中将是保持不变的。虹膜验证对硬件要求较高，一般应用于需要高度保密的场所。并且虹膜验证涉及用户的敏感隐私信息，因此，其使用环境受到限制。
综上所述，密保问题、密保卡和安全邮箱均为静态密码，易引起安全风险，数字证书、人脸验证、指纹验证以及虹膜验证使用环境受限，不易进行推广应用，而密保手机又存在运营成本问题以及手机丢失风险，因此，本申请实施例基于令牌方式提供低风险、适用范围广、成本低并且不存在手机丢失风险的身份验证方法以及相应地装置。
本申请实施例使用的令牌为一种软件令牌，所述软件令牌可根据用于鉴定用户身份的种子以及预设的令牌生成算法获得。具体地，本申请实施例可以为用户提供一种或多种身份验证方式，包括但不限于动态密码验证、扫码验证以及一键登录。
请参考图1，其示出了本申请一个实施例提供的实施环境的示意图。该实施环境包括：第一终端120、验证服务器140和第二终端160。
第一终端120中运行有第一客户端。第一终端120可以是手机、平板电脑、电视机、膝上型便携计算机和台式计算机，也可以是一台服务器，或者是由若干台服务器组成的服务器集群，或者是一个云计算服务中心。
验证服务器140可以是一台验证服务器，也可以是由若干台服务器组成的服务器集群，或者是一个云计算服务中心。
第二终端160中运行有第二客户端。第二终端160可以是手机、平板电脑、膝上型便携计算机和台式计算机等等。
验证服务器140可以通过通信网络分别与第一终端120和第二终端160建立通信连接。该网络可以是无线网络，也可以是有线网络。
在本申请实施例中，第一客户端可以是任何具有用户界面(User Interface，UI)接口、需要对使用所述第一客户端的用户的身份进行验证并能够与验证服务器140通信的客户端。例如，第一客户端可以是视频服务类服务器或客户端、有线电视服务器或客户端、安全服务服务器 或客户端、即时通信服务器或客户端、邮箱服务服务器或客户端、游戏服务服务器或客户端、支付服务服务器或客户端、电子商务服务服务器或客户端等等。
在本申请实施例中，第二客户端可以是任何具有用户界面(User Interface，UI)接口、需要登陆第一客户端并能够与验证服务器140通信的客户端。例如，第二客户端可以是手机客户端、平板电脑客户端和多媒体客户端等等。
在实际应用中，当终端设备中运行的客户端用于实现本申请方法示例中第一客户端侧的功能时，该终端设备即作为第一终端；当终端设备中运行的客户端用于实现本申请方法示例中第二客户端侧的功能时，该终端设备即作为第二终端。
在一个示例中，如图2所示，当验证服务器140为集群架构时，所述验证服务器140可以包括：通讯服务器142、种子管理服务器144、身份验证服务器146和验证消息管理服务器148。
通讯服务器142用于提供与第一客户端和与第二客户端的通讯服务，并提供种子管理服务器144、身份验证服务器146和验证消息管理服务器148三种服务器之间的通讯服务。在另外的实施方式中，种子管理服务器144、身份验证服务器146和验证消息管理服务器148三种服务器之间也可以通过内网自由通讯。
种子管理服务器144用于向第一客户端发放种子以及进行验证服务器端的种子的管理。
身份验证服务器146用于对需要登录第一客户端的第二客户端的身份进行验证。
验证消息管理服务器148用于对第一客户端发送的验证消息进行管理。
上述各个服务器之间可通过通信网络建立通信连接。该网络可以是无线网络，也可以是有线网络。
请参考图3，其示出了本申请一个实施例提供的身份绑定方法的流程图。该方法可应用于图1所示实施环境中。该方法(即身份绑定流程)可以包括如下步骤。
步骤301，第二客户端响应于用户操作，向第一客户端发布绑定指令。
具体地，请参考图4，其示出了第二客户端在身份绑定流程中的用户界面，用户点击“马上添加”按钮，第二客户端即向第一客户端发布绑定指令。具体地，第二客户端可以通过获取第一客户端的统一资源定位符向第一客户端发布绑定指令。
步骤302，第一客户端响应于所述绑定指令，获取用户的账号。
具体地，在一种实施方式中，所述用户账号可由用户预先向所述第一客户端申请，在步骤302中，由所述用户向第一客户端录入预先申请的账号，第一客户端即可获取用户的账号。
此外，在另一种实施方式中，在身份绑定流程开始之前，向第一客户端申请账号并设置对应的密码；第一客户端对于所述账号和密码进行相关的合法性校验；若校验通过，所述第一客户端记录所述账号和所述密码的对应关系，并通过界面显示或语音提示的方式提示用户进入身份绑定流程，并在步骤302中直接获取用户的账号。
步骤303，第一客户端为所述帐号分配第一验证种子。
请参考图5，其示出了第一验证种子的得到方法流程图。所述方法包括：
步骤3031，获取未使用种子集合，所述未使用种子均来自验证服务器。
第一客户端预先向验证服务器获取一批种子，并对获取到的种子进行管理。具体地，所述种子由验证服务器通过安全通道下发至第一客户端。
若种子在被获取后与其它用户的账号形成了绑定关系(对应关系)，则所述种子为已使用种子，若种子在被获取后没有与任何账号形成绑定关系(对应关系)，则所述种子为未使用种子。所有未使用种子构成了一个未使用种子集合。
步骤3032，在所述未使用种子集合中选取一颗种子作为分配给所述帐号的第一验证种子。
第一客户端可以根据预设的种子选取算法从所述未使用种子中选取一个作为第一验证种子，也可以随机从所述未使用种子集合中选取一个作为第一验证种子。
步骤304，第一客户端生成与所述第一验证种子相对应的第二验证种子，并将所述第二验证种子提供给第二客户端。
具体地，第一客户端生成与所述第一验证种子相同的种子，并将所述种子作为第二验证种子。
将所述第二验证种子提供给第二客户端的方法包括但不限于下述方法：
(1)第一客户端直接将所述第二验证种子发送至第二客户端；
(2)第一客户端根据所述第二验证种子生成第一验证条码。所述第一验证条码为能够被第二客户端扫描的二维码或条形码。在图4中，第二客户端通过扫描二维码(第一验证条码)即可获取第二验证种子，并在步骤305中获取令牌，所述令牌即为动态密码。
(3)第一客户端根据所述第二验证种子以及其它可选信息生成第一验证条码。所述第一验证条码为能够被第二客户端扫描的二维码或条 形码。
所述可选信息可以为用户账号和/或验证种子生成时间。
进一步地，在(2)(3)中，第一验证条码也可以根据预设的加密算法以加密方式生成，相应地，在第二客户端能够通过预设的解密算法对所述第一验证条码进行解密。
步骤305，第二客户端得到第二验证种子，根据所述第二验证种子生成令牌并将所述令牌提供给第一客户端。
第二客户端得到的种子即为所述第二验证种子，并根据预设的令牌生成算法和所述第二验证种子生成令牌。
将所述令牌提供给第一客户端的方法包括但不限于下述方法：
(1)第二客户端直接将所述令牌发送至第一客户端；
(2)第二客户端根据所述令牌生成绑定验证码。所述绑定验证码为能够被第一客户端扫描的二维码或条形码。
(3)持有第二客户端的用户向第一客户端输入所述令牌的内容。
步骤306，第一客户端将第一验证种子和所述令牌发送至验证服务器。
步骤307，验证服务器获取验证结果。
具体地，验证服务器可以根据预设的令牌验证算法验证第一验证种子与所述令牌是否具有合法的对应关系,即验证第一验证种子与所述令牌是否对应，从而得到验证结果。所述令牌验证算法与所述令牌生成算法为具有对应关系的算法，可以由验证服务器与第二客户端通过协商获得。
步骤308，验证服务器将所述验证结果发送至第一客户端。
步骤309，第一客户端判断验证是否通过，若验证通过，则第一客户端存储第一验证种子，以及所述第一验证种子与所述第二客户端帐号 的对应关系。
具体地，若验证通过，则说明步骤305中第二客户端得到的种子即为第一客户端生成的验证种子，具体的，所述第二客户端得到的种子与第一验证种子相同。
第二客户端存储所得到的种子，为与第一验证种子对应，所述得到的种子即为第二验证种子。进一步地，对应于步骤304的(2)(3)的情况，为便于第二客户端存储所述得到的所述种子，第二客户端还可以验证获取的第一验证条码中是否含有用户账号，若含有，则在身份绑定成功后，存储所述用户账号与所述得到的种子的对应关系(即第一客户端与所述种子的对应关系)；若不含有，则允许用户自行为得到的种子命名，并存储所述命名与所述得到的种子的对应关系。请参考图6，其示出了由用户为得到的种子命名的示意图，所述绑定号即为得到的种子。
具体地，若验证通过，第一客户端还可以使用界面显示或语音输出的方式告知用户身份绑定流程执行成功。
本申请实施例提供了在身份验证之前进行身份绑定的方法，所述方法能够使得第一客户端获取合法用户与种子之间的绑定关系，是后续使用令牌进行身份验证的前提，此外，所述身份绑定方法对于第一客户端没有限制，因此，可以适用于为多个第一客户端提供身份绑定服务。
进一步地，本申请实施例提供的种子可以为任意正整数，相应地，请参考图7，其示出了一种令牌生成算法，本申请实施例提供的一种第二客户端一侧的令牌生成算法可以包括：
步骤S1，获取用于生成令牌的种子。
步骤S2，获取本地的当前系统时间。
步骤S3，根据预设的哈希算法得到令牌。
具体地，可以根据所述当前系统时间得到所述当前系统时间对应的 时间参量。比如，每60s一个时间参量，则所述当前系统时间只需精确到分即可得到所述时间参量，以60s为一个时间参量，则对应于同一个种子的动态密码每隔60s会改变一次；
又比如，每30s一个时间参量，则需要先判断当前系统时间在秒单位上的读数是否大于30，然后根据判断结果划分时间参量，以30s为一个时间参量，则对应于同一个种子的动态密码每隔30s会改变一次。
具体地，所述种子及所述时间参量作为所述哈希算法的实际参数。具体地，本申请实施例中的令牌由六位数字构成。
相应地，请参考图8，其示出了令牌验证算法，本申请实施例提供的一种服务器一侧的令牌验证算法可以包括：
步骤S110，获取待验证种子和待验证令牌。
步骤S120，获取本地的当前系统时间。
步骤S130，根据预设的哈希算法得到目标令牌。
具体地，可以根据所述当前系统时间得到所述当前系统时间对应的时间参量。比如，每60s一个时间参量，则所述当前系统时间只需精确到分即可得到所述时间参量，以60s为一个时间参量，则对应于同一个种子的动态密码每隔60s会改变一次；
又比如，每30s一个时间参量，则需要先判断当前系统时间在秒单位上的读数是否大于30，然后根据判断结果划分时间参量，以30s为一个时间参量，则对应于同一个种子的动态密码每隔30s会改变一次。
具体地，所述种子及所述时间参量作为所述哈希算法的实际参数。所述哈希算法与步骤S3中的哈希算法相同。
步骤S140，判断所述目标令牌与待验证令牌是否相同。
步骤S150，若是，则验证通过。
所述目标令牌与待验证令牌相同，说明待验证种子与生成所述待验 证令牌的种子为相同的种子，即所述待验证种子与所述待验证令牌之间具有合法的对应关系，因此，验证通过。
步骤S160，若否，则验证不通过。
上述令牌生成算法以及令牌验证算法均依赖于执行算法的硬件的当前系统时间，因此，上述令牌验证算法有较小的概率可能导致验证结果出现不可靠的情况。以60s为一个时间参量为例，若第二客户端在S3中得到令牌的当前系统时间的秒单位的数值为59，将所述得到的令牌传输至验证服务器耗时2秒，则当所述验证服务器对所述令牌进行验证时，验证服务器的当前系统时间的秒单位为可能为01，则执行S130时与第二客户端执行S30时得到的时间参量不一致，这必然导致验证失败，这个验证失败仅仅是由于时间问题导致而与种子无关，可见这个验证结果是不可靠的，出现这种情况只能重新进行验证，从而影响了用户体验，并且浪费了客户端及服务器的处理资源。
为了提升验证结果的可靠性，请参考图9，其示出了另一种令牌验证算法，本申请实施例提供的另一种服务器一侧的令牌验证算法包括：
步骤S210，获取待验证种子和待验证令牌。
步骤S220，获取本地的当前系统时间。
步骤S230，根据预设的哈希算法得到第一目标令牌和第二目标令牌。
具体地，可以根据所述当前系统时间得到所述当前系统时间对应的时间参量。比如，每60s一个时间参量，则所述当前系统时间只需精确到分即可得到所述时间参量，以60s为一个时间参量，则对应于同一个种子的动态密码每隔60s会改变一次；
又比如，每30s一个时间参量，则需要先判断当前系统时间在秒单位上的读数是否大于30，然后根据判断结果划分时间参量，以30s为一个时间参量，则对应于同一个种子的动态密码每隔30s会改变一次。
具体地，以所述种子及所述时间参量作为所述哈希算法的实际参数得到第一目标令牌，以所述种子及所述时间参量的上一个时间参量作为所述哈希算法的实际参数得到第二目标令牌。所述哈希算法与步骤S3中的哈希算法相同。
步骤S240，判断所述第一目标令牌与待验证令牌是否相同。
步骤S250，若是，则验证通过。
步骤S260，若否，则判断所述第二目标令牌与待验证令牌是否相同。
步骤S270，若是，则验证通过。
步骤S280，若否，则验证不通过。
这种令牌验证算法能够较大限度地避免出现验证结果不可靠的情况，从而提升用户体验，并避免因重新验证而造成的客户端及服务器的处理资源的浪费。
进一步地，由于第二客户端一侧的令牌生成算法与验证服务器一侧的令牌验证算法依赖于执行算法的硬件的当前系统时间，因此，为进一步提升验证结果的可靠性，可以根据验证服务器的当前系统时间对第二客户端进行时间校验，避免由于验证服务器的当前系统时间与第二客户端的当前系统时间的不同步导致验证结果不可靠。具体地，校正方法可以有以下四种：
(1)验证服务器定时或不定时地向第二客户端主动推送第一时间，所述第一时间为验证服务器在推送时的当前系统时间。
(2)验证服务器定时或不定时地向第一客户端主动推送第一时间，所述第一时间为验证服务器在推送时的当前系统时间；然后由第一客户端立即向第二客户端主动推送所述第一时间。
(3)在第一客户端与验证服务器交互的过程中，验证服务器向第一客户端发送第一时间，所述第一时间为验证服务器在发送时的当前系 统时间；然后在第一客户端与第二客户端的交互过程中，由第一客户端向第二客户端主动发送所述第一时间。
(3)在第二客户端与验证服务器交互的过程中，验证服务器向第二客户端发送第一时间，所述第一时间为验证服务器在发送时的当前系统时间。
具体地，请参考图10，其示出了第二客户端的时间校正方法，包括：
步骤T1，获取来自于验证服务器的第一时间；所述第一时间为验证服务器的当前系统时间；
步骤T2，获取本地的第二时间；所述第二时间为获取第一时间那一刻本地的当前系统时间；
步骤T3，计算所述第一时间与所述第二时间的差值；
步骤T4，存储所述差值。
相应地，在步骤S3中首先根据步骤S2中获取的当前系统时间和步骤T4中存储的所述差值得到时间校正值，然后根据所述时间校正值得到时间参量。
本申请实施例提供了一种时间校正方法，可以避免由于验证服务器的当前系统时间与第二客户端的当前系统时间的不同步导致验证结果不可靠，从而进一步提升验证结果的可靠度，提升用户体验，避免因重新验证而造成的客户端及服务器的处理资源的浪费。
当然本申请实施例中使用的令牌生成算法和令牌验证算法还有其它形式，只要是令牌生成算法和令牌验证算法具有固定的对应关系，能够用于完成种子与令牌的合法关系的验证即可，在此不再赘述。
基于具有对应关系的令牌生成算法与令牌验证算法，在身份绑定流程执行成功的基础上，本实施例提供一种身份验证方法。
具体地，所述身份验证方法可以通过输入令牌、扫一扫或一键登录 等多种方式实现，所述身份验证方法对于第一客户端和第二客户端没有限制，因此，可以在多种应用场景下使用，比如支付类等敏感操作前验证用户身份，也可以用于在修改密码前验证用户身份，用户信息丢失并向第一客户端申请挂失时验证用户身份。进一步地，所述身份验证方法也可以应用于一种或多种第一客户端。
以输入令牌的方式实现身份验证的方法，请参考图11，其示出了一种身份验证方法，包括：
步骤401，第一客户端响应于身份验证指令，获取账号。
具体地，所述账号可以由用户输入，也可以依赖于浏览器cookies的记录由第一客户端自行获取。请参考图12，第一客户端还向用户示出用于输入令牌的界面。图12中以第一客户端为安全中心为例，可用于输入安全中心对应的第二验证种子生成的令牌。
进一步地，为提升身份验证的安全性，在获取账号之前，还可以由第一客户端根据自身存储用户数据对用户身份进行验证，即进行账号验证以检验账号的合法性。比如，第一客户端可以要求用户输入与账号对应的密码，若密码正确，则账号验证通过，才可以进行下述的身份验证步骤。可见，本申请实施例提供的身份验证方式可以与其它身份验证方式结合使用。
步骤402，第一客户端根据所述账号查询与所述账号对应的第一验证种子。
具体地，在身份绑定流程中，第一客户端存储有账号以及第一验证种子的对应关系，因此，根据所述账号即可得到对应的第一验证种子。
步骤403，第二客户端根据第二验证种子生成令牌并将所述令牌提供给第一客户端。
具体地，第二客户端根据本地存储的第二验证种子和令牌生成算法 生成令牌。若第二客户端只存储有一个种子，则所述种子即为第二验证种子；根据所述第二验证种子即可得到令牌；若第二客户端存储有多个种子，则由用户选择一个作为第二验证种子，并生成令牌。
为使得生成的令牌能够被第一客户端得到，本实施例中通过用户向第一客户端输入所述令牌实现，输入页面即为图12。
在另一种实施方式中，也可以针对每一个种子生成一个令牌，由用户自行根据选择的第二验证种子选择相应的令牌。请参考图13，其示出了用户选择令牌的界面。由图13可知，在绑定流程第二客户端可以存储多个对应关系，即种子与所述种子对应的第一客户端的对应关系，以第一个种子为例，其对应于网页邮箱，生成的令牌为787246；以第二个种子为例，其对应于安全中心，生成的令牌为896332。用户选择令牌后按下确定按钮，令牌即可被发送到第一客户端。
步骤404，第一客户端得到所述令牌并将所述第一验证种子与所述令牌传输至验证服务器。
步骤405，验证服务器获取验证结果。
具体地，验证服务器可以根据令牌验证算法验证第一验证种子与所述令牌是否对应，从而得到验证结果。所述服务器的令牌验证算法与所述第二客户端令牌生成算法为具有对应关系的算法，可以由验证服务器与第二客户端通过协商获得。
步骤406，验证服务器将所述验证结果发送至第一客户端。
步骤407，第一客户端判断验证是否通过，若验证通过，则身份验证通过。
具体地，若验证通过，则说明步骤403中第二客户端存储的第二验证种子与第一客户端中与用户的账号对应的第一验证种子相同。
步骤408，若验证不通过，则身份验证不通过。
本申请实施例提供的身份验证方法能够适用于多个应用，各个应用(第一客户端)之间互不影响，从而解决了现有技术情况下若用户同时使用多个应用，需要绑定多个安全中心，操作繁琐，用户体验较差的问题。此外，验证服务器不会存储第一客户端中的账号与第一验证种子的对应关系，只负责生成种子并验证种子和令牌之间的对应关系，从而不涉及到各个应用(第一客户端)的敏感数据，充分保障了第一客户端的数据安全。验证服务器在不需要第一客户端向验证服务器泄露其数据隐私的前提下，为第一客户端提供身份验证服务。
请参考图14，其示出了另一种身份验证方法，包括：
步骤501，第一客户端响应于身份验证指令，获取账号。
具体地，所述账号可以由用户输入，也可以依赖于浏览器cookies的记录由第一客户端自行获取。
进一步地，为提升身份验证的安全性，在获取账号之前，还可以由第一客户端根据自身存储用户数据对用户身份进行验证，即进行账号验证以检验账号的合法性。比如，第一客户端可以要求用户输入与账号对应的密码，若密码正确，则账号验证通过，才可以进行下述的身份验证步骤。可见，本申请实施例提供的身份验证方式可以与其它身份验证方式结合使用。
步骤502，第一客户端根据所述账号查询与所述账号对应的第一验证种子。
具体地，在身份绑定流程中，第一客户端存储有账号以及第一验证种子的对应关系，因此，根据所述账号即可得到对应的第一验证种子。
步骤503，第一客户端根据所述账号生成验证消息。
具体地，所述验证消息可以包括验证消息产生时间和所述账号。比如，所述验证消息的内容可以为“XXX时间，XXX账号进行XXX操作， 请确认是否本人操作”。
步骤504，第一客户端将所述第一验证种子和所述验证消息发送至验证服务器。
步骤505，验证服务器获取所述第一验证种子和所述验证消息，并生成对应的消息标识。
具体地，在本实施例中，服务器还需要维护所述验证消息，比如对验证消息进行添加、插入和删除等操作。
具体地，验证服务器存储所述第一验证种子与所述验证消息，并根据预设的消息标识生成算法生成消息标识，所述消息标识与所述验证消息一一对应，并且，所述消息标识与所述第一验证种子也一一对应。具体地，所述消息标识生成算法可以为按照收到所述验证消息的顺序生成，也可以为按照收到所述验证消息的时间生成，也可以为根据收到所述验证消息的时间以及验证消息的发送方标识(第一客户端的标识，与验证服务器通讯过程中携带所述标识)生成。
步骤506，验证服务器将所述消息标识发送至第一客户端。
步骤507，第一客户端获取所述消息标识并将消息标识提供给第二客户端。
具体地，在扫一扫身份验证方式中，请参考图15，其示出了第二验证条码的生成页面。第一客户端根据所述消息标识生成第二验证条码，第二客户端通过扫描并解析所述第二验证条码获取消息标识，所述第二验证条码可以为二维码或条形码。
此外，在其它实施例中，还可以由第一客户端直接将所述消息标识发送至第二客户端。
步骤508，第二客户端根据所述消息标识从所述验证服务器获取与所述消息标识对应的验证消息。
具体地，由第二客户端对所述验证消息进行显示，请参考图16，其示出了第二客户端显示验证消息的界面。若用户是本人并希望继续进行身份验证，则点击“是我操作”，即向第二客户端发送了确认指令；否则，点击“拒绝”，则第二客户端直接通知验证服务器身份验证流程结束，相应地，验证服务器通知第一客户端身份验证失败，身份验证流程结束。
步骤509，第二客户端响应于确认指令，根据第二验证种子生成令牌，并将所述令牌与所述消息标识传输至所述验证服务器。
具体地，第二客户端根据本地存储的第二验证种子和令牌生成算法生成令牌。若第二客户端只存储有一个种子，则所述种子即为第二验证种子；根据所述第二验证种子即可得到令牌；若第二客户端存储有多个种子，则由用户选择一个作为第二验证种子，并生成令牌。在另一种实施方式中，也可以针对每一个种子生成一个令牌，由用户自行根据选择的第二验证种子选择相应的令牌。
步骤510，验证服务器获取验证结果。
具体地，所述验证服务器根据从第二客户端得到的消息标识查询第一验证种子，并根据令牌验证算法验证第一验证种子与所述令牌是否具有合法的对应关系，从而得到验证结果。所述服务器的令牌验证算法与所述第二客户端的令牌生成算法为具有对应关系的算法，可以由验证服务器与第二客户端通过协商获得。
步骤511，验证服务器将所述验证结果发送至第一客户端。
步骤512，第一客户端判断验证是否通过，若验证通过，则身份验证通过。
具体地，若验证通过，则说明步骤509中第二客户端存储的第二验证种子与第一客户端中与用户的账号对应的第一验证种子相同。
步骤513，若验证不通过，则身份验证不通过。
本实施例有别于输入令牌的方式提供了另一种身份验证方法，丰富了身份验证的方式，避免了用户手动输入令牌，使得身份验证更为便捷，从而提升了用户体验。
请参考图17，其示出了另一种身份验证方法，包括：
步骤601，第一客户端响应于身份验证指令，获取账号。
具体地，所述账号可以由用户输入，也可以依赖于浏览器cookies的记录由第一客户端自行获取。
进一步地，为提升身份验证的安全性，在获取账号之前，还可以由第一客户端根据自身存储用户数据对用户身份进行验证，即进行账号验证以检验账号的合法性。比如，第一客户端可以要求用户输入与账号对应的密码，若密码正确，则账号验证通过，才可以进行下述的身份验证步骤。可见，本申请实施例提供的身份验证方式可以与其它身份验证方式结合使用。
步骤602，第一客户端根据所述账号查询与所述账号对应的第一验证种子。
具体地，在身份绑定流程中，第一客户端存储有账号以及第一验证种子的对应关系，因此，根据所述账号即可得到对应的第一验证种子。
步骤603，第一客户端根据所述账号生成验证消息。
具体地，所述验证消息可以包括验证消息产生时间和所述账号。比如，所述验证消息的内容可以为“XXX时间，XXX账号进行XXX操作，请确认是否本人操作”。
步骤604，第一客户端将所述第一验证种子和所述验证消息发送至验证服务器，并向验证服务器请求服务器推送操作。
步骤605，验证服务器获取所述第一验证种子和所述验证消息，并生成对应的消息标识。
具体地，在本实施例中，服务器还需要维护所述验证消息，比如对验证消息进行添加、插入和删除等操作。
具体地，验证服务器存储所述第一验证种子与所述验证消息，并根据预设的消息标识生成算法生成消息标识，所述消息标识与所述验证消息一一对应，并且，所述消息标识与所述第一验证种子也一一对应。具体地，所述消息标识生成算法可以为按照收到所述验证消息的顺序生成，也可以为按照收到所述验证消息的时间生成，也可以为根据收到所述验证消息的时间以及验证消息的发送方标识(第一客户端的标识，与验证服务器通讯过程中携带所述标识)生成。
步骤606，验证服务器响应于所述服务器推送操作的请求，将所述消息标识和所述验证消息推送至第二客户端。
具体地，验证服务器与第二客户端之间建立超文本传输协议(HyperText Transfer Protocol，HTTP)长连接安全通道，并使用服务器推(server push)技术将所述消息标识和所述验证消息主动推送至第二客户端。
步骤607，第二客户端获取所述消息标识和所述验证消息。
具体地，由第二客户端对所述验证消息进行显示，请参考图16，其示出了第二客户端显示验证消息的界面。若用户是本人并希望继续进行身份验证，则点击“是我操作”，即向第二客户端发送了确认指令；否则，点击“拒绝”，则第二客户端直接通知验证服务器身份验证流程结束，相应地，验证服务器通知第一客户端身份验证失败，身份验证流程结束。
步骤608，第二客户端响应于确认指令，根据第二验证种子生成令牌，并将所述令牌与所述消息标识传输至所述验证服务器。
具体地，第二客户端根据本地存储的第二验证种子和令牌生成算法生成令牌。若第二客户端只存储有一个种子，则所述种子即为第二验证 种子；根据所述第二验证种子即可得到令牌；若第二客户端存储有多个种子，则由用户选择一个作为第二验证种子，并生成令牌。在另一种实施方式中，也可以针对每一个种子均生成一个令牌，由用户自行根据选择的第二验证种子选择相应的令牌。
步骤609，验证服务器获取验证结果。
具体地，所述验证服务器根据从第二客户端得到的消息标识查询第一验证种子，并根据令牌验证算法验证第一验证种子与所述令牌是否具有合法的对应关系，从而得到验证结果。所述服务器令牌验证算法与所述第二客户端令牌生成算法为具有对应关系的算法，可以由验证服务器与第二客户端通过协商获得。
步骤610，验证服务器将所述验证结果发送至第一客户端。
步骤611，第一客户端判断验证是否通过，若验证通过，则身份验证通过。
具体地，若验证通过，则说明步骤608中第二客户端存储的第二验证种子与第一客户端中与用户的账号对应的第一验证种子相同。
步骤612，若验证不通过，则身份验证不通过。
本实施例供了另一种身份验证方法，具体地，本实施例提供的身份验证方法为一键登录的验证方法，即用户只需向第二客户端发送确认指令即可，不必进行其它操作，本实施例中的方法更为便捷，用户体验更好。
在本申请实施例提供的身份验证方法中，若用户使用手机执行第二客户端的功能，当手机丢失后，用户可以向第一客户端申请使用新的手机进行身份绑定或者验证，只要新的手机可以执行第二客户端的功能即可。由此可见，本申请实施例提供的身份绑定方法以及身份验证方法都是基于软件令牌实现的，不依赖于具体地硬件设备，相较于目前较为常 用的密保手机进行身份验证的方式具有不受手机丢失的影响，运营成本低的显著优势；此外，相对于其它常见的身份验证方式，又具有安全系数高、成本低和适用范围广的显著优势。
下述为本申请装置实施例，可以用于执行本申请方法实施例。对于本申请装置实施例中未披露的细节，请参照本申请方法实施例。
请参考图18，其示出了一种身份验证装置的框图，该装置能够实现上述方法示例中第一客户端的功能，所述功能可以由硬件实现，也可以由硬件执行相应的软件实现。该装置可以包括：
账号获取模块701，用于获取账号。可用于执行方法实施例的步骤302、401、501和601。
第一验证种子查询模块702，用于根据所述账号查询与所述账号对应的第一验证种子。可用于执行方法实施例的步骤402、502和602。
验证消息生成模块703，用于根据账号生成验证消息。可用于执行方法实施例的步骤503和603。
验证消息发送模块704，用于向验证服务器发送第一验证种子和验证消息。可用于执行方法实施例的步骤504和604。
验证结果获取模块705，用于获取验证结果。可用于执行方法实施例的步骤308、406、511和610。
进一步地，请参考图19，其示出了所述装置包括的用于进行绑定流程的相关模块的框图：
第一验证种子获取模块706，用于得到第一验证种子。可用于执行方法实施例的步骤303。
种子生成模块707，用于生成与第一验证种子相对应的种子。可用于执行方法实施例的步骤304。
令牌获取模块708，用于获取由第二客户端生成的令牌。可用于执 行方法实施例的步骤305和403。
组合发送模块709，用于将第一验证种子和令牌发送至验证服务器。可用于执行方法实施例的步骤306和404。
第一验证种子存储模块710，用于在验证结果获取模块705获取验证结果后，若验证通过，存储第一验证种子，以及所述第一验证种子与第二客户端的对应关系。可用于执行方法实施例的步骤309。
其中，令牌获取模块708和组合发送模块709也可用于身份验证流程中。
进一步地，所述装置还可以包括：
种子发送模块711，用于将种子发送至第二客户端。可用于执行方法实施例的步骤305。
进一步地，所述装置还可以包括：
第一验证条码生成模块712，用于根据种子生成第一验证条码。可用于执行方法实施例的步骤305。
进一步地，所述装置还可以包括：
消息标识获取模块713，用于获取验证服务器发送的与验证消息对应的消息标识。可用于执行方法实施例的步骤506。
进一步地，所述装置还可以包括：
消息标识发送模块714，用于发送所述消息标识。可用于执行方法实施例的步骤507。
进一步地，所述装置还可以包括：
第二验证条码生成模块715，用于根据消息标识生成第二验证条码。可用于执行方法实施例的步骤507。
进一步地，所述装置还可以包括：
请求模块716，用于向验证服务器请求服务器推送操作。可用于执 行方法实施例的步骤604。
进一步地，所述第一验证种子获取模块706包括：
集合获取单元7061，用于获取未使用种子集合，所述未使用种子均来自验证服务器；
选取单元7062，用于在所述未使用种子集合中随机选取一颗种子作为第一验证种子。
请参考图20，其示出了一种身份验证装置，该装置可以用于实现上述方法示例中第二客户端的功能，所述功能可以由硬件实现，也可以由硬件执行相应的软件实现。该装置可以包括：
消息获取模块801，用于获取消息标识和验证消息。可用于执行方法实施例的步骤507、508和607。
显示模块802，用于显示验证消息。
用户指令监测模块803，用于检测用户指令，所述用户指令包括确认指令。
第二验证种子获取模块804，用于获取第二验证种子。可用于执行方法实施例的步骤403，509和608。
令牌生成模块805，用于生成令牌。可用于执行方法实施例的步骤305，403，509和608。
传输模块806，用于将所述消息标识和所述令牌传输至验证服务器。可用于执行方法实施例的步骤509和608。
进一步地，所述装置还可以包括：
验证种子获取模块807，用于得到验证种子。可用于执行方法实施例的步骤305。
第二验证种子存储模块809，用于存储所述第二验证种子。可用于 执行方法实施例的步骤309。
进一步地，所述装置还可以包括：
组合存储模块810，用于存储第二验证种子与第一客户端的对应关系。可用于执行方法实施例的步骤309。
请参考图21，其示出了令牌生成模块的框图，所述令牌生成模块805包括：
时间参量获取单元8051，用于根据当前系统时间得到时间参量。可用于执行方法实施例的步骤S2和S3。
令牌计算单元8052，用于根据预设的哈希算法计算令牌。可用于执行方法实施例的步骤S3。
进一步地，请参考图22，其示出了与时间校正相关的模块框图，包括：
第一时间获取模块811，用于获取来自于验证服务器的第一时间。可用于执行方法实施例的步骤T1。
第二时间获取模块812，用于获取本地的第二时间。可用于执行方法实施例的步骤T2。
差值计算模块813，用于计算所述第一时间与所述第二时间的差值。可用于执行方法实施例的步骤T3。
差值存储模块814，用于存储所述差值。可用于执行方法实施例的步骤T4。
相应地，如图21所示，所述时间参量获取单元8051包括：
时间校正值计算模块80511，用于根据当前系统时间和所述差值计算时间校正值。
时间参量获取模块80512，用于根据所述时间校正值得到时间参量。
进一步地，如图20所示，所述消息获取模块801还可以包括：
消息标识获取单元8011，用于从第一客户端得到消息标识；
验证消息获取单元8012，用于根据所述消息标识从验证服务器获取所述验证消息。
进一步地，所述消息标识获取单元8011还可以包括：
第二验证条码获取模块80111，用于获取第二验证条码；
解析模块80112，用于解析所述第二验证条码得到消息标识。
进一步地，所述消息获取模块801还可以包括：
直接获取单元8013，用于直接获取由验证服务器推送的消息标识和验证消息。
本申请一示例性实施例还提供了一种身份验证系统，如图23所示，所述系统包括第一客户端901、第二客户端902和验证服务器903；
第一客户端901响应于身份验证指令，获取账号；根据所述账号查询与所述账号对应的第一验证种子；生成验证消息；将所述第一验证种子和所述验证消息发送至验证服务器903；从验证服务器903获取消息标识；
第二客户端902从第一客户端901得到所述消息标识；根据所述消息标识从所述验证服务器903获取与所述消息标识对应的验证消息；响应于对所述验证消息的确认指令，根据第二验证种子生成令牌，并将所述令牌与所述消息标识传输至所述验证服务器903；
所述验证服务器903根据从第二客户端902得到的消息标识查询第一验证种子；通过验证第一验证种子与所述令牌是否具有合法的对应关系获得验证结果，并将所述验证结果发送至第一客户端901；
所述第一客户端901获取来自所述验证服务器903的验证结果。
具体地，所述第一客户端901和第二客户端902可以为上述的身份验证装置。
本申请一示例性实施例还提供了一种身份验证系统，如图24所示，所述系统包括第一客户端1001、第二客户端1002和验证服务器1003；
第一客户端1001响应于身份验证指令，获取账号；根据所述账号查询与所述账号对应的第一验证种子；得到第二客户端1002生成的令牌；将所述第一验证种子与所述令牌传输至验证服务器1003并获取验证结果；
所述第二客户端1002根据第二验证种子生成令牌并使得所述令牌能够被第一客户端1001得到；
所述验证服务器1003通过验证第一验证种子与所述令牌是否具有合法的对应关系获得验证结果，并将所述验证结果发送至第一客户端1001。
具体地，所述第一客户端1001和第二客户端1002可以为上述的身份验证装置。
本申请一示例性实施例还提供了一种身份验证系统，如图25所示，所述系统包括第一客户端1101、第二客户端1102和验证服务器1103；
第一客户端1101响应于身份验证指令，获取账号；根据所述账号查询与所述账号对应的第一验证种子；生成验证消息；将所述第一验证种子和所述验证消息发送至验证服务器1103，并向验证服务器1103请求服务器推送操作；
验证服务器1103生成与述第一验证种子和所述验证消息对应的消息标识，并将消息标识和验证消息推送至第二客户端1102；
第二客户端1102响应于对所述验证消息的确认指令，根据第二验证种子生成令牌，并将所述令牌与所述消息标识传输至所述验证服务器1103；
所述验证服务器1103根据从第二客户端1102得到的消息标识查询 第一验证种子；通过验证第一验证种子与所述令牌是否具有合法的对应关系获得验证结果，并将所述验证结果发送至第一客户端1101；
所述第一客户端1101获取来自所述验证服务器1103的验证结果。
具体地，所述第一客户端1101和第二客户端1102可以为上述的身份验证装置。
需要说明的是，上述实施例提供的装置和系统，在实现其功能时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的装置与方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
请参考图26，其示出了本申请一个实施例提供的终端的结构示意图。该终端用于实施上述实施例中提供的身份验证方法中第一客户端或第二客户端的功能。
所述终端可以包括RF(Radio Frequency，射频)电路2610、包括有一个或一个以上计算机可读存储介质的存储器2620、输入单元2630、显示单元2640、传感器2650、音频电路2660、WiFi(wireless fidelity，无线保真)模块2670、包括有一个或者一个以上处理核心的处理器2680、以及电源2690等部件。本领域技术人员可以理解，图26中示出的终端结构并不构成对终端的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。其中：
RF电路2610可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，交由一个或者一个以上处理器2680处理；另外，将涉及上行的数据发送给基站。通常，RF电路2610包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、用户身 份模块(SIM)卡、收发信机、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等。此外，RF电路2610还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于GSM(Global System of Mobile communication，全球移动通讯系统)、GPRS(General Packet Radio Service，通用分组无线服务)、CDMA(Code Division Multiple Access，码分多址)、WCDMA(Wideband Code Division Multiple Access,宽带码分多址)、LTE(Long Term Evolution,长期演进)、电子邮件、SMS(Short Messaging Service，短消息服务)等。
存储器2620可用于存储软件程序以及模块，处理器2680通过运行存储在存储器2620的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器2620可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、功能所需的应用程序等；存储数据区可存储根据所述终端的使用所创建的数据等。此外，存储器2620可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。相应地，存储器2620还可以包括存储器控制器，以提供处理器2680和输入单元2630对存储器2620的访问。
输入单元2630可用于接收输入的数字或字符信息，以及产生与用户设置以及功能控制有关的键盘、鼠标、操作杆、光学或者轨迹球信号输入。具体地，输入单元2630可包括触敏表面2631以及其他输入设备2632。触敏表面2631，也称为触摸显示屏或者触控板，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触敏表面2631上或在触敏表面2631附近的操作)，并根据预先设定的程式驱动相应的连接装置。在一些实施例中，触敏表面2631可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户 的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器2680，并能接收处理器2680发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触敏表面2631。除了触敏表面2631，输入单元2630还可以包括其他输入设备2632。具体地，其他输入设备2632可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元2640可用于显示由用户输入的信息或提供给用户的信息以及所述终端的各种图形用户接口，这些图形用户接口可以由图形、文本、图标、视频和其任意组合来构成。显示单元2640可包括显示面板2641，在一些实施例中，可以采用LCD(Liquid Crystal Display，液晶显示器)、OLED(Organic Light-Emitting Diode,有机发光二极管)等形式来配置显示面板2641。进一步的，触敏表面2631可覆盖显示面板2641，当触敏表面2631检测到在其上或附近的触摸操作后，传送给处理器2680以确定触摸事件的类型，随后处理器2680根据触摸事件的类型在显示面板2641上提供相应的视觉输出。虽然在图26中，触敏表面2631与显示面板2641是作为两个独立的部件来实现输入和输入功能，但是在某些实施例中，可以将触敏表面2631与显示面板2641集成而实现输入和输出功能。
所述终端还可包括至少一种传感器2650，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板2641的亮度，接近传感器可在所述终端移动到耳边时，关闭显示面板2641和/或背光。作为运动传感器的一种，重力加速度传感器可检测各个方向 上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别终端姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于所述终端还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路2660、扬声器2661，传声器2662可提供用户与所述终端之间的音频接口。音频电路2660可将接收到的音频数据转换后的电信号，传输到扬声器2661，由扬声器2661转换为声音信号输出；另一方面，传声器2662将收集的声音信号转换为电信号，由音频电路2660接收后转换为音频数据，再将音频数据输出处理器2680处理后，经RF电路2610以发送给比如另一终端，或者将音频数据输出至存储器2620以便进一步处理。音频电路2660还可能包括耳塞插孔，以提供外设耳机与所述终端的通信。
WiFi属于短距离无线传输技术，所述终端通过WiFi模块2670可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图26示出了WiFi模块2670，但是可以理解的是，其并不属于所述终端的必须构成，完全可以根据需要在不改变申请的本质的范围内而省略。
处理器2680是所述终端的控制中心，利用各种接口和线路连接整个终端的各个部分，通过运行或执行存储在存储器2620内的软件程序和/或模块，以及调用存储在存储器2620内的数据，执行所述终端的各种功能和处理数据，从而对终端进行整体监控。在一些实施例中，处理器2680可包括一个或多个处理核心；在一些实施例中，处理器2680可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以 理解的是，上述调制解调处理器也可以不集成到处理器2680中。
所述终端还包括给各个部件供电的电源2690(比如电池)，在一些实施例中，电源可以通过电源管理系统与处理器2680逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。电源2690还可以包括一个或一个以上的直流或交流电源、再充电系统、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。
尽管未示出，所述终端还可以包括摄像头、蓝牙模块等，在此不再赘述。具体在本实施例中，终端的显示单元是触摸屏显示器，终端还包括有存储器，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行述一个或者一个以上程序包含用于执行上述第一客户端或第二客户端的身份验证方法的指令。
请参考图27，其示出了本申请一个实施例提供的服务器的结构示意图。该服务器用于实施上述实施例中提供的服务器的身份验证方法。具体来讲：
所述服务器2700包括中央处理单元(CPU)2701、包括随机存取存储器(RAM)2702和只读存储器(ROM)2703的系统存储器2704，以及连接系统存储器2704和中央处理单元2701的系统总线2705。所述服务器2700还包括帮助计算机内的各个器件之间传输信息的基本输入/输出系统(I/O系统)2706，和用于存储操作系统2713、应用程序2714和其他程序模块2715的大容量存储设备2707。
所述基本输入/输出系统2706包括有用于显示信息的显示器2708和用于用户输入信息的诸如鼠标、键盘之类的输入设备2709。其中所述显示器2708和输入设备2709都通过连接到系统总线2705的输入输出控制器2710连接到中央处理单元2701。所述基本输入/输出系统2706还 可以包括输入输出控制器2710以用于接收和处理来自键盘、鼠标、或电子触控笔等多个其他设备的输入。类似地，输入输出控制器2710还提供输出到显示屏、打印机或其他类型的输出设备。
所述大容量存储设备2707通过连接到系统总线2705的大容量存储控制器(未示出)连接到中央处理单元2701。所述大容量存储设备2707及其相关联的计算机可读介质为服务器2700提供非易失性存储。也就是说，所述大容量存储设备2707可以包括诸如硬盘或者CD-ROM驱动器之类的计算机可读介质(未示出)。
不失一般性，所述计算机可读介质可以包括计算机存储介质和通信介质。计算机存储介质包括以用于存储诸如计算机可读指令、数据结构、程序模块或其他数据等信息的任何方法或技术实现的易失性和非易失性、可移动和不可移动介质。计算机存储介质包括RAM、ROM、EPROM、EEPROM、闪存或其他固态存储其技术，CD-ROM、DVD或其他光学存储、磁带盒、磁带、磁盘存储或其他磁性存储设备。当然，本领域技术人员可知所述计算机存储介质不局限于上述几种。上述的系统存储器2704和大容量存储设备2707可以统称为存储器。
根据本申请的各种实施例，所述服务器2700还可以通过诸如因特网等网络连接到网络上的远程计算机运行。也即服务器2700可以通过连接在所述系统总线2705上的网络接口单元2711连接到网络2712，或者说，也可以使用网络接口单元2711来连接到其他类型的网络或远程计算机系统(未示出)。
所述存储器还包括一个或者一个以上的程序，所述一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行。上述一个或者一个以上程序包含用于执行上述服务器的方法的指令。
在示例性实施例中，还提供了一种包括指令的非临时性计算机可读 存储介质，例如包括指令的存储器，上述指令可由终端的处理器执行以完成上述方法实施例中的各个步骤，或者上述指令由服务器的处理器执行以完成上述方法实施例中后台服务器侧的各个步骤。例如，所述非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
应当理解的是，在本文中提及的“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的原则之内所作的任何修改、等同替换和改进等，均应包含在本申请的保护范围之内。

Claims (45)

  1. 一种身份验证方法，应用于第一客户端，所述方法包括：
    响应于第二客户端的身份验证指令，获取第二客户端的账号；
    根据所述账号查询与所述账号对应的第一验证种子，其中所述第一客户端中存储有所述第一验证种子，以及所述账号与所述第一验证种子的对应关系；
    根据所述账号生成验证消息；
    将所述第一验证种子和所述验证消息发送至验证服务器；
    获取验证结果并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与第一令牌是否对应获得，所述第一令牌是由第二客户端响应于所述验证消息的确认指令生成并发送给所述验证服务器的，所述第二客户端中存储有第二验证种子，以及所述账号与所述第二验证种子的对应关系。
  2. 根据权利要求1所述的方法，在所述响应于身份验证指令之前，还包括：
    响应于所述第二客户端的绑定指令，获取所述第二客户端的账号；
    为所述帐号分配所述第一验证种子；
    生成与所述第一验证种子相对应的第二验证种子,并将所述第二验证种子提供给所述第二客户端，其中所述第二客户端根据所述第二验证种子生成第二令牌；
    获取由第二客户端生成的第二令牌；
    将第一验证种子和所述第二令牌发送至验证服务器；
    获取验证结果；所述验证结果为验证服务器通过验证第一验证种子与所述第二令牌是否对应获得；
    若验证通过，则存储第一验证种子，以及所述第一验证种子与所述 第二客户端的账号的对应关系。
  3. 根据权利要求2所述的方法，所述为所述帐号分配第一验证种子包括：
    获取未使用种子集合，所述未使用种子均来自验证服务器；
    在所述未使用种子集合中随机选取一颗种子作为第一验证种子。
  4. 根据权利要求2所述的方法，其中，将所述第二验证种子提供给所述第二客户端包括以下任意一个：
    将所述第二验证种子发送至第二客户端；
    根据所述第二验证种子生成第一验证条码供所述第二客户端扫描；
    其中，所述根据所述第二验证种子生成第一验证条码供所述第二客户端扫描包括：
    根据所述第二验证种子和所述账号生成能够被第二客户端扫描的二维码或条形码。
  5. 根据权利要求1所述的方法，所述验证消息包括验证消息产生时间和所述账号。
  6. 根据权利要求1所述的方法，在所述获取验证结果之前，还包括：
    获取验证服务器发送的与所述验证消息对应的消息标识，并将所述消息标识提供给所述第二客户端；所述消息标识在所述验证服务器中与第一验证种子对应；
    其中，将所述消息标识提供给所述第二客户端包括以下任意一个：
    向第二客户端发送所述消息标识；
    根据所述消息标识生成第二验证条码供所述第二客户端扫描。
  7. 根据权利要求1所述的方法，在将所述第一验证种子和所述验证消息发送至验证服务器之后，还包括：向验证服务器请求服务器推送操作以使得所述验证服务器将所述消息标识和所述验证消息推送至第二 客户端。
  8. 一种身份验证装置，应用于第一客户端，包括：
    处理器；
    与所述处理器相连接的存储器；所述存储器中存储有可由所述处理器执行的机器可读指令模块；所述机器可读指令模块包括：
    账号获取模块，用于响应于第二客户端的身份验证指令，获取第二客户端的账号；
    第一验证种子查询模块，用于根据所述账号查询与所述账号对应的第一验证种子，其中所述第一客户端中存储有所述第一验证种子，以及所述账号与所述第一验证种子的对应关系；
    验证消息生成模块，用于根据所述账号生成验证消息；
    验证消息发送模块，用于向验证服务器发送所述第一验证种子和验证消息；
    验证结果获取模块，用于获取验证结果并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与第一令牌是否对应获得，所述第一令牌是由第二客户端响应于所述验证消息的确认指令生成并发送给所述验证服务器的，所述第二客户端中存储有第二验证种子，以及所述账号与所述第二验证种子的对应关系。
  9. 根据权利要求8所述的装置，还包括：
    第一验证种子获取模块，用于为所述帐号分配所述第一验证种子；
    种子生成模块，用于生成与所述第一验证种子相对应的第二验证种子，其中所述第二客户端根据所述第二验证种子生成第二令牌；
    令牌获取模块，用于获取由第二客户端生成的第二令牌；
    组合发送模块，用于将第一验证种子和所述第二令牌发送至验证服 务器；
    第一验证种子存储模块，用于当验证服务器验证通过时，存储第一验证种子，以及所述第一验证种子与所述第二客户端帐号的对应关系，其中如果验证服务器确定第一验证种子与所述第二令牌对应，则验证通过。
  10. 根据权利要求9所述的装置，所述第一验证种子获取模块包括：
    集合获取单元，用于获取未使用种子集合，所述未使用种子均来自验证服务器；
    选取单元，用于在所述未使用种子集合中随机选取一颗种子作为第一验证种子。
  11. 根据权利要求9所述的装置，还包括以下任意一个：
    种子发送模块，用于将所述第二验证种子发送至第二客户端；
    第一验证条码生成模块，用于根据所述第二验证种子生成第一验证条码供所述第二客户端扫描。
  12. 根据权利要求8所述的装置，还包括：
    消息标识获取模块，用于获取验证服务器发送的与所述验证消息对应的消息标识；所述消息标识在所述验证服务器中与第一验证种子对应；所述装置还包括以下至少一个：
    消息标识发送模块，用于将所述消息标识发送给所述第二客户端；
    第二验证条码生成模块，用于根据所述消息标识生成第二验证条码供所述第二客户端扫描。
  13. 根据权利要求8所述的装置，还包括：
    请求模块，用于向验证服务器请求服务器推送操作以使得所述验证服务器将所述验证消息和与所述验证消息对应的消息标识推送至第二客户端；所述消息标识在所述验证服务器中与第一验证种子对应。
  14. 一种身份验证方法，应用于第二客户端，所述方法包括：
    获取消息标识以及验证消息；其中，所述验证服务器接收第一客户端发送的所述验证消息并将所述验证消息提供给所述第二客户端，所述消息标识为所述验证服务器分配的与所述验证消息对应的消息标识；
    显示所述验证消息并监测用户指令，所述用户指令包括响应于所述验证消息的确认指令；
    响应于确认指令，获取第二验证种子并根据所述第二验证种子生成第一令牌；
    将所述消息标识和所述第一令牌传输至验证服务器，以使得验证服务器得到验证结果，并将验证结果发送给第一客户端；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应而获得的，所述第一验证种子为所述验证服务器通过所述消息标识从所述验证服务器中查询到的。
  15. 根据权利要求14所述的方法，在所述获取消息标识以及验证消息之前，还包括：
    从所述第一客户端得到所述第二验证种子；
    根据所述第二验证种子生成第二令牌并将所述第二令牌传输至所述第一客户端，其中所述第一客户端将所述第一验证种子和所述第二令牌发送给所述验证服务器；
    获取验证结果；所述验证结果为验证服务器通过获取第一客户端传送的第一验证种子与所述第二令牌，并验证第一验证种子与所述第二令牌是否对应获得；
    若验证通过，则存储所述第二验证种子及所述第二验证种子与所述第二客户端的帐号的对应关系。
  16. 根据权利要求14或15所述的方法，所述生成所述第一令牌包 括：
    获取用于生成所述第一令牌的种子；
    获取本地的当前系统时间；
    根据预设的哈希算法得到所述第一令牌，其中所述第二验证种子和与所述当前系统时间对应的时间参量为所述哈希算法的参数。
  17. 根据权利要求16所述的方法，所述时间参量的获取方法包括：
    获取来自于验证服务器的第一时间；
    获取本地的第二时间；
    计算所述第一时间与所述第二时间的差值；
    根据所述当前系统时间和所述差值计算时间校正值；
    根据所述时间校正值得到时间参量。
  18. 根据权利要求14所述的方法，所述获取消息标识以及验证消息包括：
    从第一客户端得到消息标识，所述消息标识为所述验证服务器分配的与验证消息对应的消息标识；
    根据所述消息标识从验证服务器获取所述验证消息。
  19. 根据权利要求14所述的方法，其中，所述获取消息标识以及验证消息包括：直接获取由验证服务器推送的消息标识和验证消息。
  20. 一种身份验证装置，应用于第二客户端，所述装置包括：
    处理器；
    与所述处理器相连接的存储器；所述存储器中存储有可由所述处理器执行的机器可读指令模块；所述机器可读指令模块包括：
    消息获取模块，用于获取消息标识和验证消息；其中，所述验证服务器接收第一客户端发送的所述验证消息并将所述验证消息提供给所述第二客户端，所述消息标识为所述验证服务器分配的与所述验证消息 对应的消息标识；
    显示模块，用于显示所述验证消息；
    用户指令监测模块，用于检测用户指令，所述用户指令包括响应于所述验证消息的确认指令；
    第二验证种子获取模块，用于获取第二验证种子；
    令牌生成模块，用于根据所述第二验证种子生成第一令牌；
    传输模块，用于将所述消息标识和所述第一令牌传输至验证服务器，以使得验证服务器得到验证结果，并将验证结果发送给第一客户端；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应而获得的，所述第一验证种子为所述验证服务器通过所述消息标识从所述验证服务器中查询到的。
  21. 根据权利要求20所述的装置，还包括：
    验证种子获取模块，用于在所述消息获取模块获取消息标识以及验证消息之前，从所述第一客户端得到第二验证种子；
    第二验证种子存储模块，用于存储第二验证种子；
    组合存储模块，用于存储所述第二验证种子与所述第二客户端的帐号的对应关系。
  22. 根据权利要求20所述的装置，其中所述令牌生成模块包括：
    时间参量获取单元，用于根据当前系统时间得到与当前系统时间对应的时间参量；
    令牌计算单元，用于根据预设的哈希算法、所述第二验证种子和时间参量计算所述第一令牌。
  23. 根据权利要求22所述的装置，进一步包括：
    第一时间获取模块，用于获取来自于验证服务器的第一时间；
    第二时间获取模块，用于获取本地的第二时间；
    差值计算模块，用于计算所述第一时间与所述第二时间的差值；
    所述时间参量获取单元包括：
    时间校正值计算模块，用于根据当前系统时间和所述差值计算时间校正值；
    时间参量获取模块，用于根据所述时间校正值得到所述时间参量。
  24. 根据权利要求20所述的装置，所述消息获取模块包括：
    消息标识获取单元，用于从第一客户端得到消息标识，所述消息标识为所述验证服务器分配的与验证消息对应的消息标识；
    验证消息获取模块，用于根据所述消息标识从验证服务器获取所述验证消息。
  25. 根据权利要求20所述的装置，其中所述消息获取模块包括：
    直接获取单元，用于直接获取由验证服务器推送的消息标识和验证消息。
  26. 一种身份验证方法，所述方法包括：
    第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；
    所述第二客户端根据第二验证种子生成第一令牌并将所述第一令牌提供给所述第一客户端；
    所述第一客户端得到第二客户端生成的所述第一令牌，将所述第一验证种子与所述第一令牌传输至验证服务器；
    所述验证服务器通过验证第一验证种子与所述令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；
    所述第一客户端获取所述验证结果，并根据所述验证结果确定所述第二客户端是否验证通过。
  27. 根据权利要求26所述的方法，在所述第一客户端响应于身份验 证指令之前，还包括：
    第一客户端响应于所述第二客户端的绑定指令，获取所述第二客户端的账号；为所述第二客户端的帐号分配所述第一验证种子；生成与第一验证种子对应的第二验证种子并将所述第二验证种子提供给所述第二客户端；
    所述第二客户端根据得到的所述第二验证种子生成第二令牌，并将所述第二令牌提供给所述第一客户端；
    所述第一客户端得到所述第二客户端生成的所述第二令牌；将所述第一验证种子与所述第二令牌传输至验证服务器；
    所述验证服务器通过验证第一验证种子与所述第二令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；
    所述第一客户端获取验证结果；若验证通过，则存储所述账号与所述第一验证种子的对应关系。
  28. 根据权利要求27所述的方法，所述方法还包括：
    若验证通过，则所述第二客户端存储得到的第二验证种子，以及所述第二验证种子与所述第二客户端的帐号的对应关系。
  29. 根据权利要求28所述的方法，其中所述验证服务器通过验证第一验证种子与所述第二令牌是否对应获得验证结果包括：
    根据令牌生成算法和所述第一验证种子生成目标令牌；
    判断所述目标令牌和所述第二令牌是否相同；
    若是，则验证结果为验证通过；否则，验证结果为验证不通过。
  30. 根据权利要求28所述的方法，所述验证服务器通过验证第一验证种子与所述第二令牌是否对应获得验证结果包括：
    根据令牌生成算法和所述第一验证种子生成第一目标令牌和第二目标令牌；
    判断所述第一目标令牌和所述第二令牌是否相同；
    若是，则验证结果为验证通过；否则，判断所述第二目标令牌和所述第二令牌是否相同；
    若是，则验证结果为验证通过，否则，验证结果为验证不通过。
  31. 一种身份验证方法，应用于第一客户端，所述方法包括：
    响应于第二客户端的身份验证指令，获取第二客户端的账号；
    根据所述账号查询与所述账号对应的第一验证种子；
    获取第二客户端生成的第一令牌；
    将所述第一验证种子与所述第一令牌传输至验证服务器并获取验证结果，并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得。
  32. 根据权利要求31所述的方法，在响应于身份验证指令之前，还包括：
    响应于第二客户端的绑定指令，获取第二客户端的账号；
    为所述第二客户端分配所述第一验证种子；
    生成与第一验证种子对应的第二验证种子并将所述第二验证种子提供给所述第二客户端；
    得到第二客户端根据所述第二验证种子生成的第二令牌；
    将所述第一验证种子与所述第二令牌传输至验证服务器并获取验证结果；若验证通过，则存储所述账号与所述第一验证种子的对应关系。
  33. 根据权利要求32所述的方法，所述得到第一验证种子包括：
    获取未使用种子集合，所述未使用种子均来自验证服务器；
    在所述未使用种子集合中随机选取一颗种子作为第一验证种子。
  34. 一种身份验证方法，应用于第二客户端，所述方法包括：
    得到第二验证种子；
    根据所述第二验证种子生成第一令牌并将所述第一令牌提供给第一客户端得到，其中所述第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；将所述第一验证种子与所述第一令牌传输至验证服务器以获取验证结果，其中所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；所述第一客户端根据所述验证结果确定所述第二客户端是否通过验证。
  35. 根据权利要求34所述的方法，所述生成所述第一令牌包括：
    获取用于生成所述第一令牌的第二验证种子；
    获取本地的当前系统时间；
    根据所述当前系统时间得到与所述当前系统时间对应的时间参量；
    根据预设的哈希算法得到所述第一令牌，所述第二验证种子与所述当前系统时间对应的时间参量为所述哈希算法的参数。
  36. 根据权利要求35所述的方法，所述根据系统时间得到与所述当前系统时间对应的时间参量包括：
    获取来自于验证服务器的第一时间；
    获取本地的第二时间；
    计算所述第一时间与所述第二时间的差值；
    根据当前系统时间和所述差值计算时间校正值；
    根据所述时间校正值得到时间参量。
  37. 一种身份验证装置，应用于第一客户端，所述装置包括：
    处理器；
    与所述处理器相连接的存储器；所述存储器中存储有可由所述处理器执行的机器可读指令模块；所述机器可读指令模块包括：
    账号获取模块，用于响应于第二客户端的身份验证指令，获取第二客户端的账号；
    第一验证种子查询模块，用于根据所述账号查询与所述账号对应的第一验证种子；
    令牌获取模块，用于获取第二客户端生成的第一令牌；
    组合发送模块，用于将所述第一验证种子与所述第一令牌传输至验证服务器；
    验证结果获取模块，用于获取来自验证服务器的验证结果，并根据所述验证结果确定所述第二客户端是否验证通过；所述验证结果为所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得。
  38. 根据权利要求37所述的装置，所述装置还包括：
    第一验证种子获取模块，用于为所述第二客户端分配所述第一验证种子；
    种子生成模块，用于生成与第一验证种子对应的第二验证种子，并将所述第二验证种子提供给所述第二客户端；得到第二客户端根据所述第二验证种子生成的第二令牌；将所述第一验证种子与所述第二令牌传输至验证服务器并获取验证结果；
    第一验证种子存储模块，用于当验证通过时，存储第一验证种子，以及所述第一验证种子与所述第二客户端的账号的对应关系。
  39. 一种身份验证装置，应用于第二客户端，所述装置包括：
    验证种子获取模块，用于获取第二验证种子；
    令牌生成模块，用于根据所述第二验证种子生成第一令牌并将所述第一令牌提供给所述第一客户端，其中所述第一客户端响应于第二客户端的身份验证指令，获取第二客户端的账号；根据所述账号查询与所述账号对应的第一验证种子；将所述第一验证种子与所述第一令牌传输至 验证服务器以获取验证结果，其中所述验证服务器通过验证第一验证种子与所述第一令牌是否对应获得验证结果，并将所述验证结果发送至第一客户端；所述第一客户端根据所述验证结果确定所述第二客户端是否通过验证。
  40. 根据权利要求39所述的装置，所述令牌生成模块包括：
    时间参量获取单元，用于根据当前系统时间得到与所述当前系统时间对应的时间参量；
    令牌计算单元，用于根据预设的哈希算法计算所述第一令牌，所述第二验证种子和与所述当前系统时间对应的时间参量为所述哈希算法的参数。
  41. 根据权利要求40所述的装置，还包括：
    第一时间获取模块，用于获取来自于验证服务器的第一时间；
    第二时间获取模块，用于获取本地的第二时间；
    差值计算模块，用于计算所述第一时间与所述第二时间的差值；
    所述时间参量获取单元用于根据当前系统时间和所述差值计算时间校正值；根据所述时间校正值得到时间参量。
  42. 一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成权利要求1至7任一项所述的方法。
  43. 一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成权利要求14至19任一项所述的方法。
  44. 一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成权利要求31至33任一项所述的方法。
  45. 一种非易失性计算机可读存储介质，所述存储介质中存储有机器可读指令，所述机器可读指令可以由处理器执行以完成权利要求34至36任一项所述的方法。
PCT/CN2017/115566 2016-12-15 2017-12-12 身份验证方法、装置及存储介质 WO2018108062A1 (zh)

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
CN201611161452.3 2016-12-15
CN201611162210.6A CN108234412B (zh) 2016-12-15 2016-12-15 身份验证方法与装置
CN201611162274.6A CN108234113B (zh) 2016-12-15 2016-12-15 身份验证方法、装置与系统
CN201611162274.6 2016-12-15
CN201611161452.3A CN108234409B (zh) 2016-12-15 2016-12-15 身份验证方法与装置
CN201611162210.6 2016-12-15

Publications (1)

Publication Number Publication Date
WO2018108062A1 true WO2018108062A1 (zh) 2018-06-21

Family

ID=62558052

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/115566 WO2018108062A1 (zh) 2016-12-15 2017-12-12 身份验证方法、装置及存储介质

Country Status (1)

Country Link
WO (1) WO2018108062A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110008668A (zh) * 2019-03-21 2019-07-12 北京小米移动软件有限公司 一种数据处理方法、装置及存储介质
CN110968860A (zh) * 2019-11-21 2020-04-07 上海掌门科技有限公司 应用账号的安全验证方法、计算机设备及计算机可读存储介质
CN111935059A (zh) * 2019-05-13 2020-11-13 阿里巴巴集团控股有限公司 一种设备标识的处理方法、装置及系统
CN112084485A (zh) * 2020-09-16 2020-12-15 腾讯科技（深圳）有限公司 数据获取方法、装置、设备以及计算机存储介质
CN114500025A (zh) * 2022-01-19 2022-05-13 北京达佳互联信息技术有限公司 一种账户标识获取方法、装置、服务器及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101163014A (zh) * 2007-11-30 2008-04-16 中国电信股份有限公司 一种动态口令身份认证系统和方法
CN101197667A (zh) * 2007-12-26 2008-06-11 北京飞天诚信科技有限公司 一种动态口令认证的方法
CN101662465A (zh) * 2009-08-26 2010-03-03 深圳市腾讯计算机系统有限公司 一种动态口令验证的方法及装置
CN102202300A (zh) * 2011-06-14 2011-09-28 上海众人网络安全技术有限公司 一种基于双通道的动态密码认证系统及方法
CN103152172A (zh) * 2011-12-07 2013-06-12 中国电信股份有限公司 一种手机令牌动态口令生成方法、客户端、服务器以及系统
WO2016161889A1 (zh) * 2015-04-07 2016-10-13 阿里巴巴集团控股有限公司 一种动态口令验证方法及系统、客户端和服务器

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101163014A (zh) * 2007-11-30 2008-04-16 中国电信股份有限公司 一种动态口令身份认证系统和方法
CN101197667A (zh) * 2007-12-26 2008-06-11 北京飞天诚信科技有限公司 一种动态口令认证的方法
CN101662465A (zh) * 2009-08-26 2010-03-03 深圳市腾讯计算机系统有限公司 一种动态口令验证的方法及装置
CN102202300A (zh) * 2011-06-14 2011-09-28 上海众人网络安全技术有限公司 一种基于双通道的动态密码认证系统及方法
CN103152172A (zh) * 2011-12-07 2013-06-12 中国电信股份有限公司 一种手机令牌动态口令生成方法、客户端、服务器以及系统
WO2016161889A1 (zh) * 2015-04-07 2016-10-13 阿里巴巴集团控股有限公司 一种动态口令验证方法及系统、客户端和服务器

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110008668A (zh) * 2019-03-21 2019-07-12 北京小米移动软件有限公司 一种数据处理方法、装置及存储介质
CN110008668B (zh) * 2019-03-21 2023-09-19 北京小米移动软件有限公司 一种数据处理方法、装置及存储介质
CN111935059A (zh) * 2019-05-13 2020-11-13 阿里巴巴集团控股有限公司 一种设备标识的处理方法、装置及系统
CN111935059B (zh) * 2019-05-13 2023-08-25 阿里巴巴集团控股有限公司 一种设备标识的处理方法、装置及系统
CN110968860A (zh) * 2019-11-21 2020-04-07 上海掌门科技有限公司 应用账号的安全验证方法、计算机设备及计算机可读存储介质
CN112084485A (zh) * 2020-09-16 2020-12-15 腾讯科技（深圳）有限公司 数据获取方法、装置、设备以及计算机存储介质
CN112084485B (zh) * 2020-09-16 2023-09-15 腾讯科技（深圳）有限公司 数据获取方法、装置、设备以及计算机存储介质
CN114500025A (zh) * 2022-01-19 2022-05-13 北京达佳互联信息技术有限公司 一种账户标识获取方法、装置、服务器及存储介质
CN114500025B (zh) * 2022-01-19 2023-10-27 北京达佳互联信息技术有限公司 一种账户标识获取方法、装置、服务器及存储介质

Similar Documents

Publication Publication Date Title
CN112733107B (zh) 一种信息验证的方法、相关装置、设备以及存储介质
US10637668B2 (en) Authentication method, system and equipment
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
WO2018108123A1 (zh) 身份验证方法、装置与系统
WO2018157858A1 (zh) 信息存储方法、装置及计算机可读存储介质
CN111193695B (zh) 一种第三方账号登录的加密方法、装置及存储介质
WO2018108062A1 (zh) 身份验证方法、装置及存储介质
JP6576555B2 (ja) サービス処理方法、デバイス及びシステム
US11488234B2 (en) Method, apparatus, and system for processing order information
WO2018177124A1 (zh) 业务处理方法、装置、数据共享系统及存储介质
WO2017118412A1 (zh) 一种更新密钥的方法、装置和系统
WO2017041599A1 (zh) 业务处理方法及电子设备
WO2017185711A1 (zh) 控制智能设备的方法、装置、系统和存储介质
WO2015101273A1 (zh) 一种安全验证方法、相关设备和系统
US9635018B2 (en) User identity verification method and system, password protection apparatus and storage medium
WO2017084288A1 (zh) 身份验证方法及装置
CN110198301B (zh) 一种服务数据获取方法、装置及设备
CN110417543B (zh) 一种数据加密方法、装置和存储介质
CN107154935B (zh) 业务请求方法及装置
US20210273794A1 (en) Method employed in user authentication system and information processing apparatus included in user authentication system
CN104954126B (zh) 敏感操作验证方法、装置及系统
US20230353363A1 (en) Login authentication method, apparatus, and system
WO2016078504A1 (zh) 身份鉴权方法和装置
CN108475304A (zh) 一种关联应用程序和生物特征的方法、装置以及移动终端
CN110474864B (zh) 一种注册、登录移动应用程序的方法及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17880457

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17880457

Country of ref document: EP

Kind code of ref document: A1