WO2018108123A1

WO2018108123A1 - Identity authentication method, device and system

Info

Publication number: WO2018108123A1
Application number: PCT/CN2017/116140
Authority: WO
Inventors: 袁丽娜; 郝允允; 李轶峰; 陈云云
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2016-12-15
Filing date: 2017-12-14
Publication date: 2018-06-21
Also published as: CN108234124A; CN108234124B

Abstract

Provided in the embodiments of the present invention are an identity authentication method, device and system, the method comprising: a first client obtaining an account number in response to an identity authentication instruction; querying a first authentication seed corresponding to the account number; generating an authentication message; sending the first authentication seed and the authentication message to an authentication server; and acquiring a message number from the authentication server. A second terminal obtaining the message number from the first terminal; acquiring an authentication message corresponding to the message number from the verification server according to the message number; and generating a token according to a second authentication seed in response to an acknowledgement instruction for the authentication message, and transmitting the token and the message number to the authentication server. The authentication server querying the first authentication seed according to the message number obtained from the second terminal; acquiring a verification result by means of verifying whether the first authentication seed and the token have a legal correspondence relationship, and sending the verification result to the first terminal. The first terminal acquiring the authentication result from the authentication server.

Description

Authentication method, device and system

The present application claims priority to Chinese Patent Application No. 201611160732.2, entitled "Identification Method, Apparatus and System", filed on December 15, 2016, the entire contents of .

Technical field

The present invention relates to the field of identity verification, and in particular, to an identity verification method, apparatus and system.

Background of the invention

With the rapid development of the Internet, mobile Internet, online shopping, games and other Internet services have penetrated into all aspects of life, and the value of personal accounts on the Internet is getting higher and higher. At the same time, the risk of personal account password leakage, phishing, hacking Trojans, social engineering, etc., resulting in the theft of network accounts is also increasing. The traditional way for users to set the login password is easy to crack through violent attempts, keyboard interception, screen capture, etc., for this reason only by verifying the password is not enough to prove the legitimacy of the user.

In order to protect account security, users need to set password protection measures in multiple account systems, such as binding Taobao security center for Taobao account, QQ security center for QQ account, etc., which leads to the need for users to use multiple applications at the same time. Binding multiple security centers is cumbersome.

Summary of the invention

The embodiments of the present invention provide an identity verification method, apparatus, and system, and a storage medium. The embodiment of the present invention is specifically implemented by the following technical solutions:

In a first aspect, an authentication method, the method comprising:

The first terminal obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server; The verification server obtains the message number;

The second terminal obtains the message number from the first terminal; acquires a verification message corresponding to the message number from the verification server according to the message number; and responds to the confirmation instruction of the verification message, according to the second verification seed Generating a token and transmitting the token and the message number to the verification server;

The verification server queries the first verification seed according to the message number obtained from the second terminal; obtains a verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first terminal;

The first terminal acquires a verification result from the verification server.

In a second aspect, an authentication method is applied to a first terminal, where the method includes:

Acquiring an account in response to the authentication command;

Querying, according to the account, a first verification seed corresponding to the account;

Generating a verification message according to the account number;

Sending the first verification seed and the verification message to an authentication server;

Obtaining a message number from the verification server and enabling the second terminal to acquire the message number;

Obtaining a verification result from the verification server; the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token; the token is generated by the second terminal according to the second verification seed.

In a third aspect, an authentication method is applied to a second terminal, where the method includes:

Get the message number from the first client;

Obtaining a message number from the first terminal;

Acquiring, according to the message number, a verification message corresponding to the message number from the verification server;

Displaying the verification message and monitoring a user instruction, the user instruction including a confirmation instruction;

And in response to the confirmation instruction, acquiring a second verification seed and generating a token according to the second verification seed;

Transmitting the message number and the token to an authentication server to enable the first terminal to obtain a verification result from the verification server.

A fourth aspect is an authentication device, the device comprising one or more processors and one or more non-volatile storage media, the one or more non-volatile storage media storing one or more computers Readable instructions configured to be executed by the one or more processors to implement the following steps:

Acquiring an account in response to the authentication command;

Generating a verification message according to the account number;

In a fifth aspect, an authentication device, the device comprising one or more processors and one or more non-volatile storage media, the one or more non-volatile storage media storing one or more computers Readable instructions configured to be executed by the one or more processors to implement the following steps:

Obtaining a message number from the first terminal;

Displaying the verification message;

Detecting a user instruction, the user instruction including a confirmation instruction;

Acquiring a second verification seed in response to the confirmation instruction;

Generating a token according to the second verification seed;

A sixth aspect is an identity verification system, where the system includes a first client, a second client, and an authentication server;

The first client includes the above device;

The second client includes the above described device.

In a seventh aspect, a non-transitory computer readable storage medium storing computer readable instructions, the computer readable instructions being executable by at least one processor.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive effort.

1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

2 is a schematic diagram of a verification server cluster according to an embodiment of the present invention;

FIG. 3 is a flowchart of an identity binding method according to an embodiment of the present invention;

4 is a user interface of an identity binding process according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for obtaining a first verification seed according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of naming a seed obtained by a user according to an embodiment of the present invention; FIG.

FIG. 7 is a flowchart of a token generation algorithm according to an embodiment of the present invention;

FIG. 8 is a flowchart of a token verification algorithm according to an embodiment of the present invention;

FIG. 9 is a flowchart of another token verification algorithm according to an embodiment of the present invention;

FIG. 10 is a flowchart of a time correction method according to an embodiment of the present invention;

11 is a flowchart of an identity verification method according to an embodiment of the present invention;

FIG. 12 is a schematic diagram of an interface for inputting a token according to an embodiment of the present invention;

FIG. 13 is a schematic diagram of an interface of a user selection token according to an embodiment of the present invention;

FIG. 14 is a flowchart of another identity verification method according to an embodiment of the present invention;

15 is a schematic diagram of a page for generating a second verification barcode according to an embodiment of the present invention;

16 is a schematic diagram of an interface for displaying a verification message according to an embodiment of the present invention;

FIG. 17 is a flowchart of another identity verification method according to an embodiment of the present invention;

FIG. 18 is a block diagram of an identity verification apparatus according to an embodiment of the present invention; FIG.

19 is a block diagram of related modules for performing a binding process according to an embodiment of the present invention;

20 is a block diagram of another identity verification apparatus according to an embodiment of the present invention;

FIG. 21 is a block diagram of a token generating module according to an embodiment of the present invention;

FIG. 22 is a block diagram of a module related to time correction according to an embodiment of the present invention; FIG.

23 is a schematic diagram of a terminal according to an embodiment of the present invention;

24 is a schematic structural diagram of a server according to an embodiment of the present invention;

FIG. 25 is a schematic diagram of an identity verification system according to an embodiment of the present invention.

Mode for carrying out the invention

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

There are several types of authentication methods: confidentiality protection, secret security card, secure email, secret mobile phone, digital certificate, face verification, fingerprint verification and iris verification. The following is a brief analysis of the above authentication methods:

Secret security issue: The secret security issue consists of questions selected by the user and corresponding answers. The security issue is not very convenient, and is often used as a secondary authentication method, such as to retrieve passwords and set other secrets. The secret security problem uses a static password, which is easy to cause security risks.

Secret security card: The security card can be regarded as a two-dimensional matrix, each matrix contains a series of numbers, and each security card has a unique identifier, which is between the value of the matrix and the identifier of each user. A correspondence. When used to authenticate the user identity, the user queries the security card information according to the server prompt, and manually enters the security information according to the server requirements to complete the verification process. The secret security card uses a static password, so there is a risk of screen captures and files being stolen, and it is not easy to carry.

Secure Mailbox: Similar to the secret security issue, the security mailbox is not very convenient, and is often used as a secondary authentication method, such as to retrieve passwords and set other secrets. Mailbox cracking is difficult and can cause security risks.

Secret security mobile phone: The security of the mobile phone is better. It mainly verifies the identity by verifying the SMS verification code sent to the mobile phone, and is widely used in sensitive operations such as registration, consumption, transfer, and confidentiality. However, the secret mobile phone uses SMS downlink verification, which will result in operating costs paid to the operator, and the confidential mobile phone has the risk of loss and replacement.

Digital certificate: A digitally signed document containing public key owner information and public key, which is mainly used for website authentication and is not universal to a large user group.

Face verification: A biometric technology based on human facial feature information for identity verification. Personal identification is performed by verifying the face, but face verification involves sensitive privacy information of the user, and thus its use environment is limited.

Fingerprint verification: Fingerprint refers to the line created by the unevenness of the skin on the front side of the finger end of a person. The lines are regularly arranged to form different patterns. The identification is performed by comparing the detailed feature points of different fingerprints. It is widely used to open mobile phones, open APP, consumer and other fields. Similar to face verification, fingerprint verification involves sensitive privacy information of users, and therefore its use environment is limited.

Iris Verification: The iris is an annular portion between the black pupil and the white sclera that includes a number of interlaced spots, filaments, crowns, stripes, crypts, and the like. After the iris is formed in the fetal development stage, it will remain unchanged throughout the life course. Iris verification has high hardware requirements and is generally used in locations that require a high degree of confidentiality. And iris verification involves sensitive privacy information of users, so its use environment is limited.

In summary, the secret security policy, the secret security card and the security email are static passwords, which are easy to cause security risks. The digital certificate, face verification, fingerprint verification and iris verification use environment are limited, and it is not easy to promote and apply. The mobile phone has the problem of operating cost and the risk of loss of the mobile phone. Therefore, the embodiment of the present invention provides a low risk and a suitable application based on the token mode. An authentication method and a corresponding device that are widely distributed, low in cost, and free from the risk of loss of the mobile phone.

The token used in the embodiment of the present invention is a software token, and the software token can be obtained according to a seed for authenticating a user identity and a preset token generation algorithm. Specifically, the embodiment of the present invention may provide one or more authentication methods for the user, including but not limited to dynamic password verification, scan code verification, and one-click login.

Please refer to FIG. 1, which shows a schematic diagram of an implementation environment provided by an embodiment of the present invention. The implementation environment includes a first terminal 120, an authentication server 140, and a second terminal 160.

The first client 120 runs a first client. The first terminal 120 can be a mobile phone, a tablet computer, a television set, a laptop portable computer, and a desktop computer. It can also be a server, a server cluster composed of several servers, or a cloud computing service center.

The verification server 140 can be an authentication server, a server cluster composed of several servers, or a cloud computing service center.

A second client is running in the second terminal 160. The second terminal 160 can be a cell phone, a tablet, a laptop portable computer, a desktop computer, and the like.

The verification server 140 can establish a communication connection with the first terminal 120 and the second terminal 160 through the communication network, respectively. The network can be either a wireless network or a wired network.

In the embodiment of the present invention, the first client may be any client that has a user interface (UI) interface, needs to verify the identity of the user who uses the first client, and can communicate with the authentication server 140. For example, the first client can be a video service class server or client, a cable television server or client, a security service server or client, an instant messaging server or client, a mail service server or client, a game service server, or a client. , payment service server or client, e-commerce service server or client, and so on.

In the embodiment of the present invention, the second client may be any client that has a user interface (UI) interface, needs to log in to the first client, and can communicate with the authentication server 140. For example, the second client can be a mobile client, a tablet client, a multimedia client, and the like.

In a practical application, when a client running in the terminal device is used to implement the function of the first client side in the method example of the present invention, the terminal device is used as the first terminal; when the client running in the terminal device is used to implement When the function of the second client side is used in the method example of the present invention, the terminal device acts as the second terminal.

In one example, as shown in FIG. 2, when the verification server 140 is a cluster architecture, the verification server 140 may include a communication server 142, a seed management server 144, an authentication server 146, and a verification message management server 148.

The communication server 142 is configured to provide communication services with the first client and the second client, and provides communication services between the three servers of the seed management server 144, the authentication server 146, and the authentication message management server 148. In other embodiments, the seed management server 144, the authentication server 146, and the verification message management server 148 can also communicate freely through the intranet.

The seed management server 144 is configured to issue a seed to the first client and perform management of the seed of the authentication server.

The authentication server 146 is configured to verify the identity of the second client that needs to log in to the first client.

The verification message management server 148 is configured to manage the verification message sent by the first client.

A communication connection can be established between the above various servers through a communication network. The network can be either a wireless network or a wired network.

Please refer to FIG. 3, which is a flowchart of an identity binding method provided by an embodiment of the present invention. This method can be applied to the implementation environment shown in FIG. The method (ie, the identity binding process) can include the following steps.

Step 301: The second client issues a binding instruction to the first client in response to the user operation.

Specifically, please refer to FIG. 4, which shows the user interface of the second client in the identity binding process. The user clicks the “Add Now” button, and the second client issues a binding instruction to the first client. Specifically, the second client may issue a binding instruction to the first client by acquiring a uniform resource locator of the first client.

Step 302: The first client acquires an account of the user in response to the binding instruction.

Specifically, in an implementation manner, the user account may be applied to the first client in advance by the user, and in step 302, the user inputs a pre-applied account to the first client, where the first client You can get the user's account.

In addition, in another implementation manner, before the identity binding process starts, the first client is requested to apply for an account and a corresponding password is set; the first client performs relevant legality verification on the account and the password; After the verification is passed, the first client records the correspondence between the account and the password, and prompts the user to enter the identity binding process by using an interface display or a voice prompt, and directly obtains the user's account in step 302.

In step 303, the first client obtains the first verification seed.

Please refer to FIG. 5, which shows a flow chart of a method for obtaining a first verification seed. The method includes:

Step 3031: Acquire an unused seed set, and the unused seeds are all from an authentication server.

The first client obtains a batch of seeds from the verification server in advance, and manages the acquired seeds. Specifically, the seed is sent by the verification server to the first client through a secure channel.

If the seed forms a binding relationship (correspondence relationship) with other users' accounts after being acquired, the seed is a used seed, and if the seed does not form a binding relationship (correspondence relationship) with any account after being acquired, The seed is an unused seed. All unused seeds constitute an unused seed collection.

Step 3032: Select one seed in the unused seed set as the first verification seed.

The first client may select one of the unused seeds as the first verification seed according to a preset seed selection algorithm, or randomly select one of the unused seed sets as the first verification seed.

Step 304: The first client generates a verification seed, where the verification seed is a seed corresponding to the first verification seed and obtainable by the second client.

Specifically, the first client generates the same seed as the first verification seed and uses the seed as a verification seed.

The method of making the verification seed obtained by the second client includes, but is not limited to, the following method:

(1) The first client directly sends the verification seed to the second client;

(2) The first client generates a first verification barcode according to the verification seed. The first verification barcode is a two-dimensional code or barcode that can be scanned by the second client. In Figure 4, by scanning the two-dimensional code (the first verification barcode) The verification seed is taken and the token is obtained in step 305, which is a dynamic password.

(3) The first client generates a first verification barcode according to the verification seed and other optional information. The first verification barcode is a two-dimensional code or barcode that can be scanned by the second client.

The optional information may be a user account and/or a verification seed generation time.

Further, in (2) (3), the first verification barcode may be generated in an encrypted manner according to a preset encryption algorithm, and correspondingly, the second verification is performed by the second client by using a preset decryption algorithm. The barcode is decrypted.

Step 305: The second client obtains a verification seed, generates a token according to the verification seed, and enables the token to be acquired by the first client.

The seed obtained by the second client is the verification seed, and generates a token according to a preset token generation algorithm and the seed.

The method of making the token obtained by the first client includes, but is not limited to, the following method:

(1) The second client directly sends the token to the first client;

(2) The second client generates a binding verification code according to the token. The binding verification code is a two-dimensional code or barcode that can be scanned by the first client.

(3) The user holding the second client inputs the content of the token to the first client.

Step 306: The first client sends the first verification seed and the token to the verification server.

In step 307, the verification server obtains the verification result.

Specifically, the verification server may verify, according to a preset token verification algorithm, whether the first verification seed has a legal correspondence with the token, thereby obtaining a verification result. The token verification algorithm and the token generation algorithm are related algorithms, and can be obtained by the verification server and the second client through negotiation.

Step 308, the verification server sends the verification result to the first client.

Step 309: The first client determines whether the verification is passed. If the verification succeeds, the first client stores the first verification seed, and the corresponding relationship between the first verification seed and the second client.

Specifically, if the verification is passed, the seed obtained by the second client in step 305 is the verification seed generated by the first client. Specifically, the seed obtained by the second client is the same as the first verification seed.

The second client stores the obtained seed corresponding to the first verification seed, and the obtained seed is the second verification seed. Further, corresponding to the case of (2) (3) of step 304, in order to facilitate the second client to store the obtained seed, the second client may further verify whether the acquired first verification barcode contains a user account. If yes, the correspondence between the user account and the obtained seed (ie, the correspondence between the first client and the seed) is stored after the identity binding is successful; if not, the user is allowed to The resulting seeds are named and the correspondence between the nomenclature and the obtained seeds is stored. Please refer to FIG. 6, which shows a schematic diagram named by the user for the obtained seed, and the binding number is the obtained seed.

Specifically, if the verification is passed, the first client may also notify the user that the identity binding process is successfully executed by using an interface display or a voice output.

The embodiment of the invention provides a method for performing identity binding before the identity verification, and the method enables the first client to obtain the binding relationship between the legal user and the seed, which is a prerequisite for subsequent use of the token for identity verification. , The identity binding method has no limitation on the first client, and therefore can be adapted to provide an identity binding service for multiple first clients.

Further, the seed provided by the embodiment of the present invention may be any positive integer. Correspondingly, refer to FIG. 7, which illustrates a token generation algorithm, which is provided by a second client side according to an embodiment of the present invention. The token generation algorithm can include:

In step S1, a seed for generating a token is obtained.

In step S2, the local current system time is obtained.

In step S3, the token is obtained according to a preset hash algorithm.

Specifically, the time parameter corresponding to the current system time may be obtained according to the current system time. For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;

For example, if there is a time parameter every 30s, it is necessary to first determine whether the current system time reading in the second unit is greater than 30, and then divide the time parameter according to the judgment result, and use 30s as a time parameter, corresponding to the dynamic password of the same seed. It will change every 30s.

Specifically, the seed and the time parameter are actual parameters of the hash algorithm. Specifically, the token in the embodiment of the present invention is composed of six digits.

Correspondingly, please refer to FIG. 8 , which illustrates a token verification algorithm. The server side token verification algorithm provided by the embodiment of the present invention may include:

Step S110: Acquire a seed to be verified and a token to be verified.

Step S120: Acquire a local current system time.

Step S130, obtaining a target token according to a preset hash algorithm.

Specifically, the seed and the time parameter are actual parameters of the hash algorithm. The hash algorithm is the same as the hash algorithm in step S3.

Step S140, determining whether the target token is the same as the token to be verified.

In step S150, if yes, the verification is passed.

The target token is the same as the token to be verified, and the seed to be verified is the same as the seed that generates the token to be verified, that is, the seed to be verified has a legal correspondence with the token to be verified. Relationship, therefore, verification passed.

Step S160, if no, the verification fails.

The above token generation algorithm and token verification algorithm both depend on the current system time of the hardware executing the algorithm, because Therefore, the above token verification algorithm has a small probability that the verification result may be unreliable. Taking 60s as a time parameter as an example, if the value of the second unit of the current system time of the token obtained by the second client in S3 is 59, and the obtained token is transmitted to the verification server for 2 seconds, then When the verification server verifies the token, the second unit of the current system time of the verification server is 01, and the time parameter obtained when the S130 is executed by the second client is inconsistent, which inevitably causes the verification to fail. This verification failure is only caused by the time problem and has nothing to do with the seed. It can be seen that the verification result is unreliable. In this case, the verification can only be re-verified, thus wasting the processing resources of the client and the server.

In order to improve the reliability of the verification result, please refer to FIG. 9 , which illustrates another token verification algorithm. Another server-side token verification algorithm provided by the embodiment of the present invention includes:

Step S210: Acquire a seed to be verified and a token to be verified.

Step S220: Acquire a local current system time.

Step S230, obtaining a first target token and a second target token according to a preset hash algorithm.

Specifically, the first target token is obtained by using the seed and the time parameter as actual parameters of the hash algorithm, and the last time parameter of the seed and the time parameter is used as the actual of the hash algorithm. The parameter gets the second target token. The hash algorithm is the same as the hash algorithm in step S3.

Step S240, determining whether the first target token is the same as the token to be verified.

In step S250, if yes, the verification is passed.

Step S260, if no, determining whether the second target token is the same as the token to be verified.

In step S270, if yes, the verification is passed.

Step S280, if no, the verification fails.

This token verification algorithm can largely avoid the situation where the verification result is unreliable, thereby avoiding waste of processing resources of the client and the server caused by re-authentication.

Further, since the token generation algorithm on the second client side and the token verification algorithm on the verification server side depend on the current system time of the hardware executing the algorithm, in order to further improve the reliability of the verification result, the verification may be performed according to the verification. The current system time of the server performs time verification on the second client to avoid unreliable verification results due to the synchronization between the current system time of the verification server and the current system time of the second client. Specifically, there are four types of correction methods:

(1) The verification server actively pushes the first time to the second client periodically or irregularly, and the first time is the current system time when the verification server is pushed.

(2) The verification server actively pushes the first time to the first client periodically or irregularly, the first time is Verifying the current system time of the server at the time of push; then the first time is actively pushed by the first client to the second client.

(3) in the process of interacting with the authentication server by the first client, the verification server sends the first time to the first client, where the first time is the current system time when the verification server is transmitting; and then at the first client During the interaction with the second client, the first time is actively sent by the first client to the second client.

(3) During the interaction between the second client and the verification server, the verification server sends the first time to the second client, where the first time is the current system time when the verification server is transmitting.

Specifically, please refer to FIG. 10, which illustrates a time correction method of the second client, including:

Step T1: acquiring a first time from the verification server; the first time is a current system time of the verification server;

Step T2: acquiring a local second time; the second time is a current local system time at the moment of acquiring the first time;

Step T3, calculating a difference between the first time and the second time;

In step T4, the difference is stored.

Correspondingly, in step S3, a time correction value is first obtained from the current system time acquired in step S2 and the difference value stored in step T4, and then the time parameter is obtained from the time correction value.

The embodiment of the invention provides a time correction method, which can prevent the verification result from being unreliable due to the unsynchronization between the current system time of the verification server and the current system time of the second client, thereby further improving the reliability of the verification result and avoiding The waste of processing resources of the client and server caused by the verification.

Of course, the token generation algorithm and the token verification algorithm used in the embodiments of the present invention have other forms. As long as the token generation algorithm and the token verification algorithm have a fixed correspondence, the token can be used to complete the legal relationship between the seed and the token. The verification can be done, and will not be described here.

Based on the token generation algorithm and the token verification algorithm having the corresponding relationship, the embodiment provides an identity verification method based on the successful execution of the identity binding process.

Specifically, the authentication method may be implemented by using a token, a swipe, or a one-click login. The authentication method has no limitation on the first client and the second client, and therefore, may be in multiple In an application scenario, the identity of the user is verified before a sensitive operation such as a payment class. It can also be used to verify the identity of the user before modifying the password. The user information is lost and the identity of the user is verified when the application is reported to the first client. Further, the authentication method can also be applied to one or more first clients.

A method for implementing authentication by inputting a token, please refer to FIG. 11, which illustrates an authentication method, including:

Step 401: The first client acquires an account in response to the identity verification instruction.

Specifically, the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie. Referring to FIG. 12, the first client also shows the user an interface for inputting a token. In FIG. 12, the first client is used as a security center, and can be used to input a token generated by the second verification seed corresponding to the security center.

Further, in order to improve the security of the authentication, before the account is obtained, the first client may also be based on the self. The user data is stored to verify the identity of the user, that is, the account verification is performed to verify the legality of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present invention can be used in combination with other identity verification methods.

Step 402: The first client queries, according to the account, a first verification seed corresponding to the account.

Specifically, in the identity binding process, the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.

Step 403: The second client generates a token according to the second verification seed and enables the token to be obtained by the first client.

Specifically, the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token.

In order to enable the generated token to be obtained by the first client, in this embodiment, the user inputs the token to the first client, and the input page is FIG. 12 .

In another embodiment, a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed. Please refer to FIG. 13, which shows an interface for a user to select a token. It can be seen from FIG. 13 that the second client in the binding process can store multiple correspondences, that is, the correspondence between the seed and the first client corresponding to the seed, and the first seed is taken as an example, which corresponds to the webpage mailbox, and is generated. The token is 787246; for example, the second seed corresponds to the security center, and the generated token is 896332. After the user selects the token and presses the OK button, the token can be sent to the first client.

Step 404: The first client obtains the token and transmits the first verification seed and the token to an authentication server.

In step 405, the verification server obtains the verification result.

Specifically, the verification server may verify, according to the token verification algorithm, whether the first verification seed has a legal correspondence with the token, thereby obtaining a verification result. The token verification algorithm of the server and the second client token generation algorithm have an algorithm corresponding to the algorithm, and may be obtained by the verification server and the second client through negotiation.

Step 406: The verification server sends the verification result to the first client.

Step 407: The first client determines whether the verification is passed, and if the verification passes, the identity verification passes.

Specifically, if the verification is passed, the second verification seed stored by the second client in step 403 is the same as the first verification seed corresponding to the account of the user in the first client.

In step 408, if the verification fails, the identity verification fails.

The identity verification method provided by the embodiment of the present invention can be applied to multiple applications, and each application (the first client) does not affect each other, thereby solving the problem that if the user uses multiple applications at the same time in the prior art, the binding needs to be multiple. Security center, cumbersome operation. In addition, the verification server does not store the correspondence between the account in the first client and the first verification seed, and is only responsible for generating the seed and verifying the correspondence between the seed and the token, so that the application is not involved. Sensitive data of a client) fully guarantees the data security of the first client. The authentication server provides an authentication service for the first client without requiring the first client to disclose its data privacy to the authentication server.

Please refer to FIG. 14, which illustrates another authentication method, including:

Step 501: The first client acquires an account in response to the identity verification instruction.

Specifically, the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.

Further, in order to improve the security of the identity verification, before the account is obtained, the first client may also verify the identity of the user according to the stored user data, that is, perform account verification to verify the validity of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present invention can be used in combination with other identity verification methods.

Step 502: The first client queries, according to the account, a first verification seed corresponding to the account.

Step 503: The first client generates a verification message according to the account.

Specifically, the verification message may include a verification message generation time and the account number. For example, the content of the verification message may be “XXX time, XXX account performs XXX operation, please confirm whether it is operated by itself”.

Step 504: The first client sends the first verification seed and the verification message to the verification server.

Step 505: The verification server acquires the first verification seed and the verification message, and generates a corresponding message number.

Specifically, in this embodiment, the server also needs to maintain the verification message, such as adding, inserting, and deleting the verification message.

Specifically, the verification server stores the first verification seed and the verification message, and generates a message number according to a preset message number generation algorithm, where the message number corresponds to the verification message, and the message number There is also a one-to-one correspondence with the first verification seed. Specifically, the message number generation algorithm may be generated in the order of receiving the verification message, or may be generated according to the time when the verification message is received, or may be based on the time and verification of receiving the verification message. The sender identifier of the message (the identifier of the first client, which carries the identifier during communication with the authentication server) is generated.

Step 506: The verification server sends the message number to the first client.

Step 507: The first client acquires the message number and enables the second client to obtain the message number.

Specifically, in the swipe authentication method, please refer to FIG. 15, which shows a generation page of the second verification barcode. The first client generates a second verification barcode according to the message number, and the second client obtains a message number by scanning and parsing the second verification barcode, and the second verification barcode may be a two-dimensional code or a barcode.

In addition, in other embodiments, the message number may also be directly sent by the first client to the second client.

Step 508: The second client acquires the verification message corresponding to the message number from the verification server according to the message number.

Specifically, the verification message is displayed by the second client, please refer to FIG. 16, which shows the second client. The interface that displays the verification message. If the user is the person and wants to continue the authentication, click "I am operating", that is, send a confirmation command to the second client; otherwise, click "reject", then the second client directly informs the verification server that the authentication process ends. Correspondingly, the authentication server notifies the first client that the authentication failed, and the authentication process ends.

Step 509: The second client generates a token according to the second verification seed in response to the confirmation instruction, and transmits the token and the message number to the verification server.

Specifically, the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token. In another embodiment, a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.

In step 510, the verification server obtains the verification result.

Specifically, the verification server queries the first verification seed according to the message number obtained from the second client, and verifies whether the first verification seed has a legal correspondence relationship with the token according to the token verification algorithm, thereby obtaining a verification result. . The token verification algorithm of the server and the token generation algorithm of the second client are algorithms corresponding to each other, and may be obtained by the verification server and the second client through negotiation.

Step 511: The verification server sends the verification result to the first client.

In step 512, the first client determines whether the verification is passed, and if the verification passes, the identity verification passes.

Specifically, if the verification is passed, the second verification seed stored by the second client in step 509 is the same as the first verification seed corresponding to the account of the user in the first client.

In step 513, if the verification fails, the identity verification fails.

This embodiment provides another authentication method different from the method of inputting a token, which enriches the authentication method and avoids the user manually inputting the token, which makes the identity verification more convenient.

Please refer to FIG. 17, which illustrates another authentication method, including:

Step 601: The first client acquires an account in response to the identity verification instruction.

Step 602: The first client queries, according to the account, a first verification seed corresponding to the account.

Step 603: The first client generates a verification message according to the account.

Step 604: The first client sends the first verification seed and the verification message to the verification server, and requests a server push operation from the verification server.

Step 605: The verification server acquires the first verification seed and the verification message, and generates a corresponding message number.

Step 606: The verification server pushes the message number and the verification message to the second client in response to the request of the server push operation.

Specifically, a hypertext transfer protocol (HTTP) long connection secure channel is established between the verification server and the second client, and the message number and the verification message are actively pushed by using a server push technology. To the second client.

Step 607: The second client acquires the message number and the verification message.

Specifically, the verification message is displayed by the second client, please refer to FIG. 16, which shows an interface of the second client displaying the verification message. If the user is the person and wants to continue the authentication, click "I am operating", that is, send a confirmation command to the second client; otherwise, click "reject", then the second client directly informs the verification server that the authentication process ends. Correspondingly, the authentication server notifies the first client that the authentication failed, and the authentication process ends.

Step 608: The second client generates a token according to the second verification seed in response to the confirmation instruction, and transmits the token and the message number to the verification server.

In step 609, the verification server obtains the verification result.

Specifically, the verification server queries the first verification seed according to the message number obtained from the second client, and verifies whether the first verification seed has a legal correspondence relationship with the token according to the token verification algorithm, thereby obtaining a verification result. . The algorithm that the server token verification algorithm and the second client token generation algorithm have a corresponding relationship may be obtained by the verification server and the second client through negotiation.

Step 610: The verification server sends the verification result to the first client.

In step 611, the first client determines whether the verification is passed, and if the verification passes, the identity verification passes.

Specifically, if the verification is passed, the second verification seed stored by the second client in step 608 is the same as the first verification seed corresponding to the account of the user in the first client.

In step 612, if the verification fails, the identity verification fails.

This embodiment provides another authentication method. Specifically, the identity verification method provided in this embodiment is a one-key login verification method, that is, the user only needs to send a confirmation instruction to the second client, and does not need to perform other operations. The method in this embodiment is more convenient.

In the identity verification method provided by the embodiment of the present invention, if the user uses the mobile phone to perform the function of the second client, after the mobile phone is lost, the user may apply to the first client to use the new mobile phone for identity binding or verification, as long as the new one The mobile phone can perform the functions of the second client. It can be seen that the identity binding method and the identity verification method provided by the embodiments of the present invention have the advantages of being not affected by the loss of the mobile phone and having low operation cost compared with the currently used secret security mobile phone authentication method; Compared with other common authentication methods, it has the significant advantages of high safety factor, low cost and wide application range.

The following is an embodiment of the apparatus of the present invention, which can be used to carry out the method embodiments of the present invention. For details not disclosed in the embodiment of the device of the present invention, please refer to the method embodiment of the present invention.

Please refer to FIG. 18, which shows a block diagram of an identity verification apparatus, which can implement the functions of the first client in the above method example, and the functions can be implemented by hardware or by corresponding software implementation by hardware. The device can include:

The account obtaining module 701 is configured to obtain an account. Steps 302, 401, 501, and 601 can be performed to perform the method embodiments.

The first verification seed query module 702 is configured to query, according to the account, a first verification seed corresponding to the account. It can be used to perform steps 402, 502, and 602 of the method embodiments.

The verification message generating module 703 is configured to generate an authentication message according to the account. It can be used to perform steps 503 and 603 of the method embodiment.

The verification message sending module 704 is configured to send the first verification seed and the verification message to the verification server. It can be used to perform steps 504 and 604 of the method embodiment.

The verification result obtaining module 705 is configured to obtain the verification result. It can be used to perform steps 308, 406, 511, and 610 of the method embodiments.

Further, please refer to FIG. 19, which shows a block diagram of related modules included in the apparatus for performing a binding process:

The first verification seed obtaining module 706 is configured to obtain a first verification seed. It can be used to perform step 303 of the method embodiment.

The seed generation module 707 is configured to generate a seed corresponding to the first verification seed. It can be used to perform step 304 of the method embodiment.

The token obtaining module 708 is configured to acquire a token generated by the second client. Steps that can be used to perform method embodiments Steps 305 and 403.

The combination sending module 709 is configured to send the first verification seed and the token to the verification server. It can be used to perform steps 306 and 404 of the method embodiment.

The first verification seed storage module 710 is configured to: after the verification result obtaining module 705 obtains the verification result, if the verification is passed, storing the first verification seed, and the corresponding relationship between the first verification seed and the second client. It can be used to perform step 309 of the method embodiment.

The token acquisition module 708 and the combined transmission module 709 can also be used in the identity verification process.

Further, the device may further include:

a seed sending module, configured to send the seed to the second client. It can be used to perform step 305 of the method embodiment.

Further, the device may further include:

The first verification barcode generating module is configured to generate a first verification barcode according to the seed. It can be used to perform step 305 of the method embodiment.

Further, the device may further include:

The message number obtaining module is configured to obtain a message number corresponding to the verification message sent by the verification server. It can be used to perform step 506 of the method embodiment.

Further, the device may further include:

A message number sending module, configured to send the message number. It can be used to perform step 507 of the method embodiment.

Further, the device may further include:

The second verification barcode generating module is configured to generate a second verification barcode according to the message number. It can be used to perform step 507 of the method embodiment.

Further, the device may further include:

A request module for requesting a server push operation from an authentication server. It can be used to perform step 604 of the method embodiment.

Further, the first verification seed obtaining module 706 includes:

a collection obtaining unit, configured to acquire an unused seed set, where the unused seeds are all from an authentication server;

And a selecting unit, configured to randomly select one seed in the unused seed set as the first verification seed.

Please refer to FIG. 20, which illustrates an identity verification apparatus, which may be used to implement the functions of the second client in the above method example, and the functions may be implemented by hardware, or may be implemented by hardware. The device can include:

The message obtaining module 801 is configured to obtain a message number and a verification message. It can be used to perform steps 507, 508, and 607 of the method embodiments.

The display module 802 is configured to display a verification message.

The user instruction monitoring module 803 is configured to detect a user instruction, and the user instruction includes a confirmation instruction.

The second verification seed obtaining module 804 is configured to obtain a second verification seed. It can be used to perform steps 403, 509 and 608 of the method embodiment.

The token generation module 805 is configured to generate a token. It can be used to perform steps 305, 403, 509 and 608 of the method embodiment.

The transmission module 806 is configured to transmit the message number and the token to the verification server. It can be used to perform steps 509 and 608 of the method embodiment.

Further, the device may further include:

Verify the seed acquisition module to get the verification seed. It can be used to perform step 305 of the method embodiment.

And a second verification seed storage module, configured to store the second verification seed. It can be used to perform step 309 of the method embodiment.

Further, the device may further include:

And a combined storage module, configured to store a correspondence between the second verification seed and the first client. It can be used to perform step 309 of the method embodiment.

Please refer to FIG. 21, which shows a block diagram of a token generation module, which includes:

The time parameter obtaining unit 8051 is configured to obtain a time parameter according to the current system time. It can be used to perform steps S2 and S3 of the method embodiment.

The token calculation unit 8052 is configured to calculate a token according to a preset hash algorithm. It can be used to perform step S3 of the method embodiment.

Further, please refer to FIG. 22, which shows a block diagram of a module related to time correction, including:

The first time obtaining module 811 is configured to acquire the first time from the verification server. It can be used to perform step T1 of the method embodiment.

The second time acquisition module 812 is configured to acquire the local second time. It can be used to perform step T2 of the method embodiment.

The difference calculation module 813 is configured to calculate a difference between the first time and the second time. It can be used to perform step T3 of the method embodiment.

The difference storage module 814 is configured to store the difference. It can be used to perform step T4 of the method embodiment.

Correspondingly, the time parameter obtaining unit 8051 includes:

The time correction value calculation module is configured to calculate a time correction value according to the current system time and the difference.

The time parameter acquisition module is configured to obtain a time parameter according to the time correction value.

Further, the message obtaining module 801 may further include:

a message number obtaining unit, configured to obtain a message number from the first client;

And a verification message obtaining unit, configured to acquire the verification message from the verification server according to the message number.

Further, the message number obtaining unit may further include:

a second verification barcode acquisition module, configured to acquire a second verification barcode;

And a parsing module, configured to parse the second verification barcode to obtain a message number.

Further, the message obtaining module 801 may further include:

A direct acquisition unit for directly acquiring a message number and a verification message pushed by the verification server.

An exemplary embodiment of the present invention further provides an identity verification system. As shown in FIG. 25, the system includes a first client 901, a second client 902, and an authentication server 903.

The first client 901 obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server. 903: Obtain a message number from the verification server 903;

The second client 902 obtains the message number from the first client 901; acquires a verification message corresponding to the message number from the verification server 903 according to the message number; in response to the confirmation instruction to the verification message, Generating a token according to the second verification seed, and transmitting the token and the message number to the verification server 903;

The verification server 903 queries the first verification seed according to the message number obtained from the second client 902; obtains a verification result by verifying whether the first verification seed has a legal correspondence relationship with the token, and sends the verification result To the first client 901;

The first client 901 acquires a verification result from the verification server 903.

Specifically, the first client 901 and the second client 902 may be the identity verification device described above.

As shown in FIG. 25, an exemplary embodiment of the present invention further provides an identity verification system, where the system includes a first client 901, a second client 902, and an authentication server 903;

The first client 901 obtains an account in response to the identity verification instruction; queries the first verification seed corresponding to the account according to the account; obtains a token generated by the second client 902; and the first verification seed and the The token is transmitted to the verification server 903 and the verification result is obtained;

The second client 902 generates a token according to the second verification seed and enables the token to be obtained by the first client 901;

The verification server 903 obtains the verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first client 901.

The first client 901 obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server. 903, and requesting a server push operation from the verification server 903;

The verification server 903 generates a message number corresponding to the first verification seed and the verification message, and pushes the message number and the verification message to the second client 902;

The second client 902 generates a token according to the second verification seed in response to the confirmation instruction of the verification message, and transmits the token and the message number to the verification server 903;

It should be noted that, when the device and the system provided by the foregoing embodiments are implemented, only the division of the foregoing functional modules is illustrated. In actual applications, the function distribution may be completed by different functional modules as needed. The internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the foregoing embodiments are in the same concept, and the specific implementation process is described in detail in the method embodiment, and details are not described herein again.

Please refer to FIG. 23, which is a schematic structural diagram of a terminal according to an embodiment of the present invention. The terminal is configured to implement the functions of the first client or the second client in the identity verification method provided in the foregoing embodiment.

The terminal may include an RF (Radio Frequency) circuit 110, a memory 121 including one or more computer readable storage media, an input unit 130, a display unit 142, a sensor 150, an audio circuit 163, and a WiFi (wireless fidelity, The Wireless Fidelity module 170 includes a processor 180 having one or more processing cores, and a power supply 190 and the like. It will be understood by those skilled in the art that the terminal structure shown in FIG. 23 does not constitute a limitation to the terminal, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements. among them:

The RF circuit 110 can be used for transmitting and receiving information or during a call, and receiving and transmitting signals. Specifically, after receiving downlink information of the base station, the downlink information is processed by one or more processors 180. In addition, the data related to the uplink is sent to the base station. . Generally, the RF circuit 110 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier). , duplexer, etc. In addition, RF circuitry 110 can also communicate with the network and other devices via wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.

The memory 121 can be used to store software programs and modules, and the processor 180 executes various functional applications and data processing by running software programs and modules stored in the memory 121. The memory 121 may mainly include a storage program area and an storage data area, wherein the storage program area may store an operating system, an application required for the function, and the like; the storage data area may store data or the like created according to the use of the terminal. Further, the memory 121 may include a high speed random access memory, and may also include a nonvolatile memory such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, the memory 121 may also include a memory controller to provide access to the memory 121 by the processor 180 and the input unit 130.

The input unit 130 can be configured to receive input numeric or character information and to generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls. In particular, input unit 130 can include touch-sensitive surface 131 as well as other input devices 132. Touch-sensitive surface 131, also referred to as a touch display or trackpad, can collect touch operations on or near the user (such as a user using a finger, stylus, etc., on any suitable object or accessory on touch-sensitive surface 131 or The operation near the touch-sensitive surface 131) and driving the corresponding connecting device according to a preset program. Alternatively, the touch-sensitive surface 131 can include two portions of a touch detection device and a touch controller. Wherein, the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information. The processor 180 is provided and can receive commands from the processor 180 and execute them. In addition, resistive, capacitive, infrared, and Various types such as surface acoustic waves implement the touch-sensitive surface 131. In addition to the touch-sensitive surface 131, the input unit 130 can also include other input devices 132. Specifically, other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.

Display unit 142 can be used to display information entered by the user or information provided to the user as well as various graphical user interfaces of the terminal, which can be composed of graphics, text, icons, video, and any combination thereof. The display unit 142 may include a display panel 141. Alternatively, the display panel 141 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like. Further, the touch-sensitive surface 131 may cover the display panel 141, and when the touch-sensitive surface 131 detects a touch operation thereon or nearby, it is transmitted to the processor 180 to determine the type of the touch event, and then the processor 180 according to the touch event The type provides a corresponding visual output on display panel 141. Although in FIG. 23, touch-sensitive surface 131 and display panel 141 are implemented as two separate components to implement input and input functions, in some embodiments, touch-sensitive surface 131 can be integrated with display panel 141 for input. And output function.

The terminal may also include at least one type of sensor 150, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 141 according to the brightness of the ambient light, and the proximity sensor may close the display panel 141 when the terminal moves to the ear. And / or backlight. As a kind of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity. It can be used to identify the attitude of the terminal (such as horizontal and vertical screen switching, related Game, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for the terminal can also be configured with gyroscopes, barometers, hygrometers, thermometers, infrared sensors and other sensors, here No longer.

An audio circuit 163, a speaker 161, and a microphone 162 can provide an audio interface between the user and the terminal. The audio circuit 163 can transmit the converted electrical data of the received audio data to the speaker 161, and convert it into a sound signal output by the speaker 161; on the other hand, the microphone 162 converts the collected sound signal into an electrical signal, and the audio circuit 163 After receiving, it is converted into audio data, and then processed by the audio data output processor 180, transmitted to the terminal, for example, via the RF circuit 110, or outputted to the memory 121 for further processing. The audio circuit 163 may also include an earbud jack to provide communication of the peripheral earphones with the terminal.

WiFi is a short-range wireless transmission technology, and the terminal can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 170, which provides wireless broadband Internet access for users. Although FIG. 23 shows the WiFi module 170, it can be understood that it does not belong to the essential configuration of the terminal, and may be omitted as needed within the scope of not changing the essence of the invention.

The processor 180 is a control center of the terminal, which connects various parts of the entire terminal using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 121, and calling data stored in the memory 121. Performing various functions and processing data of the terminal to perform overall monitoring on the terminal. Optionally, the processor 180 may include one or more processing cores; preferably, the processor 180 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like. The modem processor primarily handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 180.

The terminal further includes a power source 190 (such as a battery) for supplying power to each component. Preferably, the power source can be logically connected to the processor 180 through the power management system to manage functions such as charging, discharging, and power management through the power management system. . Power supply 190 may also include any one or more of a DC or AC power source, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.

Although not shown, the terminal may further include a camera, a Bluetooth module, and the like, and details are not described herein again. Specifically, in this embodiment, the display unit of the terminal is a touch screen display, the terminal further includes a memory, and one or more programs, wherein one or more programs are stored in the memory and configured to be processed by one or more The program executes one or more programs that include instructions for executing the authentication method of the first client or the second client described above.

Please refer to FIG. 24, which is a schematic structural diagram of a server according to an embodiment of the present invention. The server is used to implement the authentication method of the server provided in the above embodiment. Specifically:

The server 1200 includes a central processing unit (CPU) 1201, a system memory 1204 including a random access memory (RAM) 1202 and a read only memory (ROM) 1203, and a system bus 1205 that connects the system memory 1204 and the central processing unit 1201. The server 1200 also includes a basic input/output system (I/O system) 1206 that facilitates transfer of information between various devices within the computer, and mass storage for storing the operating system 1213, applications 1214, and other program modules 1215. Device 1207.

The basic input/output system 1206 includes a display 1208 for displaying information and an input device 1209 such as a mouse, keyboard, etc. for user input of information. The display 1208 and the input device 1209 are both connected to the central processing unit 1201 via an input-output controller 1210 that is coupled to the system bus 1205. The basic input/output system 1206 can also include an input output controller 1210 for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus. Similarly, input-output controller 1210 also provides output to a display screen, printer, or other type of output device.

The mass storage device 1207 is connected to the central processing unit 1201 by a mass storage controller (not shown) connected to the system bus 1205. The mass storage device 1207 and its associated computer readable medium provide non-volatile storage for the server 1200. That is, the mass storage device 1207 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.

Without loss of generality, the computer readable medium can include computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that the computer storage medium is not limited to the above. The system memory 1204 and the mass storage device 1207 described above may be collectively referred to as a memory.

According to various embodiments of the present invention, the server 1200 may also be operated by a remote computer connected to the network through a network such as the Internet. That is, the server 1200 can be connected to the network 1212 through the network interface unit 1211 connected to the system bus 1205, or can also be connected to other types using the network interface unit 1211. Network or remote computer system (not shown).

The memory also includes one or more programs, the one or more programs being stored in a memory and configured to be executed by one or more processors. The one or more programs described above include instructions for executing the method of the server described above.

In an exemplary embodiment, there is also provided a non-transitory computer readable storage medium comprising instructions, such as a memory comprising instructions executable by a processor of a terminal to perform various steps in the above method embodiments, or The above instructions are executed by the processor of the server to complete the steps of the background server side in the above method embodiment. For example, the non-transitory computer readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.

The embodiments of the present invention can be combined with the existing identity verification methods by using the identity verification method, apparatus, and system provided by the embodiments of the present invention. The user can first pass the identity verification of the first client and generate a token by using the second client that is held by the user. After the token is verified by the token of the verification server, the identity verification can be formally passed, compared to the ordinary identity. Verification, higher security. The authentication server can provide a service for authenticating the user token for multiple first clients, and its function is equivalent to the security center. If the user uses multiple applications, it is no longer necessary to bind multiple security centers, thereby simplifying user operations.

It should be understood that "a plurality" as referred to herein means two or more. "and/or", describing the association relationship of the associated objects, indicating that there may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately. The character "/" generally indicates that the contextual object is an "or" relationship.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

A person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium. The storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

An authentication method, the method comprising:

The first terminal obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server; The verification server obtains the message number;

The second terminal obtains the message number from the first terminal; acquires a verification message corresponding to the message number from the verification server according to the message number; and responds to the confirmation instruction of the verification message, according to the second verification seed Generating a token and transmitting the token and the message number to the verification server;

The verification server queries the first verification seed according to the message number obtained from the second terminal; obtains a verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first terminal;

The first terminal acquires a verification result from the verification server.
The method of claim 1, wherein before the first terminal is responsive to the authentication command, the method further comprises:

The first terminal acquires an account in response to the binding instruction; obtains a first verification seed; generates a verification seed corresponding to the first verification seed and enables the verification seed to be obtained by the second terminal; and obtains a token generated by the second terminal; Transmitting the first verification seed and the token to the verification server, and obtaining a verification result; if the verification is passed, storing a correspondence between the account and the first verification seed;

The second terminal generates a token according to the obtained seed and enables the token to be obtained by the first terminal;

The verification server obtains a verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first terminal.
The method of claim 1, wherein the second terminal further comprises:

If the verification is passed, the verification seed is stored, and the corresponding relationship between the verification seed and the first terminal is stored.
The method according to claim 3, wherein the verification server obtains the verification result by verifying whether the first verification seed has a legal correspondence with the token, including:

Generating a target token according to the token generation method and the first verification seed;

Determining whether the target token and the token are the same token;

If yes, the verification result is the verification pass; otherwise, the verification result is that the verification fails.
The method according to claim 3, wherein the verification server obtains the verification result by verifying whether the first verification seed has a legal correspondence with the token, including:

Generating a first target token and a second target token according to the token generation method and the first verification seed;

Determining whether the first target token and the token are the same token;

If yes, the verification result is verification pass; otherwise, determining whether the second target token and the token are the same token;

If yes, the verification result is the verification pass; otherwise, the verification result is that the verification fails.
An authentication method is applied to a first terminal, and the method includes:

Acquiring an account in response to the authentication command;

Querying, according to the account, a first verification seed corresponding to the account;

Generating a verification message according to the account number;

Sending the first verification seed and the verification message to an authentication server;

Obtaining a message number from the verification server and enabling the second terminal to acquire the message number;

Obtaining a verification result from the verification server; the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token; the token is generated by the second terminal according to the second verification seed.
The method of claim 6 further comprising: before said responding to the authentication command;

Acquiring an account in response to the binding instruction;

Obtaining a first verification seed;

Generating a verification seed corresponding to the first verification seed and enabling the verification seed to be obtained by the second terminal;

Obtaining a token generated by the second terminal;

Sending the first verification seed and the token to the verification server;

Obtaining a verification result; the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token;

If the verification is passed, storing the first verification seed and the correspondence between the first verification seed and the second terminal.
The method of claim 6, wherein the verification message comprises a verification message generation time and the account number.
The method according to claim 6, wherein after the obtaining the message number from the verification server, the method further comprises:

Generating a second verification barcode according to the message number.
An authentication method is applied to a second terminal, and the method includes:

Obtaining a message number from the first terminal;

Acquiring, according to the message number, a verification message corresponding to the message number from the verification server;

Displaying the verification message and monitoring a user instruction, the user instruction including a confirmation instruction;

And in response to the confirmation instruction, acquiring a second verification seed and generating a token according to the second verification seed;

Transmitting the message number and the token to an authentication server to enable the first terminal to obtain a verification result from the verification server.
The method according to claim 10, wherein before the obtaining the message number and the verification message, the method further comprises:

Obtain a verification seed;

Generating a token based on the verification seed and enabling the token to be obtained by the first terminal.
The method of claim 11 wherein

If the verification is passed, the verification seed is stored, and the corresponding relationship between the verification seed and the first terminal is stored.
The method of claim 10 wherein said obtaining a message number from said first terminal comprises:

Obtaining a second verification barcode generated by the first terminal according to the message number;

Parsing the second verification barcode to obtain a message number.
An authentication device, the device comprising one or more processors and one or more non-volatile storage media, the one or more non-volatile storage media storing one or more computer readable instructions, Configuring by the one or more processors to implement the following steps:

Acquiring an account in response to the authentication command;

Querying, according to the account, a first verification seed corresponding to the account;

Generating a verification message according to the account number;

Sending the first verification seed and the verification message to an authentication server;

Obtaining a message number from the verification server and enabling the second terminal to acquire the message number;

Obtaining a verification result from the verification server; the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token; the token is generated by the second terminal according to the second verification seed.
The apparatus of claim 14, wherein the one or more processors execute the one or more computer readable instructions to further implement the steps of:

Acquiring an account in response to the binding instruction;

Obtaining a first verification seed;

Generating a verification seed corresponding to the first verification seed and enabling the verification seed to be obtained by the second terminal;

Obtaining a token generated by the second terminal;

Sending the first verification seed and the token to the verification server;

Obtaining a verification result; the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token;

And if the verification is passed, storing the first verification seed, and the corresponding relationship between the first verification seed and the second terminal.
The apparatus of claim 14, wherein the one or more processors execute the one or more computer readable instructions to further implement the steps of:

Generating a second verification barcode according to the message number.
An authentication device, the device comprising one or more processors and one or more non-volatile storage media, the one or more non-volatile storage media storing one or more computer readable instructions, Configuring by the one or more processors to implement the following steps:

Obtaining a message number from the first terminal;

Acquiring, according to the message number, a verification message corresponding to the message number from the verification server;

Displaying the verification message;

Detecting a user instruction, the user instruction including a confirmation instruction;

Acquiring a second verification seed in response to the confirmation instruction;

Generating a token according to the second verification seed;

Transmitting the message number and the token to an authentication server to enable the first terminal to obtain the verification service Verification result of the server.
The apparatus of claim 17, wherein the one or more processors execute the one or more computer readable instructions to further implement the steps of:

Obtain a verification seed;

Store the second verification seed.
The apparatus of claim 17, wherein the one or more processors execute the one or more computer readable instructions to further implement the steps of:

Obtaining a second verification barcode generated by the first terminal according to the message number;

Parsing the second verification barcode to obtain a message number.
An identity verification system, characterized in that the system comprises a first terminal, a second terminal and an authentication server;

The first terminal comprises the apparatus of any one of claims 14-16;

The second terminal comprises the apparatus of any of claims 17-19.
A non-transitory computer readable storage medium storing computer readable instructions capable of causing at least one processor to perform the method of any of claims 1-13.