WO2018141219A1 - 认证服务器、认证系统及方法 - Google Patents

认证服务器、认证系统及方法 Download PDF

Info

Publication number
WO2018141219A1
WO2018141219A1 PCT/CN2018/073888 CN2018073888W WO2018141219A1 WO 2018141219 A1 WO2018141219 A1 WO 2018141219A1 CN 2018073888 W CN2018073888 W CN 2018073888W WO 2018141219 A1 WO2018141219 A1 WO 2018141219A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
server
merchant
user
mobile phone
Prior art date
Application number
PCT/CN2018/073888
Other languages
English (en)
French (fr)
Inventor
陈大昭
Original Assignee
陈大昭
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to EP18747294.9A priority Critical patent/EP3579495A4/en
Application filed by 陈大昭 filed Critical 陈大昭
Priority to RU2019102051A priority patent/RU2019102051A/ru
Priority to KR1020197006962A priority patent/KR20190111006A/ko
Priority to CN201880000120.8A priority patent/CN108702297A/zh
Priority to SG11201900393UA priority patent/SG11201900393UA/en
Priority to CA3029871A priority patent/CA3029871C/en
Priority to JP2018569162A priority patent/JP2020507823A/ja
Priority to AU2018214492A priority patent/AU2018214492A1/en
Priority to US15/952,231 priority patent/US10230721B2/en
Publication of WO2018141219A1 publication Critical patent/WO2018141219A1/zh
Priority to HK18115626.0A priority patent/HK1256555A1/zh
Priority to IL265408A priority patent/IL265408A/en
Priority to PH12019500743A priority patent/PH12019500743A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3215—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a plurality of channels

Definitions

  • the present invention relates to identity authentication technologies, and in particular, to an authentication server, an authentication system, and a method.
  • SMS authentication has security problems that are easily intercepted by Trojans.
  • Biometric authentication has personal privacy, is not secret (easy to copy), and cannot be converted if biometrics are lost. If it is combined with other authentication methods, it will also be used by users. Poor experience.
  • many authentication technologies or methods require the cooperation of users. Without the verification of independent third parties, the true and false users cannot be 100% certain. At the same time, they need to solve how to avoid the abuse of authentication mechanism by merchants. Stealing user privacy, how to avoid problems such as Trojans, man-in-the-middle attacks, viruses or mobile terminal software cracks on mobile terminals or devices, security and personal privacy issues have always existed.
  • the present invention provides an authentication server, comprising: a data acquisition module: configured to obtain telecommunications user data from a telecommunications server based on an end user mobile phone number, and obtain merchant user data from a merchant server; and an identity authentication module: configured to The authentication mode compares the telecommunications user profile with the merchant profile and returns a comparison result to the merchant server.
  • a data acquisition module configured to obtain telecommunications user data from a telecommunications server based on an end user mobile phone number, and obtain merchant user data from a merchant server
  • an identity authentication module configured to The authentication mode compares the telecommunications user profile with the merchant profile and returns a comparison result to the merchant server.
  • the authentication mode includes: a full mobile phone number authentication mode, a half mobile phone number authentication mode, a full mobile phone number, a full user data authentication mode, and a half mobile phone number and a half user data authentication mode.
  • the present invention also provides an authentication system, comprising: a telecommunications server, an authentication server, and a merchant server, wherein the telecommunications server is configured to provide telecommunications user data to the authentication server based on the end user mobile phone number, and the merchant server is used for the terminal based a user mobile phone number to the authentication server provider user profile, the authentication server, configured to: obtain the telecommunication user profile obtained from the telecommunication server and the merchant user profile obtained from the merchant server according to a predetermined authentication mode The comparison is made and the comparison result is returned to the merchant server.
  • the telecommunications server is configured to provide telecommunications user data to the authentication server based on the end user mobile phone number
  • the merchant server is used for the terminal based a user mobile phone number to the authentication server provider user profile
  • the authentication server configured to: obtain the telecommunication user profile obtained from the telecommunication server and the merchant user profile obtained from the merchant server according to a predetermined authentication mode The comparison is made and the comparison result is returned to the merchant server.
  • the authentication mode includes: a full mobile phone number authentication mode, a half mobile phone number authentication mode, a full mobile phone number, a full user data authentication mode, and a half mobile phone number and a half user data authentication mode.
  • the merchant server continues to perform the comparison of the complete mobile phone number and the user data.
  • the telecommunication server provides the telecommunication user data to the authentication server by adding the user data to the webpage, or the authentication server acquires the user profile from the telecommunication server according to the user's IP or IP+Port information.
  • the invention also provides an authentication method, comprising: the merchant server provides the user data of the authentication server provider based on the mobile phone number of the terminal user; the telecommunication server provides the telecommunication user profile to the authentication server based on the mobile phone number of the terminal user; The authentication mode compares the telecommunication user profile obtained from the telecommunications server with the merchant user profile obtained from the merchant server, and returns a comparison result to the merchant server.
  • the authentication mode includes: a full mobile phone number authentication mode, a half mobile phone number authentication mode, a full mobile phone number, a full user data authentication mode, and a half mobile phone number and a half user data authentication mode.
  • the merchant server continues to perform the comparison of the complete mobile phone number and the user data.
  • the process of the authentication method includes: the merchant server generates a code request code including a merchant abbreviation, a terminal user mobile phone number, a time stamp, and a random code, and transmits a code request code and a corresponding merchant according to the authentication mode.
  • the user data is sent to the authentication server; after the authentication server confirms the identity and rights of the merchant, a case code including the authentication short name, the merchant identification code, the time stamp, and the random code is generated, and a unified resource locator including the encrypted case code is formed and the case is included
  • the data of the coding, the uniform resource locator and the remaining usage rights are sent to the merchant server; the merchant server transfers the uniform resource locator to the user terminal; and the telecommunication server provides the corresponding telecommunication user data according to the request of the user terminal based on the uniform resource locator
  • the authentication server based on the encrypted case code obtained from the uniform resource locator, after the decryption verification is successfully completed, the telecommunication user data and the merchant user data are compared, and the comparison result is transmitted to the merchant server; the merchant Server obtained After the results of the server's ratio, the authentication processing according to the corresponding mode.
  • the authentication method provided by the invention can obtain better security protection, fast authentication, better user experience, and avoid the security problem of repeated short message interception.
  • FIG. 1 is a schematic diagram of system interaction of identity authentication according to an embodiment of the present invention.
  • FIGS. 2A-F are flow chart diagrams of identity authentication according to an embodiment of the present invention.
  • the present invention provides an identity authentication system based on a telecommunications service provider and a mobile network. In the entire authentication process, it is usually based on four-party interaction, including a user terminal (end user) 10, and a telecommunications server (telecom service provider). 20, a merchant server (APP or web content provider) 30, and an authentication server (authentication service provider) 40.
  • the user terminal 10 may be various computing devices including a processor and a memory used by the terminal user, such as a desktop computer, a notebook computer, a tablet computer, a smart phone (mobile terminal), etc., which can run various operating systems. For example, windows system, iOS system, Android system, and so on.
  • the difference between the telecommunication server 20, the merchant server 30, and the authentication server 40 is mainly in that they belong to different users, and there is basically no substantial difference in hardware structure.
  • Servers typically include processors with powerful processing power, as well as memory arrays with massive storage capabilities, and typically store data for managing their registered users in the form of a database.
  • each of the above three servers can be further subdivided based on its execution function. It should be understood that such subdivision is a logical subdivision; from the physical entity, different execution functions may be performed by one server on the physical entity or by multiple different servers on the physical entity.
  • a merchant server it can be functionally distinguished as a code request server, an identity authentication server, a code result acquisition server, etc., but on an object entity, these servers can be one server or multiple servers. .
  • the authentication server it can be functionally divided into a telecom user data acquisition server, a mobile network identity direct authentication server, etc., which can also be one or more servers on the physical entity.
  • the authentication server may include a data acquisition module and an identity authentication module.
  • the data acquisition module is configured to obtain the telecommunications user data from the telecommunications server and obtain the merchant user data from the merchant server, respectively, based on the mobile phone number of the end user.
  • the identity authentication module is configured to compare the telecommunications user profile with the merchant profile according to a predetermined authentication mode, and return a comparison result to the merchant server.
  • the functions of the data acquisition module and the identity authentication module may be implemented by the same processor or by different processors.
  • Such a processor may be a DSP (Digital Signal Processor), an FPGA (Field-Programmable Gate Array), or the like.
  • DSP Digital Signal Processor
  • FPGA Field-Programmable Gate Array
  • the above-mentioned telecommunications user data and merchant user data are only distinguished by their source, that is, the user data provided by the telecommunications company and the user data provided by the merchant. In fact, based on the same end user (the same mobile phone number), the condition for successful authentication is that the information of the telecommunications user information and the merchant user data, such as the mobile phone number, name, gender, ID number, etc., should be consistent.
  • the four-way interactive communication link can be implemented by using various well-known communication interconnection technologies as needed.
  • a telecommunications network such as GSM/3G/4G can be arranged based on the telecommunications service provider. mobile network.
  • the user terminal can communicate with the merchant server by using an Internet or a WiFi, etc., in an APP or webpage manner.
  • the Internet or a dedicated line (for example, a fiber) channel configured by the authentication service provider for the merchant, or a VPN (Virtual Private Network) can be used for communication.
  • the Internet can also be used for communication.
  • the present invention mainly utilizes the mobile phone number of the end user as the authentication object.
  • the mobile phone number is usually provided by the telecommunications service provider. Therefore, in the authentication process of the present invention, the participation of the telecommunications service provider is involved.
  • These telecommunications service providers include operators such as China Telecom, China Mobile, China Unicom, etc., which provide telecommunications services to users.
  • the authentication of the present invention mainly authenticates the service authority of the user in each merchant, and therefore involves the participation of the merchant.
  • These merchants include, for example, merchants such as Bank of China that provide banking services to users.
  • the core of the authentication of the present invention is to implement the authentication service by a separate authentication service provider. Based on the above, referring to FIG. 1, in the authentication process of the present invention, the process of the four-party interaction mainly includes:
  • the authentication starts, and the terminal user first uses the APP/WEB method to send the mobile phone number to the merchant server through the user terminal through the Internet.
  • the merchant server provides the corresponding merchant user data (which may be encrypted by non-encryption or protocol encryption) according to the mobile phone number of the terminal user, and the registration login data of the authentication server to the authentication server.
  • the authentication server After obtaining the relevant information, the authentication server returns a URL (Uniform Resource Locator) pointing to the server location to the merchant server, and the URL specifically points to the telecommunications user data acquisition server in the authentication server, which includes one time.
  • URL Uniform Resource Locator
  • Sexual token token
  • the merchant server transfers it to the user terminal.
  • the user terminal can use the JQuery or Ajax method to run the background to obtain the URL content (returned "authentication completion" information).
  • the user terminal needs to use a webview-like function to display the URL content for the user to confirm the authentication work.
  • the telecommunications provider According to the agreement with the telecommunications company at the location or domain name of the URL (ie, the location of the authentication server), the telecommunications provider transmits the user's data to the authentication server by adding it to the webpage.
  • the telecommunication server may provide the telecommunication user data to the authentication server by means of non-encryption or protocol encryption and adding the user data to the webpage, or the authentication server may be based on the user's IP or IP+Port (port). ) Information, requesting user information from the telecommunications company.
  • the authentication server can compare the telecommunication user data obtained from the telecommunication server with the merchant user data obtained from the merchant server.
  • the authentication server can perform corresponding comparison. For example, when using authentication mode A (see below), the authentication server can compare each item and return the comparison result to the merchant server.
  • the comparison results include, for example, each match, non-match, or failure to provide (for example, the authentication server is not authorized to obtain certain materials and cannot be obtained and cannot be provided). If the user confirmation mode is used, the user needs to be confirmed before the result is provided to the merchant server.
  • the merchant server can notify the authentication server that the comparison result has been received.
  • the authentication server returns the "authentication completed" information to the client webpage or APP.
  • the authentication server returns the "authentication complete” information to the telecommunications server.
  • the telecommunication server continues to transmit it back to the user terminal, and the information can be displayed on the APP/WEB on the user terminal, indicating that the authentication process has been completed.
  • the user terminal may request the query result from the merchant server (you may request the query result from the merchant server at intervals after the start of step 5 to facilitate the use of the authentication method of the user confirmation mode) to perform appropriate actions.
  • the authentication server can only compare part of the user's data. Based on the comparison result of the authentication server, the merchant server checks the other user data by itself.
  • the identity authentication method based on the telecommunication service provider and the mobile network provided by the embodiment of the present invention includes:
  • step (101) The certification process begins. Subsequently, the process can continue from step (101) or continue from step (102).
  • the user inputs the user application software APP or the web page WEB on the user terminal to include the user's mobile phone number MSISDN (Mobile Subscriber International ISDN number) and the like to log in or register. Then, the process proceeds to step (103).
  • MSISDN Mobile Subscriber International ISDN number
  • step (104) When the personal data such as the mobile phone number of the terminal user is known, the application software APP of the user terminal or the web page WEB starts the authentication process. Then, the process proceeds to step (104).
  • the merchant's code request server or module (as described above, which is part of the merchant server) transmits the corresponding data to one of the following modes via http or https, or by using a secure channel such as a private line or a VPN.
  • Mobile network identity direct authentication server (as mentioned earlier, it is part of the authentication server). Then, the process proceeds to step (110).
  • Mode A Full mobile phone number authentication mode
  • Mode B Half phone number authentication mode
  • This mode is directly authenticated by the mobile network identity server to verify the part of the mobile phone number MSISDN (ie half mobile phone number). After the half-cell number is checked correctly, all the mobile phone numbers (non-encrypted or according to the protocol encryption method) provided by the telecom operator will be returned to the merchant, and then checked by the merchant.
  • the advantage is to prevent abuse and the merchant can judge the result by himself.
  • the basic description of this mode is as follows:
  • Mode C Full mobile phone number, full user identity data authentication mode
  • Mode D half mobile phone number, half user identity data authentication mode
  • This mode is verified by the mobile network identity direct authentication server to check part of the mobile phone number MSISDN and part of the ID number. If some mobile phone numbers and part of the ID number are checked correctly, all the end user information (including the complete mobile phone number and identity) will be provided by the telecommunication provider.
  • the certificate number, name, gender and date of birth, etc. are returned to the merchant by non-encryption or according to the protocol encryption method, and then checked by the merchant.
  • the advantage is to prevent abuse and the merchant can judge the result by himself.
  • the basic description of this mode is as follows:
  • the mobile network identity direct authentication server checks the login name and password sent by the merchant's code request server, and the fixed IP address of the server that the merchant pre-registers the code request server. Then, the process proceeds to step (111).
  • step (111) Check the login name and password of the merchant. If there is an error, proceed to step (115); otherwise, proceed to step (112).
  • step (115) checking the Internet Protocol Address of the merchant server, if there is an error, proceed to step (115); otherwise, proceed to step (113);
  • step (113) Check if there is still a quota or use right, if not, go to step (115); otherwise, go to step (120); the mobile network identity direct authentication server can allocate usage rights or use quotas for the merchant, for example, the merchant can enjoy Permanent authentication service authority, or the merchant only enjoys a certain number of authentication services, etc.; (115) The mobile network identity direct authentication server returns a warning message to the merchant's code request server and the email EMail or SMS SMS notifies the merchant's agent/company ( If so, the process ends.
  • the mobile network identity direct authentication server checks the identity of the merchant, obtains the identification code of the merchant from the database, and starts to generate a case code that is never repeated and cannot be guessed according to the following formula:
  • the mobile network identity direct authentication server encrypts the case code and selects the location of the most suitable or least used telecommunications subscriber data acquisition server (as described above, which is part of the authentication server) to form a special URL containing There is an encrypted case code. Then, the process proceeds to step (122).
  • the mobile network identity direct authentication server returns the following basic information to the merchant's code request server:
  • the merchant's code requesting server further transfers the special URL webpage address including the encrypted one-time case code to the application software or webpage of the mobile terminal device of the target end user, and if the authentication mode is selected, the terminal user is not required.
  • the end user can use the AJAX or jQuery-like library to run the background to obtain the URL content, and proceed to step (124). If the selection in the authentication mode requires the terminal user to confirm the authentication, proceed to step (200);
  • the terminal user program uses the similar technology of WEBVIEW to display the content of the URL, and simultaneously opens in the background to query the merchant server for a period of time, such as 1 second, if yes, then proceeds to step (163);
  • the display requires the user to use the telecommunication mobile network or use another terminal with SIM to confirm and continue working. If the retry button is pressed, the process returns to step (201), and if the terminal with the external SIM is selected to confirm the authentication work, enter ( 210); if the cancellation is selected, proceed to step (204);
  • the display requires the user to follow different methods (drag, CAPTCHA, etc.) to confirm the next work and can simultaneously authorize the telecommunications company and the merchant to give the information to the authentication platform for identity verification. If the user confirms, go to step (130) If the user does not confirm, proceed to step (204);
  • step (136) (204) setting the value of the MSISDN to 333, indicating that the user does not agree to perform authentication, and proceeds to step (136); (210) displays different data transmission methods such as (two-dimensional code, NFC, etc.) selection, and selecting one of them.
  • the mobile terminal scan code program, NFC (Near Field Communication) receiving program, etc., convert the URL to the mobile terminal, and then display the content of the URL by using an APP or a webpage program, if the mobile terminal The network is supported, and steps 130 to 162 are repeated;
  • step (124) determining that the information has an opportunity to connect to the Internet via the telecommunications mobile network; if not, proceeding to step (125); if yes, proceeding to step (130).
  • step (136) If the telecommunication mobile network is not used, the value of the MSISDN is NULL, the telecommunication provider identification code is NULL, and then the process proceeds to step (136);
  • the telecommunications server will provide encrypted or unencrypted single end user data (MSISDN) or multiple end user data (MSISDN, name, gender and part ID number, etc.) To the telecommunications user data acquisition server; if it is encrypted, it will provide additional encrypted mobile phone number MSISDN to facilitate mode B and D authentication.
  • MSISDN single end user data
  • MSISDN multiple end user data
  • the methods provided include:
  • Method 2 Query the end user's data to other telecommunications servers using an Internet Protocol Address or an Internet Protocol Address + Port;
  • the telecommunications user data acquisition server will decrypt according to the protocol method of different telecommunications providers; if the protocol method is to use HASHING encryption, there is no need to decrypt, and the HASHING value is compared; Go to step (132).
  • step (132) checking whether the end user data is encrypted, if yes, proceeding to step (133); otherwise, proceeding to step (136);
  • step (133) checking whether the end user data is HASHING, if yes, proceeding to step (136); if not, proceeding to step (134);
  • step (134) checking whether the end user data is successfully decrypted, if successful, proceeds to step (136); if not, proceeds to step (135);
  • the email notification system administrator currently has an error in the decryption method provided by the telecommunications provider corresponding to the end user data, and the value of the MSISDN is set to NULL, and the telecom identifier is NULL. Then, the process proceeds to step (136).
  • the telecommunications user data acquisition server obtains a one-time encrypted case code from a special URL, and then decrypts to restore the case code, the purpose of which is to test whether it is its own code and reduce external interference or impact on the system; Go to step (140).
  • step (140) Checking whether the case code decryption is successful, if not, proceeding to step (141); if successful, proceeding to step (144).
  • step (141) checking whether the value of the MSISDN is NULL, according to the check result: if yes, proceeding to step (142), if not, proceeding to step (143);
  • the telecom user data acquisition server will transmit the end user data, the case code and the telecom identification name to the mobile network identity direct authentication server for the code/control work; then, enter the step ( 145).
  • the mobile network identity direct authentication server checks whether the completion or obsolescence is based on the case code; then, proceeds to step (150).
  • step (161) Check if the case is completed, and if yes, skip to step (161); otherwise, go to step (151).
  • step (152) checking whether the case is out of date, and if so, skipping to step (157); otherwise, proceeding to step (152);
  • the mobile network identity direct authentication server obtains the authentication mode according to the case code, whether the encryption process, the merchant's identification code, the code registration result server location, the code request code, and the terminal to be compared User profile, etc.; then, proceed to step (153).
  • the mobile network identity direct authentication server first checks the MSISDN value; then, proceeds to step (154).
  • step (155) Whether the value of the MSISDN is NULL or 333, and if so, proceeds to step (155); otherwise, proceeds to step (156).
  • the result of the comparison (for example, if the value of the MSISDN is NULL, the result is "not available", or the value of the MSISDN is 333, the result is "user disagrees"), and the code request code, case code, etc.
  • the data is transmitted to the location of the registration result acquisition server (as described above, which is part of the merchant server) when the merchant registers, and proceeds to step (160);
  • step (160) Compare each item of the end user's data with each item, "match” or “not match” and the data category into a list or list, and whether the authentication mode, encryption processing, code request encoding, case coding, etc. If the data is transmitted to the merchant, the result of the code acquisition server obtains the location of the server. If the authentication mode is B, and some mobile phone numbers are correct, all the mobile phone numbers of the terminal users provided by the telecommunication provider (non-encrypted or protocol encryption method) will be added. Go to the list or list. According to the demand, the other data of the end user can be HASHING, and then added to the list or list, and the process proceeds to step (160);
  • the merchant's code matching result obtaining server or module obtains the result of directly authenticating the server from the mobile network identity, and starts to generate a code that is not repeated and cannot be guessed according to its own preference or according to the following formula:
  • Network identity direct authentication server :
  • the mobile network identity direct authentication server obtains the code acquisition code sent by the merchant, confirms that the merchant has a stub, confirms that the result information has been received, and returns the code "complete" information to the telecommunications user data acquisition server; Go to step (162).
  • the telecommunications subscriber data acquisition server then transmits the "complete" information to the application software or web page of the mobile terminal of the user of the merchant; subsequently, proceeds to step (163).
  • the application software or webpage of the mobile terminal of the merchant's user sends a query result to their identity authentication server (if the user confirmation option is used, the content of the webpage needs to be displayed, that is, the query result is to be issued at intervals, because When the unknown user confirms), if it is the authentication mode A or C, and then provide the user with the appropriate service or information according to the result of the direct authentication server from the mobile network identity, such as all "match” allows the user to log in, register or enter the next step; If a piece of information "does not match", the user is required to check, and then provide the correct user information, such as: mobile phone number MSISDN or name, etc.; "not available” requires or waits for the user to use the telecommunication network, and then re-verify; Disagree” then prompts the user to confirm according to the indication; "request for obsolete code” to restart the program; if mode B, can "match” part of the mobile phone number, the merchant can check the mobile phone from the mobile network identity direct
  • the authentication system or platform implemented by the present invention is characterized in that: the important information is that the data and the result of the code to be communicated between the background server and the server are avoided, and the Trojan of the mobile terminal, the attack of the middleman, the virus or the client software are cracked. And it leads to the problem of forging results.
  • telecommunications data gateway authentication technology you can get better security protection, fast authentication, better user experience and security issues to avoid duplicate SMS interception.
  • the telecommunications provider does not know what end user data the merchant wants to control, thus ensuring the reliability of the information provided by the telecommunications provider.
  • both parties use HASHING or other encryption methods to encrypt the user data and then let the platform compare, even if the platform is hacked, it will not constitute a problem of leaking the terminal user data.
  • the authentication mode B or D is selected, the merchant does not need to fully disclose the end user information to the authentication platform. On the one hand, the credibility of the authentication platform can be improved. On the other hand, the merchant can judge the result by itself and achieve double insurance, and the authentication platform will not Abuse of abuse can maximize the privacy of end users.
  • the authentication method can select to display the URL content in the user terminal, let the terminal user know that the authentication and the button allow the next work, increase the verification of one more weight, avoid the URL being hijacked by the hacker (HACKER), and can choose to use other
  • the SIM terminal device performs mobile identity authentication and increases the flexibility of authentication, especially in devices without a SIM, such as a PC, a PAD, and the like.
  • the method and platform make the mobile terminal credible and unique, so even the use of a simple password does not pose a risk of being stolen by a Trojan, a middleman or a virus.
  • the method and platform can solve the problem of "you are you” and “who are you (KYC know your customer)", which can be well applied to the field of mobile communications. Its advantages are:
  • the telecommunications data can be directly provided to the merchant, but there is a risk that the telecommunications data may not be 100% reliable.
  • the user since the user will use more than one mobile terminal SIM card, the user does not necessarily know that the mobile phone number is used for registration. Therefore, using the code matching method, it can determine what information the user wants to provide to open an account or register, and the telecommunication data can be used as a check for user data. Eliminate unnecessary misuse or incorrect information provided by users.
  • we often log in to some services forget to log out, and leave, especially in some public places or after using a personal computer or non-mobile terminal, which will cause some security concerns.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明公开了一种认证服务器、认证系统和认证方法。所述认证服务器包括资料获取模块和身份认证模块。所述资料获取模块用于基于终端用户手机号码，分别从电讯服务器获得电讯用户资料，以及从商户服务器获得商户用户资料；所述身份认证模块用于根据预定认证模式，将所述电讯用户资料与所述商户资料进行比对，并向所述商户服务器返回比对结果。本发明的认证方式，能获得更佳的安全保护，认证快速，具有更好的用户体验，并能避免重复短信被截取的安全问题。

Description

认证服务器、认证系统及方法 技术领域
本发明涉及身份认证技术，尤其的，涉及一种认证服务器，认证系统及方法。
背景技术
在现今生活中，人们享受着使用智能、移动或物联网(Internet of Things，loT)等装置，例如：移动电话，智能手表及穿戴装置的各项服务和应用软件时带来的便利。然而这些服务同时也产生挥之不去的安全和个人隐私问题，这些问题包括：1)人们在使用各种装置时的安全意识薄弱而导致个人信息泄露，2)目的在于截取大众的登入信息的林林总总的木马或病毒，无声无色及无孔不入地攻击人们的各种装置，去偷取大众的财富。此外，许多装置的应用软件Apps都在用户不知情下收集用户信息和隐私。
尽管存在一些身份认证技术来保护用户信息安全，然而现在的身份认证技术，如：短信认证，生物认证等等都存在先天缺憾。短信认证存在容易受木马截取的安全问题，生物认证有个人隐私，不隐密(易复制)及若生物特征遗失就不能转换的问题，若将其与其他认证方式合并使用，又给用户造成使用体验不佳的问题。归根究底是许多的身份认证技术或方法，都需要用户的配合，在没有独立第三方的验证，用户的真与假就无法得到百分百确定，同时还需解决如何避免商户滥用认证机制去盗取用户隐私，如何避开在移动终端或装置的木马，中间人攻击，病毒或移动终端软件遭破解的影响等问题，故安全和个人隐私问题一直存在。
发明内容
本发明提供了一种认证服务器，包括：资料获取模块：用于基于终端用 户手机号码，分别从电讯服务器获得电讯用户资料，以及从商户服务器获得商户用户资料；以及身份认证模块：用于根据预定认证模式，将所述电讯用户资料与所述商户资料进行比对，并向所述商户服务器返回比对结果。
在一种实施方式中，所述认证模式包括：全手机号认证模式，半手机号认证模式，全手机号、全用户资料认证模式，以及半手机号、半用户资料认证模式。
本发明还提供了一种认证系统，包括：电讯服务器、认证服务器以及商户服务器，所述电讯服务器用于基于终端用户手机号码向所述认证服务器提供电讯用户资料，所述商户服务器用于基于终端用户手机号码向所述认证服务器提供商户用户资料，所述认证服务器用于根据预定认证模式，将从所述电讯服务器获得的所述电讯用户资料与从所述商户服务器获得的所述商户用户资料进行比对，并向所述商户服务器返回比对结果。
在一种实施方式中，所述认证模式包括：全手机号认证模式，半手机号认证模式，全手机号、全用户资料认证模式，以及半手机号、半用户资料认证模式。
在一种实施方式中，在半手机号认证模式或半手机号、半用户资料认证模式中，所述商户服务器继续进行完整手机号码及用户资料的比对。
在一种实施方式中，所述电讯服务器采用将用户资料加入到网页的方式，将电讯用户资料提供给认证服务器，或者，认证服务器根据用户的IP或IP+Port信息向电讯服务器获取用户资料。
本发明也提供了一种认证方法，包括：商户服务器基于终端用户手机号码向认证服务器提供商户用户资料；电讯服务器基于终端用户手机号码向所述认证服务器提供电讯用户资料；所述认证服务器根据预定认证模式，将从所述电讯服务器获得的所述电讯用户资料与从所述商户服务器获得的所述商户用户资料进行比对，并向所述商户服务器返回比对结果。
在一种实施方式中，所述认证模式包括：全手机号认证模式，半手机号认证模式，全手机号、全用户资料认证模式，以及半手机号、半用户资料认证 模式。
在一种实施方式中，在半手机号认证模式或半手机号、半用户资料认证模式中，所述商户服务器继续进行完整手机号码及用户资料的比对。
在一种实施方式中，所述认证方法的流程包括：商户服务器产生包含商户简称、终端用户手机号码、时间戳和随机码的对码请求编码，根据认证模式传送对码请求编码和相应的商户用户资料到认证服务器；认证服务器确认商户身份及权限后，产生包含认证简称、商户识别编码、时间戳和随机码的案件编码，并形成包含加密后的案件编码的统一资源定位器并将包含案件编码、统一资源定位器及剩余使用权的资料发送给商户服务器；商户服务器将统一资源定位器转给用户终端；电讯服务器根据用户终端基于统一资源定位器的请求，将相应的电讯用户资料提供到认证服务器；认证服务器基于从统一资源定位器中获得的加密后的案件编码，在解密核查成功完成后，对电讯用户资料和商户用户资料进行比对，并将比对结果传给商户服务器；商户服务器获得认证服务器的比对结果后，根据认证模式进行相应处理。
本发明提供的认证方式，能获得更佳的安全保护，认证快速，具有更好的用户体验，并能避免重复短信被截取的安全问题。
附图说明
在下文中，基于各个示例性实施方式的示意图更详细地阐述本发明。
图1是本发明实施例的身份认证的系统交互示意图。
图2A-F是本发明实施例的身份认证流程图。
具体实施方式
下文结合附图对本发明实施例的认证服务器、认证系统及认证方法做详细说明。
参见图1，本发明提供了一种基于电讯服务商和移动网络的身份认证系统，在整个认证过程中，通常基于四方的交互，包括用户终端(终端用户)10，电讯服务器(电讯服务商)20，商户服务器(APP或网页内容提供商)30，以及 认证服务器(认证服务商)40。其中，用户终端10可以是终端用户所使用的各种包括处理器和存储器的计算装置，例如台式电脑、笔记本电脑、平板电脑、智能手机(移动终端)等等，这些装置可以运行各种操作系统，例如windows系统、iOS系统、安卓系统等等。电讯服务器20，商户服务器30，以及认证服务器40的区别主要在于分别隶属于不同的使用者，其在硬件结构方面基本上没有实质区别。服务器通常包括具有强大处理能力的处理器，以及具有海量存储能力的存储器阵列，并通常以数据库形式存储管理其注册用户的资料。此外，上述三个服务器的每一个，基于其执行功能，也可做进一步细分。需要理解，这样的细分，是逻辑上的细分；从物理实体上，不同的执行功能，可以由物理实体上的一台服务器执行，也可以由物理实体上的多台不同的服务器执行。例如，对于商户服务器，其可以从功能上区分为对码请求服务器，身份认证服务器，对码结果获取服务器等等，但在物体实体上，这些服务器可以是一台服务器，也可以是多台服务器。类似的，对于认证服务器，其可以从功能上区分为电讯用户资料获取服务器、移动网络身份直接认证服务器等等，其在物理实体上同样可以是一台或者多台服务器。或者，认证服务器可以包括资料获取模块和身份认证模块。其中，资料获取模块用于基于终端用户手机号码，分别从电讯服务器获得电讯用户资料，以及从商户服务器获得商户用户资料。身份认证模块用于根据预定认证模式，将所述电讯用户资料与所述商户资料进行比对，并向所述商户服务器返回比对结果。资料获取模块和身份认证模块的功能可以由同一处理器实现，或者不同处理器分别实现。这样的处理器，可以是DSP(Digital Signal Processor，数字信号处理器)、FPGA(Field-Programmable Gate Array，可编程逻辑阵列)等等。需要理解的是，上文中的电讯用户资料及商户用户资料仅是以其来源区分，即指二者分别是由电讯商提供的用户资料和商户提供的用户资料。实际上，基于来自于同一终端用户(同一手机号码)，成功认证的条件在于，电讯用户资料和商户用户资料在内容上，例如手机号码、姓名、性别、身份证号等信息应当是一致的。
四方交互的通信链路，可以根据需要，利用熟知的各种通信互联技术实 施，例如，在用户终端与电讯服务器之间，可以基于电讯服务商布置的电讯网络，如GSM/3G/4G等等移动网络。在用户终端与商户服务器之间，可以利用互联网或者WiFi等，以APP或网页方式，而使用户终端与商户服务器进行通信。在商户服务器与认证服务器之间，例如可以利用互联网，或者认证服务商为商户配置的专线(例如光纤)通道，或VPN(Virtual Private Network，虚拟专用网)进行通信。在电讯服务器与认证服务器之间，同样可以利用互联网进行通信。
本发明主要利用终端用户的手机号码作为认证对象，众所周知，手机号码通常由电讯服务商提供，因此，在本发明的认证过程中，涉及电讯服务商的参与。这些电讯服务商例如包括中国电信、中国移动、中国联通等等为用户提供电讯服务的运营商。此外，本发明的认证主要是对用户在各个商户的服务权限进行认证，故涉及商户的参与。这些商户例如包括中国银行这样的为用户提供银行服务的商户。最后，本发明的认证核心在于将认证服务交由单独的认证服务商实施。基于上述，参见图1，本发明的认证过程中，四方交互的过程主要包括：
1)用户提供手机号码或启动认证程序
在本步骤中，认证开始，终端用户首先通过其用户终端透过互联网，利用APP/WEB方式将手机号码给到商户服务器。
2)提供商户的终端用户的资料和登入资料
在本步骤中，商户服务器根据终端用户手机号码，提供相应的商户用户资料(可以用非加密或协议加密方式)，以及自身在认证服务器的注册登入资料给认证服务器。
3)返回指向认证服务器的位置的URL
在本步骤中，认证服务器在得到相关资料后，向商户服务器返回指向其服务器位置的URL(Uniform Resource Locator，统一资源定位器)，URL具体指向认证服务器中的电讯用户资料获取服务器，其中包含一次性的Token(令牌)。
4)将URL资料转给用户端
在本步骤中，在得到URL资料后，商户服务器将其转给用户终端。
5)获取URL内容或展现URL内容给用户确认
在本步骤中，若不需要用户确认，基于所得到的URL资料，用户终端可以使用类似JQuery或者Ajax等方法后台运行来获取URL内容(返回的“认证完成”信息)。但若需要用户确认，用户终端需要使用类似webview功能，展现URL内容，以供用户确认进行认证工作。
6)根据与电讯商的协议在这条URL的位置或域名(即认证服务器位置)，电讯商将用户的资料以加入网页内的方式，传到认证服务器
在本步骤中，电讯服务器可以以非加密或协议加密方式，并采用将用户资料加入到网页的方式，将电讯用户资料提供给认证服务器，或者，认证服务器根据用户的IP或IP+Port(端口)信息，向电讯商索取用户资料。
7)对比电讯商和商户提供的资料，将对比结果提供到商户服务器
在本步骤中，认证服务器可以对比从电讯服务器得到的电讯用户资料和从商户服务器得到的商户用户资料。根据不同认证模式，认证服务器可以进行相应的比对。例如当使用认证模式A(参见下文)时，认证服务器可以比对每项资料，并将比对结果返回给商户服务器。比对结果例如包括：每项吻合、不吻合，或者无法提供(例如认证服务器未得到某些资料的授权而无法获取从而无法提供)等等。若使用用户确认模式，则需要得到用户确认，才会将结果提供到商户服务器。
8)通知已收到结果
在本步骤中，商户服务器可以向认证服务器通知已经收到比对结果。
9)认证服务器回传“认证完成”信息给用户端网页或APP
在本步骤中，认证服务器将“认证完成”信息回传给电讯服务器。电讯服务器将其继续回传给用户终端，可以在用户终端上的APP/WEB上显示该信息，说明认证过程已完成。
10)向服务器查询结果，再作出适当行动
在本步骤中，用户终端可以向商户服务器请求查询结果(可以在步骤5开始后，每隔一段时间就向商户服务器请求查询结果，方便使用用户确认模式的 认证方法)，以此作出适当行动。在一些认证模式中，例如认证模式B(参见下文)中，认证服务器只能比对用户的部分资料。商户服务器在认证服务器的比对结果基础上，自行对其他的用户资料进行核对。
具体的，参见图2A-2F，本发明实施例提供的基于电讯服务商和移动网络的身份认证方法包括：
(100)认证流程开始。随后，流程可以从步骤(101)继续，或者，从步骤(102)继续。
(101)用户在其用户终端上的商户应用软件APP或网页WEB输入包括有用户的手机号码MSISDN(Mobile Subscriber International ISDN number)等资料去登入或登记。随后，进入步骤(103)。
(102)当已知终端用户的手机号码等个人资料，用户端的应用软件APP或网页WEB启动认证程序。随后，进入步骤(104)。
(103)商户的身份认证服务器(如前所述，其是商户服务器的一部分)收到终端用户登入或登记的资料后，根据自身喜好或按照以下公式产生一条不会重复及不能猜中的对码请求编码：
[商户5个英文字简称+″-″+类别(ASK＝请求)+MD5(MSISDN手机号码+GMT base Time Stamp+6位数字或英文随机码)]；其中，GMT base Time Stamp即格林威治标准时间戳。随后，进入步骤(105)。
(104)商户的身份认证服务器取出终端用户登记的资料后，根据自身喜好或按照以下公式产生一条不会重复及不能猜中的对码请求编码：
[商户5个英文字简称+″-″+类别(ASK＝请求)+MD5(MSISDN手机号码+GMT base Time Stamp+6位数字或英文随机码)]。随后，进入步骤(105)。
(105)商户的对码请求服务器或模块(如前所述，其是商户服务器的一部分)通过http或https，或者，使用专线或VPN等安全通道按以下模式中的一种传送相应的资料到移动网络身份直接认证服务器(如前所述，其是认证服务器的一部分)。随后，进入步骤(110)。
模式A：全手机号认证模式
该模式由移动网络身份直接认证服务器核对完整的手机号码MSISDN(即全手机号)，只会返回对比后的结果。其基本描述如下：
(i)认证模式：A
(ii)已加密：没有或有
(iii)终端用户的资料：MSISDN(手机号码)[按照第(ii)项选择：若有加密，则根据协议加密方法进行加密]
(iv)商户的登入名及密码(预先登记在移动网络身份直接认证服务器)
(v)对码请求编码
(vi)要求的有效期(以秒为基础，最长为300秒，预设为10秒)；
(vii)需要终端用户确认：要或不要
模式B：半手机号认证模式
该模式由移动网络身份直接认证服务器核对部分的手机号码MSISDN(即半手机号)。半手机号核对正确后，将由电讯商提供的终端用户全部手机号码(非加密或根据协议加密方法)，返回给商户，再由商户核对，好处在于防止滥用及商户能自行判断结果。该模式基本描述如下：
(i)认证模式：B
(ii)已加密：没有或有
(iii)终端用户的资料：部分MSISDN(例如：最后四个数字)[按照第(ii)项选择：若有，根据协议加密方法]
(iv)商户的登入名及密码(预先登记在移动网络身份直接认证服务器)
(v)对码请求编码
(vi)要求的有效期(以秒为基础，最长为300秒，预设为10秒)；
(vii)需要终端用户确认：要或不要
模式C：全手机号，全用户身份资料认证模式
该模式由移动网络身份直接认证服务器核对完整的手机号码MSISDN，姓名和身份证号等等，只会返回对比后的结果。其基本描述如下：
(i)认证模式：C
(ii)已加密：没有或有
(iii)终端用户的资料：MSISDN(手机号码)、姓名、性别、出生日期和身份证号等等[按照第(ii)项选择：若有，根据协议加密方法]
(iv)商户的登入名及密码(预先登记在移动网络身份直接认证服务器)
(v)对码请求编码
(vi)要求的有效期(以秒为基础，最长为300秒，预设为10秒)；
(vii)需要终端用户确认：要或不要
模式D：半手机号，半用户身份资料认证模式
该模式由移动网络身份直接认证服务器核对部分手机号码MSISDN和部分身份证号，若部分手机号和部分身份证号核对正确后，将由电讯商提供的终端用户全部资料(包括完整的手机号码、身份证号、姓名、性别及出生日期等等，以非加密或根据协议加密方法)，返回给商户，再由商户核对，好处在于防止滥用及商户能自行判断结果。该模式基本描述如下：
(i)认证模式：D
(ii)已加密：没有或有
(iii)终端用户的资料：部分MSISDN(例如：最后四个数字)和部分身份证号(例如：中间六个数字)等等[按照第(ii)项选择：若有，根据协议加密方法]
(iv)商户的登入名及密码(预先登记在移动网络身份直接认证服务器)
(v)对码请求编码
(vi)要求的有效期(以秒为基础，最长为300秒，预设为10秒)
(vii)需要终端用户确认：要或不要。
(110)移动网络身份直接认证服务器核对商户的对码请求服务器传来的登入名及密码，以及商户预先登记的对码请求服务器的固定IP位置。随后，进入步骤(111)。
(111)核对商户的登入名和密码。若有错误，进入步骤(115)；否则，进入步骤(112)。
(112)核对商户服务器的互联网协议地址(Internet Protocol Address)位置， 若有错误，进入步骤(115)；否则，进入步骤(113)；
(113)检查是否还有使用配额或使用权，若无，进入步骤(115)；否则，进入步骤(120)；移动网络身份直接认证服务器可以为商户分配使用权或使用配额，例如商户可以享有永久认证服务权限，或者商户仅享有特定次数的认证服务等等；(115)移动网络身份直接认证服务器返回警告信息给商户的对码请求服务器及电邮EMail或短信SMS通知商户的代理人/公司(若有)，流程终结。
(120)移动网络身份直接认证服务器核对商户的身份后，从资料库取得商户的识别编码，并开始根据以下公式产生一条永不重复及不能猜中的案件编码：
[移动网络身份直接认证3个英文字简称(DTA)+″-″+MD5(商户的识别编码+MSISDN手机号码+GMT base Time Stamp+6位数字或英文随机码)]；随后，进入步骤(121)。
(121)移动网络身份直接认证服务器将案件编码加密，并选择最适合或最少使用量的电讯用户资料获取服务器(如前所述，其是认证服务器的一部分)的位置，组成一条特别的URL包含有加密后的案件编码。随后，进入步骤(122)。
(122)移动网络身份直接认证服务器将以下基本资料返回给商户的对码请求服务器：
(i)一条特别的URL(Uniform Resource Locator)包含有加密的案件编码；
(ii)一条未加密的案件编码(方便以后查询结果)；
(iii)剩下的使用额或次数；
随后，进入步骤(123)。
(123)商户的对码请求服务器再将这包含加密一次性的案件编码的特别URL网页地址转到其目标终端用户的移动终端设备的应用软件或网页内，若认证模式中选择不需要终端用户确认认证，终端用户可以运用类似AJAX或jQuery的程序库后台运行去获取这条URL内容，进入步骤(124)。若认证模式中选择需要终端用户确认进行认证，进入步骤(200)；
(200)终端用户程序使用WEBVIEW相类似的技术显示这条URL内容时，同时在后台开启每隔一段时间如1秒向商户服务器查询是否有结果，若有，即进入步 骤(163)；
(201)判断信息是否有机会通过电讯移动网连接INTERNET万维网；如果否，进入步骤(202)；如果是，进入步骤(203)；
(202)显示要求用户使用电讯移动网或使用其它有SIM的终端进行确认继续工作，若按重试键，返回步骤(201)，若选择使用外置有SIM的终端进行确认认证工作，进入(210)；如果选择取消，则进入步骤(204)；
(203)显示要求用户按不同方法(拖条、CAPTCHA等等)，以确认下一步工作及可同时授权电讯商及商户给予资料到本认证平台进行身份核对，若用户确认，进入步骤(130)；若用户不确认，即进入步骤(204)；
(204)设定MSISDN的值为333，标志为用户不同意进行认证，进入步骤(136)；(210)显示不同资料传递方法如(二维码，NFC等等)选择，选择其中一种后，运用移动终端扫码程序，NFC(Near Field Communication，近场通信)接收程序等等方法，将这条URL转换到移动终端，之后用APP或网页程序显示这条URL的内容，若此移动终端网络获得支持，即会重复步骤130到162；
(124)判断信息有机会通过电讯移动网连接INTERNET万维网；如果否，进入步骤(125)；如果是，进入步骤(130)。
(125)若非使用电讯移动网，MSISDN的值为NULL，电讯商识别码为NULL，随后转至步骤(136)；
(130)若经过有协议的电讯移动网时，电讯服务器会将加密或非加密的单项终端用户资料(MSISDN)或多项终端用户资料(MSISDN、姓名、性别及部分身份证号码等等)提供到电讯用户资料获取服务器；若是加密方式，则会额外提供加密的部分手机号码MSISDN，以方便模式B及D认证，提供的方法包括：
(i)方法一：在标头(HTTP/HTTPS Header)不同位置加入用户资料
(ii)方法二：用互联网协议地址(Internet Protocol Address)或互联网协议地址(Internet Protocol Address)+通讯端口(Port)向电讯其它服务器，查询终端用户的资料；
随后，进入步骤(131)。
(131)若获取的终端用户资料有加密，电讯用户资料获取服务器就会根据不同电讯商的协议方法去解密；若协议方法是使用HASHING(杂凑)加密，就不用解密，以HASHING值对比；随后，进入步骤(132)。
(132)检查终端用户资料是否有加密，若有，进入步骤(133)；否则，转至步骤(136)；
(133)检查终端用户资料是否HASHING化，如果有，进入步骤(136)；若否，进入步骤(134)；
(134)检查终端用户资料是否成功解密，如果成功，进入步骤(136)；若否，则进入步骤(135)；
(135)电邮通知系统管理员当前试图解密的终端用户资料所对应的电讯商提供的解密方法有错误发生，及将MSISDN的值设为NULL，电讯商识别码为NULL。随后，进入步骤(136)。
(136)电讯用户资料获取服务器从特别的URL获得一次性的加密案件编码，然后进行解密去还原案件编码，其目的是：测试是否是自家的编码，以及减少外界对系统的干扰或冲击；随后进入步骤(140)。
(140)检查案件编码解密是否成功，若否，进入步骤(141)；若成功，进入步骤(144)。
(141)检查MSISDN的值是否NULL，根据检查结果执行：如是，进入步骤(142)，如否，进入步骤(143)；
(142)将来源IP位置记录在资料库，方便以后调查非法使用者的身份；流程终结。
(143)记录MSISDN及其电讯商的资料在资料库，方便向其电讯商查询非法使用者的身份；流程终结。
(144)案件编码解密成功后，电讯用户资料获取服务器就会将终端用户资料，案件编码及电讯商识别名，传到移动网络身份直接认证服务器，进行对码/对照工作；随后，进入步骤(145)。
(145)移动网络身份直接认证服务器根据案件编码检查是否已完成或过时；随后， 进入步骤(150)。
(150)检查案件是否完成，若是，则跳到步骤(161)；否则，进入步骤(151)。
(151)检查案件是否过时，若是，则跳到步骤(157)；否则，进入步骤(152)；
(152)若案件未过期限，移动网络身份直接认证服务器根据案件编码取得认证模式、是否加密处理、商户的识别码、商户登记时对码结果获取服务器位置、对码请求编码及要对照的终端用户资料等等；随后，进入步骤(153)。
(153)移动网络身份直接认证服务器先检查MSISDN值；随后，进入步骤(154)。
(154)MSISDN的值是否NULL或333，若是，进入步骤(155)；否则，进入步骤(156)。
(155)将比对结果(例如，若MSISDN的值是NULL，结果为“不能提供”，或MSISDN的值是333，结果为“用户不同意进行”)，以及对码请求编码，案件编码等资料传给商户登记时的对码结果获取服务器(如前所述，其是商户服务器的一部分)的位置，进入步骤(160)；
(156)对比双方终端用户每项资料，将每项结果″吻合″或″不吻合″及资料类别写入一个列表或清单，以及将认证模式、是否加密处理、对码请求编码、案件编码等等资料传给商户登记时的对码结果获取服务器的位置，若是认证模式B，部分手机号正确后，则会加入由电讯商提供的终端用户的全部手机号码(非加密或协议的加密方法)到列表或清单中。因应需求，可将终端用户其它资料HASHING化后，加入列表或清单中，进入步骤(160)；
(157)将″对码请求过时″的结果，以及对码请求编码，案件编码等资料传给商户登记时的对码结果获取服务器的位置。随后，进入步骤(160)。
(160)商户的对码结果获取服务器或模块，获取从移动网络身份直接认证服务器结果后，并开始根据自身喜好或按照以下公式产生一条不会重复及不能猜中的对码获取编码返回给移动网络身份直接认证服务器：
[商户5个英文字简称+″-″+类别(GET＝获取)+MD5(MSISDN手机号码+GMT base Time Stamp+6位数字或英文随机码)]；随后，进入步骤(161)。
(161)移动网络身份直接认证服务器获取由商户发来的对码获取编码后，确认商户已有存根，证实已收到结果信息，并将对码″完成″信息返回电讯用户资料获 取服务器；随后，进入步骤(162)。
(162)电讯用户资料获取服务器再将″完成″信息传到商户的用户的移动终端的应用软件或网页；随后，进入步骤(163)。
(163)商户的用户的移动终端的应用软件或网页向他们的身份认证服务器，发出查询结果(若使用用户确认选项，需要显示网页内容，即要每隔一段时间就要发出查询结果，原因是未知用户何时确认)，若是认证模式A或C，再根据来自移动网络身份直接认证服务器的结果向用户提供适合的服务或信息，如全部″吻合″则允许用户登入、登记或进入下一步；若某项资料″不吻合″则要求用户检查，再提供正确用户资料，如：手机号码MSISDN或姓名等等；″不能提供″则要求或等待用户使用电讯网络时，再次进行验证；″同户不同意″则再次提示用户需要按照指示确认；″对码请求过时″则重新开始程序；若是模式B，又能″吻合″双方部分手机号码，商户可以再核对来自移动网络身份直接认证服务器的手机号码(非加密或协议的加密方法)及商户本身存储的终端用户的手机号码，以确保结果准确，然后根据结果向终端用户提供适合服务；若是模式D，又能″吻合″双方部分手机号码和部分身份证号，商户可以再核对来自移动网络身份直接认证服务器的用户资料(非加密或协议的加密方法)及商户本身存储的终端用户的资料，以确保结果准确，然后根据结果向终端用户提供适合服务。随后，进入步骤(180)。
(180)结束。
本发明实施的认证系统或平台的特色在于：重要信息是在后台服务器和服务器之间已沟通好要对码的资料及结果，避免移动终端的木马，中间人的攻击，病毒或客户端软件遭破解而导致能伪造结果的问题。使用电讯数据网关认证技术，能获得更佳的安全保护，快速认证，更好的用户体验和避免重复短信被截取的安全问题。此外，即使信息要经过电讯网，因为不带有要对照的终端用户资料，电讯商不知商户要对照的是什么终端用户资料，这样可确保电讯商提供的信息的可靠性。还有，若双方都使用HASHING或其它加密方法将用户资料加密，再让本平台对照，即使本平台被黑客攻击，都不会构成泄露终端用 户资料的问题。若选择认证模式B或D，商户不用完全透露终端用户信息给认证平台，一方面可以提高认证平台的可信性，另外一方，商户也可以自行再判断结果，达到双重保险，认证平台又不会遭受滥用，可最大保障终端用户隐私。此外，本认证方法能够选择透过在用户终端显示URL内容，让终端用户知晓认证及按键允许进行下一步工作，增加多一重的核实，避免URL被黑客(HACKER)劫持，又能选择用其它有SIM的终端装置，进行移动身份认证，增加认证的灵活性，尤其在没有SIM的装置，如PC，PAD等等。
本方法和平台令移动终端变得可信及唯一性，故即使使用简单密码都不构成被木马，中间人或病毒盗取的风险。此外，本方法和平台可解决“你是你”和“你是谁(KYC know your customer认识你的顾客)”的问题，可以良好地适用于移动通信领域。其优势在于：
1)若选择隐藏URL运行模式(不需要用户按键确认)，就无需用户输入一次性的密码
2)若选择隐藏URL运行模式(不需要用户按键确认)，只要知道用户手机号码，就可随时检查
3)即时知道检测结果，相比短信认证快5～15倍
4)可知道手机SIM卡和APP是否在同一部手机里，提高安全度
5)可辅助短信认证，加强手机号码的认证地位，并加大用户使用电讯网络上网的价值。
6)若选择展现URL运行模式(需要用户按键确认)，可以额外增加保障和授权讯息(明确得到用户确认)，以及让用户转换到适合有SIM的装置，进行认证工作，而不会影响原操作装置，增加灵活性。
7)一般来说，只要得到用户确认或授权，可将电讯资料直接提供给商户，但这会存在风险，电讯资料未必是百分百可靠，此外，由于用户会在移动终端使用多过一张SIM卡，用户未必知道现在是使用那个手机号码作为登记之用，故采用对码式核对方法，就能确定用户想提供哪些资料去开户或登记，电讯资料可作为核对用户资料之用，这样能消除用户不必要的误用 或错误提供资料。此外，我们经常都会登入一些服务后，而忘记登出，并且又离开，尤其在一些公众场合或使用个人电脑后或非移动终端，这会造成一些安全隐忧。针对这类问题，透过专有网页或APP，通过本认证方法，核实用户的手机号码，通过手机号码显示过往成功的交易编码，只要用户向某个交易编号按注销，系统就会根据交易编号查出相关商户资料，并向商户服务器，发出用户注销服务请求连带交易编号。当商户服务器收到要注销的服务相关的交易编号，若服务还继续，就会退出该服务，保障真实用户。
虽然本专利申请结合附图详细描述多个实施方式，但应指出的是，在不脱离本发明的精神和保护范围内，各种可能的其它改变或修改都应包含在本发明内。

Claims (10)

  1. 一种认证服务器，其特征在于，包括：
    资料获取模块：用于基于终端用户手机号码，分别从电讯服务器获得电讯用户资料，以及从商户服务器获得商户用户资料；以及
    身份认证模块：用于根据预定认证模式，将所述电讯用户资料与所述商户资料进行比对，并向所述商户服务器返回比对结果。
  2. 根据权利要求1的认证服务器，其特征在于，所述认证模式包括：全手机号认证模式，半手机号认证模式，全手机号、全用户资料认证模式，以及半手机号、半用户资料认证模式。
  3. 一种认证系统，其特征在于，包括：电讯服务器、认证服务器以及商户服务器，所述电讯服务器用于基于终端用户手机号码向所述认证服务器提供电讯用户资料，所述商户服务器用于基于终端用户手机号码向所述认证服务器提供商户用户资料，所述认证服务器用于根据预定认证模式，将从所述电讯服务器获得的所述电讯用户资料与从所述商户服务器获得的所述商户用户资料进行比对，并向所述商户服务器返回比对结果。
  4. 根据权利要求3的认证系统，其特征在于，所述认证模式包括：全手机号认证模式，半手机号认证模式，全手机号、全用户资料认证模式，以及半手机号、半用户资料认证模式。
  5. 根据权利要求4的认证系统，其特征在于，在半手机号认证模式或半手机号、半用户资料认证模式中，所述商户服务器继续进行完整手机号码及用户资料的比对。
  6. 根据权利要求3的认证系统，其特征在于，所述电讯服务器采用将用户资料加入到网页的方式，将电讯用户资料提供给认证服务器，或者认证服务器根据用户的IP或IP+Port信息向电讯服务器获取用户资料。
  7. 一种认证方法，其特征在于，包括：
    商户服务器基于终端用户手机号码向认证服务器提供商户用户资料；
    电讯服务器基于终端用户手机号码向所述认证服务器提供电讯用户资料；
    所述认证服务器根据预定认证模式，将从所述电讯服务器获得的所述电讯用户资料与从所述商户服务器获得的所述商户用户资料进行比对，并向所述商户服务器返回比对结果。
  8. 根据权利要求7的认证方法，其特征在于，所述认证模式包括：全手机号认证模式，半手机号认证模式，全手机号、全用户资料认证模式，以及半手机号、半用户资料认证模式。
  9. 根据权利要求8的认证方法，其特征在于，在半手机号认证模式或半手机号、半用户资料认证模式中，所述商户服务器继续进行完整手机号码及用户资料的比对。
  10. 根据权利要求7的认证方法，其特征在于，所述认证方法包括：
    商户服务器产生包含商户简称、终端用户手机号码、时间戳和随机码的对码请求编码，根据认证模式传送对码请求编码和相应的商户用户资料到认证服务器；认证服务器确认商户身份及权限后，产生包含认证简称、商户识别编码、时间戳和随机码的案件编码，并形成包含加密后的案件编码的统一资源定位器并将包含案件编码、统一资源定位器及剩余使用权的资料发送给商户服务器；
    商户服务器将统一资源定位器转给用户终端；
    电讯服务器根据用户终端基于统一资源定位器的请求，将相应的电讯用户资料提供到认证服务器；
    认证服务器基于从统一资源定位器中获得的加密后的案件编码，在解密核查成功完成后，对电讯用户资料和商户用户资料进行比对，并将比对结果传给商户服务器；
    商户服务器获得认证服务器的比对结果后，根据认证模式进行相应处理。
PCT/CN2018/073888 2017-02-01 2018-01-23 认证服务器、认证系统及方法 WO2018141219A1 (zh)

Priority Applications (12)

Application Number Priority Date Filing Date Title
CA3029871A CA3029871C (en) 2017-02-01 2018-01-23 Authentication server, authentication system and method
RU2019102051A RU2019102051A (ru) 2017-02-01 2018-01-23 Сервер аутентификации, система аутентификации и способ аутентификации
KR1020197006962A KR20190111006A (ko) 2017-02-01 2018-01-23 인증 서버, 인증 시스템 및 방법
CN201880000120.8A CN108702297A (zh) 2017-02-01 2018-01-23 认证服务器、认证系统及方法
SG11201900393UA SG11201900393UA (en) 2017-02-01 2018-01-23 Authentication server, authentication system, and authentication method
EP18747294.9A EP3579495A4 (en) 2017-02-01 2018-01-23 AUTHENTICATION SERVER, AUTHENTICATION SYSTEM, AND AUTHENTICATION METHOD
JP2018569162A JP2020507823A (ja) 2017-02-01 2018-01-23 認証サーバ、認証システムおよび方法
AU2018214492A AU2018214492A1 (en) 2017-02-01 2018-01-23 Authentication server, authentication system, and authentication method
US15/952,231 US10230721B2 (en) 2017-02-01 2018-04-12 Authentication server, authentication system and method
HK18115626.0A HK1256555A1 (zh) 2017-02-01 2018-12-06 認證服務器、認證系統及方法
IL265408A IL265408A (en) 2017-02-01 2019-03-17 Authentication server, authentication system and method
PH12019500743A PH12019500743A1 (en) 2017-02-01 2019-04-04 Authentication server , authentication system method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US201762452996P 2017-02-01 2017-02-01
US62/452,996 2017-02-01

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/952,231 Continuation-In-Part US10230721B2 (en) 2017-02-01 2018-04-12 Authentication server, authentication system and method

Publications (1)

Publication Number Publication Date
WO2018141219A1 true WO2018141219A1 (zh) 2018-08-09

Family

ID=63039309

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/073888 WO2018141219A1 (zh) 2017-02-01 2018-01-23 认证服务器、认证系统及方法

Country Status (13)

Country Link
US (1) US10230721B2 (zh)
EP (1) EP3579495A4 (zh)
JP (1) JP2020507823A (zh)
KR (1) KR20190111006A (zh)
CN (1) CN108702297A (zh)
AU (1) AU2018214492A1 (zh)
CA (1) CA3029871C (zh)
HK (1) HK1256555A1 (zh)
IL (1) IL265408A (zh)
PH (1) PH12019500743A1 (zh)
RU (1) RU2019102051A (zh)
SG (1) SG11201900393UA (zh)
WO (1) WO2018141219A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109769003A (zh) * 2019-03-26 2019-05-17 夏浩然 防止手机号码泄露的手机注册方法、系统及服务器

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3099974B1 (fr) * 2019-08-14 2022-09-16 Taklane Procédé de transmission d’une information numérique
GB2600401A (en) 2020-10-23 2022-05-04 Polydigi Tech Ltd Methods, systems and computer program products, for use in biometric authentication
CN114422266A (zh) * 2022-02-28 2022-04-29 深圳市中悦科技有限公司 一种基于双重验证机制的IDaaS系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1852095A (zh) * 2005-12-23 2006-10-25 华为技术有限公司 一种对互联网用户身份进行校验的方法、装置和系统
CN102143482A (zh) * 2011-04-13 2011-08-03 中国工商银行股份有限公司 一种手机银行客户端信息认证方法、系统及移动终端
CN102930435A (zh) * 2012-09-19 2013-02-13 中国联合网络通信集团有限公司 移动支付认证方法及系统
CN103138935A (zh) * 2013-01-25 2013-06-05 宝利数码有限公司 一种基于电信运营商的身份认证系统
CN104077841A (zh) * 2013-03-27 2014-10-01 宝利数码有限公司 移动身份认证及支付的方法和系统

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH06113103A (ja) * 1992-09-25 1994-04-22 Canon Inc ファクシミリ装置
JP2002041476A (ja) * 2000-07-26 2002-02-08 Ntt Comware Corp ユーザ認証システム及びユーザ認証方法
US20060212407A1 (en) * 2005-03-17 2006-09-21 Lyon Dennis B User authentication and secure transaction system
US20120028609A1 (en) * 2010-07-27 2012-02-02 John Hruska Secure financial transaction system using a registered mobile device
CA2724297C (en) * 2010-12-14 2013-11-12 Xtreme Mobility Inc. System and method for authenticating transactions through a mobile device
CN103200150B (zh) * 2012-01-04 2016-08-17 深圳市腾讯计算机系统有限公司 身份认证方法和系统
WO2014032549A1 (zh) * 2012-08-31 2014-03-06 宝利数码有限公司 基于电信服务商的移动身份认证和支付的方法与系统
JP2016148971A (ja) * 2015-02-12 2016-08-18 トヨタ自動車株式会社 運転支援装置
CN106130971B (zh) * 2016-06-22 2019-05-10 中国联合网络通信集团有限公司 身份认证方法及认证服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1852095A (zh) * 2005-12-23 2006-10-25 华为技术有限公司 一种对互联网用户身份进行校验的方法、装置和系统
CN102143482A (zh) * 2011-04-13 2011-08-03 中国工商银行股份有限公司 一种手机银行客户端信息认证方法、系统及移动终端
CN102930435A (zh) * 2012-09-19 2013-02-13 中国联合网络通信集团有限公司 移动支付认证方法及系统
CN103138935A (zh) * 2013-01-25 2013-06-05 宝利数码有限公司 一种基于电信运营商的身份认证系统
CN104077841A (zh) * 2013-03-27 2014-10-01 宝利数码有限公司 移动身份认证及支付的方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3579495A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109769003A (zh) * 2019-03-26 2019-05-17 夏浩然 防止手机号码泄露的手机注册方法、系统及服务器

Also Published As

Publication number Publication date
CA3029871A1 (en) 2018-08-09
HK1256555A1 (zh) 2019-09-27
JP2020507823A (ja) 2020-03-12
CN108702297A (zh) 2018-10-23
US10230721B2 (en) 2019-03-12
KR20190111006A (ko) 2019-10-01
AU2018214492A1 (en) 2019-02-07
SG11201900393UA (en) 2019-02-27
IL265408A (en) 2019-05-30
EP3579495A1 (en) 2019-12-11
RU2019102051A (ru) 2020-07-27
EP3579495A4 (en) 2020-06-03
CA3029871C (en) 2021-04-20
PH12019500743A1 (en) 2019-08-05
US20180302401A1 (en) 2018-10-18

Similar Documents

Publication Publication Date Title
US11663578B2 (en) Login using QR code
US11647023B2 (en) Out-of-band authentication to access web-service with indication of physical access to client device
US10904234B2 (en) Systems and methods of device based customer authentication and authorization
US20220191016A1 (en) Methods, apparatuses, and computer program products for frictionless electronic signature management
US10554420B2 (en) Wireless connections to a wireless access point
US10223520B2 (en) System and method for integrating two-factor authentication in a device
US20200210988A1 (en) System and method for authentication of a mobile device
US8214890B2 (en) Login authentication using a trusted device
CN111615105B (zh) 信息提供、获取方法、装置及终端
WO2018141219A1 (zh) 认证服务器、认证系统及方法
WO2018099407A1 (zh) 账户认证登录方法及装置
JP7079528B2 (ja) サービス提供システム及びサービス提供方法
KR20170099339A (ko) 보안 회원가입 및 로그인 호스팅 서비스 제공 시스템 및 그 방법
JP6080282B1 (ja) 認証処理システム、認証補助サーバ及びウェブ表示プログラム
US20240214373A1 (en) Establishing a trust relationship between a peripheral device and a server
CN114513299B (zh) 基于开放式授权的数据传输方法及电子设备
TWI778319B (zh) 跨平台授權存取資源方法及授權存取系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18747294

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018569162

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 3029871

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2018214492

Country of ref document: AU

Date of ref document: 20180123

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20197006962

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018747294

Country of ref document: EP

Effective date: 20190902