WO2018161777A1 - Identity verification method, terminal apparatus, server, and data storage medium - Google Patents

Abstract

An identity verification method comprises: a terminal apparatus scanning a two-dimensional barcode generated at a client apparatus; the terminal apparatus transmitting first verification data to a server; the terminal apparatus performing, according to a unidirectional Hash function, a computation on second verification data to generate third verification data; and the terminal apparatus transmitting the third verification data to the server to enable the server to transmit indication information to the client apparatus. The indication information is used to indicate that the terminal apparatus has passed the verification.

Description

Method, terminal device, server and storage medium for authentication

This application claims the priority of the Chinese Patent Application entitled "Identification Method, Terminal Device and Server" by the Chinese Patent Office, filed on March 9, 2017, with the application number of 2017101383283, the entire contents of which are incorporated herein by reference. In the application.

Technical field

The present application relates to the field of communications technologies, and in particular, to an authentication method, a terminal device, a server, and a storage medium.

Background technique

With the improvement of user network security awareness, user authentication is more and more widely used. In the insecure public network channel, user identity verification can effectively protect secure communication and system related resources.

Therefore, in order to protect a secure network system environment, a simple and effective user authentication mechanism is necessary. A password-based user authentication mechanism provides the most basic functionality to prevent unauthorized access and permissions. Of course, some smart cards, tokens TOKEN, etc. are implemented based on user rights and authorization settings. However, these methods add hardware and maintenance costs invisibly, and the efficiency of user authentication is low and the accuracy is poor.

Summary of the invention

Various embodiments provided in accordance with the present application provide a method, terminal device, server, and storage medium for authentication.

A method of authentication, including:

The terminal device scans the two-dimensional code generated by the client device, so that the terminal device that has scanned the two-dimensional code is registered to the server, and the two-dimensional code is generated by the client device based on the one-time password;

Transmitting, by the terminal device, first verification data to the server, so that the server sends second verification data to the terminal device, where the second verification data is that the server performs a one-way hash function The first verification data is calculated to generate data;

The terminal device calculates the second verification data according to the one-way hash function to generate third verification data; and

The terminal device sends the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the terminal device has passed the verification.

A method of authentication, including:

Receiving, by the server, the first verification data sent by the terminal device, where the first verification data is data generated by the terminal device after being registered to the server, and the terminal device generates the second The dimension code is registered to the server, and the two-dimensional code is generated by the client device based on the one-time password;

The server calculates the first verification data according to a one-way hash function to generate second verification data;

Sending, by the server, the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data;

Receiving, by the server, the third verification data sent by the terminal device;

The server generates indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

The server sends the indication information to the client device.

A terminal device comprising:

a scanning unit, configured to scan a two-dimensional code generated by the client device, to register the terminal device that has scanned the two-dimensional code to a server, where the two-dimensional code is generated by the client device based on a one-time password ;

a first sending unit, configured to send the first verification data to the server, so that the server sends the second verification data to the terminal device, where the second verification data is a one-way hash according to the server a function for calculating the first verification data to generate data;

a calculating unit, configured to calculate the second verification data according to the one-way hash function to generate third verification data; and

a second sending unit, configured to send the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the terminal device has passed the verification .

A terminal device comprising a memory and one or more processors, the memory storing computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processors perform the following steps:

Scanting a two-dimensional code generated by the client device to register the scanned two-dimensional code to the server, the two-dimensional code being generated by the client device based on the one-time password;

Transmitting the first verification data to the server, so that the server sends the second verification data to, the second verification data is that the server calculates the first verification data according to the one-way hash function Generated data;

Calculating the second verification data according to the one-way hash function to generate third verification data; and

And sending the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the verification has been passed.

A server that includes:

a first receiving unit, configured to receive first verification data that is sent by the terminal device, where the first verification data is data generated by the terminal device after being registered to the server, and the terminal device scans The two-dimensional code generated by the client device is registered to the server, and the two-dimensional code is generated by the client device based on the one-time password;

a first calculating unit, configured to calculate the first verification data according to a one-way hash function to generate second verification data;

a first sending unit, configured to send the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data. ;

a first receiving unit, configured to receive the third verification data sent by the terminal device;

a generating unit, configured to generate indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

a second sending unit, configured to send the indication information to the client device.

A server comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors such that the one or more The processor performs the following steps:

Receiving first verification data sent by the terminal device, where the first verification data is data generated by the terminal device after being registered, and the terminal device is registered by scanning a QR code generated by the client device to The two-dimensional code is generated by the client device based on a one-time password;

Calculating the first verification data according to a one-way hash function to generate second verification data;

Transmitting the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data;

Receiving the third verification data sent by the terminal device;

Generating indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

Sending the indication information to the client device.

One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the following steps:

Scanting a two-dimensional code generated by the client device to register the scanned two-dimensional code to the server, the two-dimensional code being generated by the client device based on the one-time password;

Transmitting the first verification data to the server, so that the server sends the second verification data to, the second verification data is that the server calculates the first verification data according to the one-way hash function Generated data;

Calculating the second verification data according to the one-way hash function to generate third verification data; and

And sending the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the verification has been passed.

One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the following steps:

Receiving first verification data sent by the terminal device, where the first verification data is data generated by the terminal device after being registered, and the terminal device is registered by scanning a QR code generated by the client device to The two-dimensional code is generated by the client device based on a one-time password;

Calculating the first verification data according to a one-way hash function to generate second verification data;

Transmitting the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data;

Receiving the third verification data sent by the terminal device;

Generating indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

Sending the indication information to the client device.

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features, objects, and advantages of the invention will be apparent from the description and appended claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present application. Other drawings may also be obtained from those of ordinary skill in the art in light of the inventive work.

1 is a schematic structural diagram of an embodiment of a verification system provided by the present application;

2 is a schematic structural diagram of an embodiment of a server provided by the present application;

3 is a schematic structural diagram of an embodiment of a terminal device provided by the present application;

4 is a flow chart of steps of an embodiment of a method for identity verification provided by the present application;

FIG. 5 is a flow chart of steps of another embodiment of the method for identity verification provided by the present application;

6 is a flow chart of steps of another embodiment of the method for identity verification provided by the present application;

FIG. 7 is a flow chart of steps of another embodiment of the method for identity verification provided by the present application;

FIG. 8 is a schematic structural diagram of another embodiment of a terminal device provided by the present application; and

FIG. 9 is a schematic structural diagram of another embodiment of a server provided by the present application.

detailed description

The embodiment of the present application provides a method for identity verification, and a method for authenticating the identity verification provided by the embodiment of the present application. The following is a detailed description of the specific structure of the verification system that can implement the method provided by the embodiment of the present application. Detailed description. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

As shown in FIG. 1, the verification system shown in this embodiment includes a server 101, at least one client device 102, and at least one terminal device 103.

The specific number of the client device 102 and the terminal device 103 included in the verification system shown in this embodiment is not limited.

Data communication can be performed between the server 101, the client device 102, and the terminal device 103 shown in this embodiment.

The specific structure of the server shown in this embodiment will be described below with reference to FIG. 2:

The server 200 provided by the embodiment of the present application may have a relatively large difference due to different configurations or performances, and may include one or more central processing units (CPUs) 222 (eg, one or more processors) and Memory 232, one or more storage media 230 storing application 242 or data 244 (e.g., one or one storage device in Shanghai). Among them, the memory 232 and the storage medium 230 may be short-term storage or persistent storage. Programs stored on storage medium 230 may include one or more modules (not shown), each of which may include a series of computer readable instructions in a server. Still further, central processor 222 can be configured to communicate with storage medium 230, executing a series of computer readable instructions in storage medium 230 on server 200 that, when executed, cause processor 222 to perform a A method of authentication. The storage medium 230 may be a non-volatile storage medium.

Server 200 may also include one or more power sources 226, one or more wired or wireless network interfaces 250, one or more input and output interfaces 258, and/or one or more operating systems 241, such as Windows ServerTM, Mac OS. XTM, UnixTM, LinuxTM, FreeBSDTM and more.

The specific structure of the terminal device 103 provided in this embodiment is described in detail below with reference to FIG. 3:

As shown in FIG. 3, for the convenience of description, only the parts related to the embodiments of the present application are shown. For the specific technical details not disclosed, please refer to the method part of the embodiment of the present application. The terminal device may be any terminal device including a mobile phone, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), an in-vehicle computer, and the like.

FIG. 3 is a block diagram showing a partial structure of a terminal device related to a terminal device provided by an embodiment of the present application. Referring to FIG. 3, the terminal device includes: a radio frequency (RF) circuit 310, a memory 320, an input unit 330, a display unit 340, a sensor 350, an audio circuit 360, a wireless fidelity (WiFi) module 370, and a processor. 380, and power supply 390 and other components. It will be understood by those skilled in the art that the terminal device structure shown in FIG. 3 does not constitute a limitation of the terminal device, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements.

The following describes the components of the terminal device in detail with reference to FIG. 3:

The RF circuit 310 can be used for receiving and transmitting signals during and after the transmission or reception of information, in particular, after receiving the downlink information of the base station, and processing it to the processor 380; in addition, transmitting the designed uplink data to the base station. Generally, RF circuit 310 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like. In addition, RF circuitry 310 can also communicate with the network and other devices via wireless communication. The above wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code Division). Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), E-mail, Short Messaging Service (SMS), and the like.

The memory 320 can be used to store software programs and modules, and the processor 380 executes various functional applications and data processing of the terminal devices by running software programs and modules stored in the memory 320. The memory 320 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to Data created by the use of the terminal device (such as audio data, phone book, etc.). Moreover, memory 320 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. The terminal device also includes a non-volatile storage medium. The non-volatile storage medium stores computer readable instructions. The computer readable instructions can be executed by processor 380. When computer readable instructions are executed by processor 380, processor 380 can be caused to perform a method of authentication.

The input unit 330 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the terminal device. Specifically, the input unit 330 may include a touch panel 331 and other input devices 332. The touch panel 331 , also referred to as a touch screen, can collect touch operations on or near the user (such as a user using a finger, a stylus, or the like on the touch panel 331 or near the touch panel 331 Operation), and drive the corresponding connecting device according to a preset program. Optionally, the touch panel 331 can include two parts: a touch detection device and a touch controller. Wherein, the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information. The processor 380 is provided and can receive commands from the processor 380 and execute them. Further, the touch panel 331 can be implemented in various types such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave. In addition to the touch panel 331, the input unit 330 may also include other input devices 332. In particular, other input devices 332 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.

The display unit 340 can be used to display information input by the user or information provided to the user as well as various menus of the terminal device. The display unit 340 can include a display panel 341. Alternatively, the display panel 341 can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like. Further, the touch panel 331 can cover the display panel 341. When the touch panel 331 detects a touch operation on or near it, the touch panel 331 transmits to the processor 380 to determine the type of the touch event, and then the processor 380 according to the touch event. The type provides a corresponding visual output on display panel 341. Although in FIG. 3, the touch panel 331 and the display panel 341 are used as two independent components to implement input and input functions of the terminal device, in some embodiments, the touch panel 331 may be integrated with the display panel 341. And realize the input and output functions of the terminal device.

The terminal device may also include at least one type of sensor 350, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 341 according to the brightness of the ambient light, and the proximity sensor may close the display panel 341 when the terminal device moves to the ear. / or backlight. As a kind of motion sensor, the accelerometer sensor can detect the acceleration of each direction (usually three axes), and the magnitude and direction of gravity can be detected at rest. It can be used to identify the attitude of the terminal device (such as horizontal and vertical screen switching, Related games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for the gyroscope, barometer, hygrometer, thermometer, infrared sensor and other sensors that can be configured in the terminal device, here No longer.

The audio circuit 360, the speaker 361, and the microphone 362 can provide an audio interface between the user and the terminal device. The audio circuit 360 can transmit the converted electrical data of the received audio data to the speaker 361 for conversion to the sound signal output by the speaker 361; on the other hand, the microphone 362 converts the collected sound signal into an electrical signal, by the audio circuit 360. After receiving, it is converted into audio data, and then processed by the audio data output processor 380, sent to, for example, another terminal device via the RF circuit 310, or outputted to the memory 320 for further processing.

WiFi is a short-range wireless transmission technology, and the terminal device can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 370, which provides wireless broadband Internet access for users. Although FIG. 3 shows the WiFi module 370, it can be understood that it does not belong to the essential configuration of the terminal device, and may be omitted as needed within the scope of not changing the essence of the invention.

The processor 380 is a control center of the terminal device that connects various portions of the entire terminal device using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 320, and recalling data stored in the memory 320. Perform various functions and processing data of the terminal device to perform overall monitoring on the terminal device. Optionally, the processor 380 may include one or more processing units; preferably, the processor 380 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like. The modem processor primarily handles wireless communications. It will be appreciated that the above described modem processor may also not be integrated into the processor 380.

The terminal device also includes a power source 390 (such as a battery) that supplies power to the various components. Preferably, the power source can be logically coupled to the processor 380 through a power management system to manage functions such as charging, discharging, and power management through the power management system.

Although not shown, the terminal device may further include a camera, a Bluetooth module, and the like, and details are not described herein again.

The specific structure of the client device 102 is not limited in this embodiment, as long as the client device 102 can generate a two-dimensional code to be scanned by the terminal device 103.

Based on FIG. 1 to FIG. 3 , the specific implementation process of the method for identity verification provided by the embodiment of the present application is described in detail below with reference to FIG. 4 .

Step 401: The client device generates a two-dimensional code based on the one-time password.

First, the one-time password shown in this embodiment is explained:

In the process of authenticating users, static passwords are vulnerable to cracking, and one-time passwords (English name: One Time Password, English abbreviation: OTP) can effectively improve the security of user authentication.

One-time passwords are only valid for one login session or transaction. One-time passwords prevent many of the shortcomings associated with traditional static passwords, such as replay attacks, dictionary attacks, and phishing attacks. This means that if a potential intruder tries to record a one-time password that has been used to log in to the service or to do something, he will not abuse it because the password is no longer valid.

Therefore, the purpose of a one-time password is to make it more difficult to gain unauthorized access to restricted resources.

One-time password schemes cannot be remembered by humans. For this reason, they need extra technology to work. Basically, one-time passwords can be divided into the following four categories:

One type: based on mathematical algorithms: In 1981, Lamport first proposed a one-time password authentication scheme using a one-way hash chain. However, if an indefinite password is required, a new seed value needs to be selected when an old hash chain is exhausted. In particular, maintaining a password file used to authenticate user authentication requests also increases the risk of tampering and maintenance costs. For this reason, many researchers have proposed various user authentications, such as using smart cards to improve security, cost or efficiency.

The other type: based on smart cards: Due to the tamper-resistant technology and convenience in managing password files, smart cards have been widely used in many remote authentication schemes. However, it is still a burden for the user to carry the card and the scanner with him or her. This barrier therefore limits the application of smart cards based on authentication schemes.

Another type: token-based tokens: token one-time passwords are usually associated with physical hardware tokens. Inside the token is an accurate clock that has been synchronized with the clock on the server. Recently, it has been able to associate electronic originals with regular key fob one-time password tokens, such as InCard, RSA, SafeNet, and Vasco. However, these methods are not very convenient for the same reasons as smart card solutions.

The other type: based on short message service: Since short-term interest is a ubiquitous communication channel, it is used on all mobile phones at the same time. Then, although SMS is the best-effort delivery agent, it means that the communication company tries to send the text message, but there is no guarantee that it will be delivered, or that it will take a long time. It should be emphasized that a one-time password must have a lifecycle as a security feature. In addition, SMS-based solutions must continue until additional costs are incurred. Therefore, it is impractical and at the same time not a necessary low-cost solution.

It can be seen that, in order to eliminate the disadvantages of the one-time password shown above, the client device shown in this embodiment can generate a two-dimensional code based on the one-time password.

Specifically, when the client device shown in this embodiment is started, the processor of the client device can calculate the preset content by using a one-time password to generate a two-dimensional code, and the display screen of the client device can display the generated second. Dimension code.

The application scenario of the method shown in this embodiment is also shown in FIG. 5. The client device shown in this embodiment may store the preset content content shown in FIG. 5 as a uniform resource location address URL, or text. Text, or phone number phone number, or SMS service SMS.

As shown in the application scenario shown in FIG. 5, the client server can perform encryption operation on the preset content content based on the one-time password to generate a QR code.

Step 402: The terminal device scans the two-dimensional code generated by the client device.

The terminal device shown in this embodiment scans the two-dimensional code to join the verification system shown in FIG. 1.

Due to the rapid development of mobile communications, the two-dimensional code technology in embedded cameras has been applied as a new input interface. Terminal devices with embedded cameras can capture two-dimensional codes and then decode them using software running on the terminal device.

At the same time, there are many benefits to using a QR code in a terminal device, such as full-scale readability and error correction. For this reason, terminal devices that use QR codes support many of today's services, such as booking, payment, and Uniform Resource Locator reading.

Therefore, this embodiment proposes to use a widely used two-dimensional code technology to support a one-time password system, and the two-dimensional code application on the terminal device can obtain the benefits of inheriting from the two-dimensional code, such as large capacity, small print size, and high-speed scanning. , anti-destructive ability and data robustness. In addition, various attributes such as liquidity and dexterity. Therefore, our approach can be more convenient because the user does not need to have a separate hardware token for each security domain to gain access.

For example, the application scenario shown in FIG. 5 is performed after the terminal device scans the two-dimensional code generated by the client device, and the specific execution process of the registration phase is as shown in step 403 to step 408 below.

Step 403: The terminal device generates first registration data corresponding to the terminal device.

In this embodiment, the first registration data IDA is not limited, as long as the first registration data IDA is associated with the terminal device. For example, the first registration data IDA may be an ID code of a processor of the terminal device, or a preset of the terminal device. Login account and login password.

Step 404: The terminal device sends the first registration data to the server.

Step 405: The server receives the first registration data sent by the terminal device.

Specifically, in the process of performing step 404 and step 405 shown in this embodiment, the server and the terminal device may establish a secure communication channel in advance, so that data is transmitted between the server and the terminal device through the created communication channel. .

Step 406: The server generates second registration data.

Specifically, the server shown in this embodiment is capable of calculating the first registration data IDA and the preset key S according to the one-way hash function h(*) to generate the second registration data XA.

The preset key S is a long-term key stored in advance by the server.

More specifically, XA = h (IDA, S).

Step 407: The server sends the second registration data to the terminal device.

Step 408: The terminal device receives the second registration data.

After receiving the second registration data, the terminal device shown in this embodiment can store the second registration data XA as a long-term key.

The process of registering the terminal device to the server is completed by using steps 403 to 408 shown in this embodiment.

As an example of the application scenario shown in FIG. 5, after the steps 403 to 408 are performed, the process of registering the terminal device to the server is completed, and the verification phase is performed through steps 409 to 435 shown below.

Step 409: The terminal device records the first timestamp.

Specifically, the first timestamp T1 is a time when the terminal device detects that the terminal device scans the two-dimensional code.

Step 410: The terminal device generates first verification data.

Specifically, the first verification data shown in this embodiment includes a first timestamp T1 and a second registration data XA.

Step 411: The terminal device sends the first verification data to the server.

Step 412: The server receives the first verification data.

Step 413: The server records the second timestamp.

Specifically, the second timestamp T2 is a time when the server detects that the terminal device scans the two-dimensional code;

Step 414: The server determines whether the first verification data meets the first preset condition. If not, step 415 is performed, and if yes, step 416 is performed.

The first preset condition is that the first timestamp is equal to the second timestamp.

Specifically, when the server determines that the first timestamp included in the first verification data is not equal to the second timestamp recorded by the server, if the first verification data does not satisfy the first preset condition, the process proceeds to step 415.

When the server determines that the first timestamp included in the first verification data is equal to the second timestamp recorded by the server, it indicates that the first verification data meets the first preset condition, and then proceeds to step 416.

Step 415: The server rejects the request of the terminal device for verification.

If the server determines that the first timestamp included in the first verification data is not equal to the second timestamp recorded by the server, the server may determine that the terminal device performs the authentication request is invalid, and the optional The server may send the target indication information to the terminal device and/or the client device, where the target indication information is used to indicate that the request for the terminal device to perform the identity verification is invalid.

Step 416: The server generates the first sub data.

Specifically, the server calculates the target random number r, the first timestamp T1, and the second timestamp T2 according to the one-way hash function h(*) to generate the first sub-data h(r, T1, T2).

The target random number r is data randomly generated by the server.

Step 417: The server generates the first parameter.

Specifically, the server performs an exclusive OR operation on the target random number r and the second registration data IDA.

To generate a first parameter α;

The second registration data shown in this embodiment is the data generated in step 406.

specific,

Step 418: The server generates a second sub-data.

Specifically, the server calculates the first parameter by using the first function to generate the second sub data.

More specifically, the first function shown in this embodiment is EOR(*).

Among them, the first function EOR(*) is a function of encoding data into a two-dimensional code image.

In this embodiment, the second sub-data is EOR(α).

Step 419: The server generates second verification data.

In this embodiment, the second verification data generated by the server includes first sub-data h(r, T1, T2), second sub-data EOR(α), and a second timestamp T2.

Step 420: The server sends the second verification data to the terminal device.

Step 421: The terminal device receives the second verification data.

Step 422: The terminal device determines whether the second verification data meets the second preset condition. If not, step 423 is performed, and if yes, step 424 is performed.

In this embodiment, the second preset condition is that the first timestamp T1 is equal to the second timestamp T2.

That is, if the terminal device determines that the first timestamp T1 is equal to the second timestamp T2, and determines that the second verification data meets the second preset condition, step 424 may be continued.

If the terminal device determines that the first timestamp T1 is not equal to the second timestamp T2, and determines that the second verification data does not satisfy the second preset condition, step 423 may be continued.

Step 423: The terminal device refuses to continue identity verification.

In this embodiment, when the terminal device determines that the first timestamp T1 is not equal to the second timestamp T2, the terminal device refuses to continue the identity verification, and the process of the identity verification is terminated.

Step 424: The terminal device generates a second parameter.

Specifically, the terminal device calculates the second sub-data EOR(α) included in the second verification data by using the second function DOR(*) to generate the second parameter.

The second function DOR(*) is a function that the terminal device will decode the two-dimensional code captured in the embedded camera device.

The second parameter is DOR (EOR(α)).

Step 425: The terminal device generates a target random number.

In this embodiment, the terminal device performs an exclusive OR operation on the second parameter DOR (EOR(α)) and the second registration data XA.

A calculation is performed to generate a target random number r.

specific,

Step 426: The terminal device generates a third parameter.

Specifically, the terminal device calculates the target random number r, the first timestamp T1, and the second timestamp T2 by using the one-way hash function h(*) to generate a third parameter.

More specifically, the third parameter is h(r, T1, T2).

Step 427: The terminal device determines whether the third parameter meets the third preset condition. If not, step 428 is performed, and if yes, step 429 is performed.

In this embodiment, the third preset condition is that the third parameter is equal to the first sub data.

Specifically, if the terminal device determines that the third parameter is not equal to the first sub-data, proceeding to step 428, if the terminal device determines that the third parameter is equal to the first sub-data, proceeding to step 429.

Step 428: The terminal device refuses to continue identity verification.

Step 429: The terminal device acquires a third timestamp.

The third timestamp shown in this embodiment is the time when the terminal device detects that the terminal device scans the two-dimensional code.

Step 430: The terminal device generates third verification data.

The third verification data generated by the terminal device shown in this embodiment includes a third parameter h(r, T1, T2) and a third timestamp T3.

Step 431: The terminal device sends the third verification data to the server.

Step 432: The server determines whether the third verification data meets the fourth preset condition, and if yes, performs step 433.

In this embodiment, the fourth preset condition is that the difference between the first timestamp T1 and the third timestamp T3 is less than or equal to the preset threshold, and the fourth preset condition is also the third parameter h(r, T1). , T2) is equal to the first sub-data h(r, T1, T2) included in the second verification data stored by the server.

Specifically, the server shown in this embodiment stores a preset threshold in advance, and after receiving the third timestamp, the server may determine whether the difference between the first timestamp and the third timestamp is less than or equal to Preset threshold.

The third parameter in this embodiment is sent by the terminal device to the server, and the first sub-data is generated by the server in step 416. In this step, the server needs to determine whether the third parameter is equal to the first sub-data.

Step 433: The server generates indication information.

In the embodiment, when the server determines that the third verification data meets the fourth preset condition, the server may generate indication information for indicating that the terminal device passes the verification.

Step 434: The server sends the indication information to the client device.

In this embodiment, when the server determines that the terminal device has passed the verification, the server may send the generated indication information to the client device.

Step 435: The client device receives the indication information.

In this embodiment, when the client device receives the indication information, it can determine that the current terminal device has passed the verification, and can perform the corresponding function.

For example, if the verification system shown in this embodiment is applied to the ticket reservation field, the client device may be a computer device capable of performing a ticket booking function. When the computer device receives the indication information sent by the server, the computer device is The corresponding function of the booking can be opened for the terminal device.

In the application scenario shown in FIG. 5, after the verification phase is completed, the method shown in this embodiment can continue to perform the phase of security avoidance.

Specifically, the method shown in this embodiment can avoid the risk of the terminal device.

In this embodiment, because the terminal device stores the key XA shown in step 408 for a long time, the terminal device needs to be well protected, and the terminal device shown in this embodiment is only used to scan the two-dimensional code of the client device. The core registration phase and the verification phase are performed on the remote server, and the generation process of the two-dimensional code is performed on the client device, thereby effectively reducing the security risk of the terminal device shown in this embodiment, and improving the terminal device. Safety.

With the method shown in this embodiment, the purpose of the attacker obtaining the server key through the terminal device is not feasible, because the one-way hash function shown in this embodiment is also called a one-way hash function, one-way hash. The function is irreversible, and the irreversible one-way hash function can make the attacker unable to obtain the key stored by the server, thereby further improving the security of the verification process.

By adopting the method shown in this embodiment, the security risk of the remote user is effectively reduced, because when the value of the corresponding random number r is not known, it is not feasible to obtain the legal user long-term key xA. On the other hand, if the information transmitted in the public channel is intercepted, it still cannot get r, because the one-way hash function is irreversible.

With the method shown in this embodiment, the man-in-the-middle attack and replay attack are effectively reduced. If the cracker attempts a legal timestamp T3 request intercepted from the public channel multiple times, the server receives the access request on the timestamp T3. . However, if the difference between the timestamp T1 and the timestamp T3 is not lower than the pre-stored time interval, the server can reject it. Moreover, the random number r is randomly selected by the server. Therefore, man-in-the-middle attacks and replay attacks will fail.

For a better understanding of the method shown in this embodiment, the method shown in this embodiment is described in detail below in conjunction with the application scenario:

In this application scenario, the verification system is applied to the payment domain. In this application scenario, the client device is a computer device capable of performing a payment function.

5, 6, and 7 are combined.

The specific process of generating a two-dimensional code by the client device shown in this application scenario is shown in the embodiment of FIG. 4, and details are not described herein.

Before the payment, the terminal device joins the verification system by scanning the two-dimensional code generated by the client device. After joining the verification system, the terminal device performs the process shown in FIG. 6 to register the terminal device to the server.

As shown in FIG. 6 , the terminal device sends the IDA to the server and the client device, and the specific process of the terminal device sending the IDA is shown in the embodiment shown in FIG. 4 , which is not described in this application scenario.

The server calculates the IDA to generate the XA. The specific generation process of the XA in this application scenario is shown in the embodiment shown in Figure 4, and is not described in this application scenario.

The server will send the generated XA to the terminal device to cause the terminal device to store the XA.

For details about the process of storing the XA on the terminal device, refer to the embodiment shown in Figure 4, which is not described in this application scenario.

As shown in FIG. 5, after the terminal device performs the registration phase to register the terminal device to the server, the verification phase can be performed. The specific process of the verification phase can be seen in FIG. 7.

During the verification phase, the authentication data is exchanged between the terminal device and the server. For the specific interaction process, refer to the detailed process shown in Figure 4, which is not described in this application scenario.

In FIG. 7, if the server determines that the terminal device has passed the verification, the server may send the indication information to the client device, so that the client device that receives the indication information determines that the terminal device has passed the verification, in the present In an application scenario, a client device can perform a payment operation with a verified terminal device.

In the fast-developing information age, the verification method shown in this embodiment can be adapted to people's habits, convenience, and daily production based on daily products and systematic design. The dynamic security boundary two-dimensional code based on the one-time password authentication protocol provided in this embodiment not only eliminates the use of the password verification table, but also shows the universal ubiquity of the terminal device and the network in the information age era. The method has a wide range of applications, and in the process of verification, the user does not need to add a new device, so that the method shown in this embodiment has a very high cost performance, can be popularized, and can eliminate the carrying of the prior art. The burden of a separate hardware token can also reduce the extra cost of SMS. Moreover, the method shown in this embodiment effectively improves the security, and the verification of the terminal device using the two-dimensional code improves the convenience and convenience of the original user identity verification.

The structure of the terminal device provided in this embodiment is described in detail from the perspective of the hardware entity. The specific structure of the terminal device provided in this embodiment is described in detail from the perspective of the function module.

The terminal device includes:

The scanning unit 801 is configured to scan a two-dimensional code generated by the client device, so that the terminal device that has scanned the two-dimensional code is registered to a server, and the two-dimensional code is based on the one-time password by the client device. generate;

a first generating unit 802, configured to generate first registration data corresponding to the terminal device;

The third sending unit 803 is configured to send the first registration data to the server, so that the server sends the second registration data to the terminal device, where the second registration data is the server according to the The one-way hash function calculates the first registration data and the preset key to generate data, and the preset key is a key pre-stored by the server;

The first receiving unit 804 is configured to receive the second registration data.

a first recording unit, configured to record a first timestamp, where the first timestamp is a time when the terminal device detects that the terminal device scans the two-dimensional code;

a second generating unit 805, configured to generate the first verification data, where the first verification data includes the first timestamp and the second registration data, so that the server determines that the first verification data is satisfied The second preset data is generated, where the first preset condition is that the first timestamp is equal to a second timestamp, and the second timestamp is that the server detects the The time at which the terminal device scans the end of the two-dimensional code, the second verification data includes a first sub-data, a second sub-data, and the second timestamp, wherein the first sub-data is The one-way hash function calculates, by the target random number, the first timestamp and the second timestamp, the generated data, the target random number is data randomly generated by the server, and the second The child data is data generated by the server by calculating a first parameter by using a first function, where the first parameter is generated by the server performing an exclusive OR operation on the target random number and the second registration data. It is.

The first sending unit 806 is configured to send the first verification data to the server, so that the server sends the second verification data to the terminal device, where the second verification data is a column function calculates the first verification data to generate data;

a second receiving unit 807, configured to receive the second verification data, where the second verification data includes a second timestamp, where the second timestamp is that the server detects that the terminal device scans the two-dimensional code End time

The first determining unit 808 is configured to determine whether the second verification data meets a second preset condition, where the second preset condition is that the first timestamp is equal to the second timestamp, and the first timestamp is The terminal device detects a time when the terminal device scans the two-dimensional code;

The triggering unit 809 is configured to: if the first determining unit determines that the second verification data meets the second preset condition, trigger the execution of the calculating unit to perform the second verification according to the one-way hash function The step of calculating the data to generate third verification data.

The calculating unit 810 is configured to calculate the second verification data according to the one-way hash function to generate third verification data;

Specifically, the calculating unit 810 includes:

a first calculating module 8101, configured to calculate, by using a second function, the second sub-data included in the second verification data to generate a second parameter;

a second calculating module 8102, configured to calculate, by using an exclusive OR operation, the second parameter and the second registration data to generate the target random number;

a third calculating module 8103, configured to calculate, by using the one-way hash function, the target random number, the first timestamp, and the second timestamp to generate a third parameter;

The determining module 8104 is configured to determine whether the third parameter meets a third preset condition, where the third preset condition is that the third parameter is equal to the first sub-data;

The obtaining module 8105 is configured to: if the determining module determines that the third parameter meets the third preset condition, acquire a third timestamp, where the third timestamp is that the terminal device detects that the terminal device scans The time at which the two-dimensional code begins;

a determining module 8106, configured to determine that the third verification data includes the third parameter and the third timestamp, so that the server determines that the third verification data meets a fourth preset condition And generating the indication information, where the fourth preset condition is that a difference between the first timestamp and the third timestamp is less than or equal to a preset threshold, and the fourth preset condition is further The third parameter is equal to the first sub-data included in the second verification data stored by the server.

a second sending unit 811, configured to send the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the terminal device has passed verification.

The specific process of the method for performing the authentication by the terminal device shown in FIG. 8 is shown in FIG. 4, which is not described in detail in this embodiment.

For the description of the beneficial effects obtained by the terminal device shown in FIG. 8 in the specific process of performing the identity verification method, please refer to the embodiment shown in FIG. 4, which is not specifically described in this embodiment.

FIG. 2 illustrates the specific structure of the server from the perspective of a hardware entity. The specific structure of the server is described in detail below from the perspective of the functional module in conjunction with the embodiment shown in FIG. 9:

The server includes:

The second receiving unit 901 is configured to receive first registration data that is sent by the terminal device and that is corresponding to the terminal device;

The second calculating unit 902 is configured to calculate the first registration data and the preset key according to the one-way hash function to generate second registration data, where the preset key is pre-stored by the server Key

The second sending unit 903 is configured to send the second registration data to the terminal device.

The first receiving unit 904 is configured to receive first verification data that is sent by the terminal device, where the first verification data is data that is generated by the terminal device after being registered to the server, and the terminal device passes the Scanning a QR code generated by the client device to register with the server, the two-dimensional code generated by the client device based on a one-time password;

a recording unit 905, configured to record a second timestamp, where the second timestamp is a time when the server detects that the terminal device scans the two-dimensional code;

The determining unit 906 is configured to determine whether the first verification data meets a first preset condition, where the first verification data includes a first timestamp and the second registration data, where the first timestamp is the terminal The device detects the time when the terminal device scans the two-dimensional code, and the first preset condition is that the first timestamp is equal to the second timestamp;

The triggering unit 907 is configured to trigger the first calculating unit to perform the first verification data according to the one-way hash function, if the determining unit determines that the first verification data meets the first preset condition A step of performing a calculation to generate second verification data.

a first calculating unit 908, configured to calculate the first verification data according to a one-way hash function to generate second verification data;

Specifically, the first calculating unit 908 includes:

a first calculating module 9081, configured to calculate, according to the one-way hash function, the target random number, the first timestamp, and the second timestamp to generate first sub-data, the target random number Data randomly generated for the server;

a second calculating module 9082, configured to perform an exclusive OR operation on the target random number and the second registration data to generate a first parameter;

a third calculating module 9083, configured to calculate the first parameter by using a first function to generate a second sub-data;

The first generation module 9084 is configured to generate second verification data, where the second verification data includes the first sub data, the second sub data, and the second timestamp.

The first sending unit 909 is configured to send the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate a third verification. data;

The first receiving unit 910 is configured to receive the third verification data that is sent by the terminal device, where the third verification data includes a third parameter and a third timestamp, where the third parameter is that the terminal device passes the Calculating, by the one-way hash function, the target random number, the first timestamp, and the second timestamp to generate a parameter, where the target random number is the terminal device, the second parameter, and the The second registration data is calculated by an exclusive OR operation to generate a random number, and the second parameter is that the terminal device calculates the second sub data included in the second verification data by using a second function to generate The third timestamp is a time when the terminal device detects that the terminal device scans the two-dimensional code;

The generating unit 911 is configured to generate indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

Specifically, the generating unit 911 includes:

The determining module 9111 is configured to determine whether the third verification data meets a fourth preset condition, where the fourth preset condition is that a difference between the first timestamp and the third timestamp is less than or equal to Determining a threshold, and the fourth preset condition is further that the third parameter is equal to the first sub-data included in the second verification data stored by the server;

The second generation module 9112 is configured to generate the indication information if the determining module determines that the third verification data meets the fourth preset condition.

The second sending unit 912 is configured to send the indication information to the client device.

The specific process of the method for performing the authentication by the server shown in FIG. 9 is shown in FIG. 4, which is not described in detail in this embodiment.

For the description of the beneficial effects of the specific process of performing the authentication method, the details of the server shown in FIG. 9 are shown in FIG. 4 , and details are not described in this embodiment.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of computer readable instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to explain the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents. The modifications and substitutions of the embodiments do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (20)

1. A method of authentication, including:

   The terminal device scans the two-dimensional code generated by the client device, so that the terminal device that has scanned the two-dimensional code is registered to the server, and the two-dimensional code is generated by the client device based on the one-time password;

   Transmitting, by the terminal device, first verification data to the server, so that the server sends second verification data to the terminal device, where the second verification data is that the server performs a one-way hash function The first verification data is calculated to generate data;

   The terminal device calculates the second verification data according to the one-way hash function to generate third verification data; and

   The terminal device sends the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the terminal device has passed the verification.
2. The method of claim 1 further comprising:

   The terminal device generates first registration data corresponding to the terminal device;

   Transmitting, by the terminal device, the first registration data to the server, so that the server sends the second registration data to the terminal device, where the second registration data is The column function calculates the first registration data and the preset key to generate data, and the preset key is a key pre-stored by the server;

   The terminal device receives the second registration data.
3. The method of claim 2, further comprising:

   The terminal device records a first timestamp, where the first timestamp is a time when the terminal device detects that the terminal device scans the two-dimensional code; and

   The terminal device generates the first verification data, where the first verification data includes the first timestamp and the second registration data, so that the server determines that the first verification data meets a first preset The second verification data is generated, where the first preset condition is that the first timestamp is equal to a second timestamp, and the second timestamp is that the server detects that the terminal device scans When the two-dimensional code ends, the second verification data includes a first sub-data, a second sub-data, and the second timestamp, wherein the first sub-data is the one-way according to the server The hash function calculates, by the target random number, the first timestamp and the second timestamp, the generated data, the target random number is data randomly generated by the server, and the second sub-data is The server calculates, by using a first function, the first parameter to generate data, where the first parameter is data generated by the server performing an exclusive OR operation on the target random number and the second registration data.
4. The method of claim 1 further comprising:

   Receiving, by the terminal device, the second verification data, where the second verification data includes a second timestamp, where the second timestamp is a time when the server detects that the terminal device scans the two-dimensional code;

   Determining, by the terminal device, whether the second verification data meets a second preset condition, where the second preset condition is that the first timestamp is equal to the second timestamp, and the first timestamp is the terminal device Detecting a time when the terminal device scans the two-dimensional code; and

   If the terminal device determines that the second verification data meets the second preset condition, triggering execution by the terminal device to calculate the second verification data according to the one-way hash function to generate third verification data. A step of.
5. The method according to claim 3, wherein the calculating, by the terminal device, the second verification data according to the one-way hash function to generate the third verification data comprises:

   The terminal device calculates the second sub-data included in the second verification data by using a second function to generate a second parameter;

   Transmitting, by the terminal device, the second parameter and the second registration data by an exclusive OR operation to generate the target random number;

   The terminal device calculates the target random number, the first timestamp, and the second timestamp by using the one-way hash function to generate a third parameter;

   Determining, by the terminal device, whether the third parameter meets a third preset condition, where the third preset condition is that the third parameter is equal to the first sub-data;

   If the terminal device determines that the third parameter meets the third preset condition, the terminal device acquires a third timestamp, where the third timestamp is that the terminal device detects that the terminal device scans the The time at which the QR code begins; and

   Determining, by the terminal device, that the third verification data includes the third parameter and the third timestamp, so that the server generates, if it is determined that the third verification data meets a fourth preset condition In the indication information, the fourth preset condition is that a difference between the first timestamp and the third timestamp is less than or equal to a preset threshold, and the fourth preset condition is further The third parameter is equal to the first sub-data included in the second verification data stored by the server.
6. A method of authentication, including:

   Receiving, by the server, the first verification data sent by the terminal device, where the first verification data is data generated by the terminal device after being registered to the server, and the terminal device generates the second The dimension code is registered to the server, and the two-dimensional code is generated by the client device based on the one-time password;

   The server calculates the first verification data according to a one-way hash function to generate second verification data;

   Sending, by the server, the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data;

   Receiving, by the server, the third verification data sent by the terminal device;

   The server generates indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

   The server sends the indication information to the client device.
7. The method of claim 6 further comprising:

   Receiving, by the server, first registration data that is sent by the terminal device and corresponding to the terminal device;

   The server calculates the first registration data and the preset key according to the one-way hash function to generate second registration data, where the preset key is a key pre-stored by the server;

   The server sends the second registration data to the terminal device.
8. The method of claim 7 further comprising:

   The server records a second timestamp, where the second timestamp is a time when the server detects that the terminal device scans the two-dimensional code;

   Determining, by the server, that the first verification data meets a first preset condition, where the first verification data includes a first timestamp and the second registration data, where the first timestamp is detected by the terminal device The terminal device scans a time when the two-dimensional code ends, and the first preset condition is that the first timestamp is equal to a second timestamp;

   If the server determines that the first verification data meets the first preset condition, triggering execution of the step of the server performing calculation on the first verification data according to a one-way hash function to generate second verification data .
9. The method according to claim 8, wherein the calculating, by the server, the first verification data according to the one-way hash function to generate the second verification data comprises:

   The server calculates the target random number, the first timestamp, and the second timestamp according to the one-way hash function to generate first sub-data, where the target random number is random to the server Generated data;

   The server performs an exclusive OR operation on the target random number and the second registration data to generate a first parameter;

   The server calculates the first parameter by using a first function to generate a second sub-data; and

   The server generates second verification data, the second verification data including the first sub data, the second sub data, and the second timestamp.
10. The method according to claim 9, wherein the third verification data comprises a third parameter and a third timestamp, the third parameter being that the terminal device pairs the said one-way hash function The target random number, the first timestamp, and the second timestamp are calculated to generate a parameter, where the target random number is performed by the terminal device by using an exclusive OR operation on the second parameter and the second registration data. Computation to generate a random number, where the second parameter is a parameter generated by the terminal device by using the second function to calculate the second sub-data included in the second verification data, the third timestamp And detecting, by the terminal device, a time when the terminal device scans the two-dimensional code;

    The generating information by the server according to the third verification data includes:

    The server determines whether the third verification data meets a fourth preset condition, where the fourth preset condition is that a difference between the first timestamp and the third timestamp is less than or equal to a preset threshold. And the fourth preset condition is further that the third parameter is equal to the first sub-data included in the second verification data stored by the server; and

    And if the server determines that the third verification data meets the fourth preset condition, the server generates the indication information.
11. A terminal device, comprising:

    a scanning unit, configured to scan a two-dimensional code generated by the client device, to register the terminal device that has scanned the two-dimensional code to a server, where the two-dimensional code is generated by the client device based on a one-time password ;

    a first sending unit, configured to send the first verification data to the server, so that the server sends the second verification data to the terminal device, where the second verification data is a one-way hash according to the server a function for calculating the first verification data to generate data;

    a calculating unit, configured to calculate the second verification data according to the one-way hash function to generate third verification data; and

    a second sending unit, configured to send the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the terminal device has passed the verification .
12. A terminal device comprising a memory and one or more processors, the memory storing computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processors perform the following steps:

    Scanting a two-dimensional code generated by the client device to register the scanned two-dimensional code to the server, the two-dimensional code being generated by the client device based on the one-time password;

    Transmitting the first verification data to the server, so that the server sends the second verification data to, the second verification data is that the server calculates the first verification data according to the one-way hash function Generated data;

    Calculating the second verification data according to the one-way hash function to generate third verification data; and

    And sending the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the verification has been passed.
13. The terminal device according to claim 12, wherein said computer readable instructions are executed by said one or more processors, further causing said one or more processors to perform the following steps:

    Generating and corresponding first registration data;

    Transmitting the first registration data to the server, so that the server sends the second registration data to, the second registration data is that the server registers the first registration according to the one-way hash function Data and a preset key are calculated to generate data, and the preset key is a key pre-stored by the server;

    Receiving the second registration data.
14. The terminal device according to claim 13, wherein said computer readable instructions are executed by said one or more processors, further causing said one or more processors to perform the following steps:

    Recording a first timestamp, where the first timestamp is detecting the end of scanning the two-dimensional code; and

    Generating the first verification data, the first verification data including the first timestamp and the second registration data, so that the server determines that the first verification data meets a first preset condition Generating the second verification data, the first preset condition is that the first timestamp is equal to a second timestamp, and the second timestamp is a time when the server detects that the scanning of the two-dimensional code ends. The second verification data includes a first sub-data, a second sub-data, and the second timestamp, wherein the first sub-data is a target random number of the server according to the one-way hash function, The first timestamp and the second timestamp are calculated to generate data, the target random number is data randomly generated by the server, and the second sub-data is the first function of the server The parameter is calculated to generate data, and the first parameter is data generated by the server performing an exclusive OR operation on the target random number and the second registration data.
15. A server, comprising:

    a first receiving unit, configured to receive first verification data that is sent by the terminal device, where the first verification data is data generated by the terminal device after being registered to the server, and the terminal device scans The two-dimensional code generated by the client device is registered to the server, and the two-dimensional code is generated by the client device based on the one-time password;

    a first calculating unit, configured to calculate the first verification data according to a one-way hash function to generate second verification data;

    a first sending unit, configured to send the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data. ;

    a first receiving unit, configured to receive the third verification data sent by the terminal device;

    a generating unit, configured to generate indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

    a second sending unit, configured to send the indication information to the client device.
16. A server comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors such that the one or more The processor performs the following steps:

    Receiving first verification data sent by the terminal device, where the first verification data is data generated by the terminal device after being registered, and the terminal device is registered by scanning a QR code generated by the client device to The two-dimensional code is generated by the client device based on a one-time password;

    Calculating the first verification data according to a one-way hash function to generate second verification data;

    Transmitting the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data;

    Receiving the third verification data sent by the terminal device;

    Generating indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

    Sending the indication information to the client device.
17. The server according to claim 16, further comprising:

    Receiving, by the terminal device, first registration data corresponding to the terminal device;

    Calculating the first registration data and the preset key according to the one-way hash function to generate second registration data, where the preset key is a pre-stored key;

    Sending the second registration data to the terminal device.
18. The server according to claim 17, further comprising:

    Recording a second timestamp, where the second timestamp is a time when the terminal device detects that the two-dimensional code is scanned;

    Determining whether the first verification data meets a first preset condition, where the first verification data includes a first timestamp and the second registration data, where the first timestamp is that the terminal device detects the terminal The time when the device scans the end of the two-dimensional code, where the first preset condition is that the first timestamp is equal to the second timestamp;

    If it is determined that the first verification data satisfies the first preset condition, triggering a step of performing calculation on the first verification data according to a one-way hash function to generate second verification data.
19. One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the following steps:

    Scanting a two-dimensional code generated by the client device to register the scanned two-dimensional code to the server, the two-dimensional code being generated by the client device based on the one-time password;

    Transmitting the first verification data to the server, so that the server sends the second verification data to, the second verification data is that the server calculates the first verification data according to the one-way hash function Generated data;

    Calculating the second verification data according to the one-way hash function to generate third verification data; and

    And sending the third verification data to the server, so that the server sends the indication information to the client device, where the indication information is used to indicate that the verification has been passed.
20. One or more non-volatile storage media storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the following steps:

    Receiving first verification data sent by the terminal device, where the first verification data is data generated by the terminal device after being registered, and the terminal device is registered by scanning a QR code generated by the client device to The two-dimensional code is generated by the client device based on a one-time password;

    Calculating the first verification data according to a one-way hash function to generate second verification data;

    Transmitting the second verification data to the terminal device, so that the terminal device calculates the second verification data according to the one-way hash function to generate third verification data;

    Receiving the third verification data sent by the terminal device;

    Generating indication information according to the third verification data, where the indication information is used to indicate that the terminal device has passed verification;

    Sending the indication information to the client device.

Images