WO2018161807A1 - 用户身份校验方法及装置 - Google Patents

用户身份校验方法及装置 Download PDF

Info

Publication number
WO2018161807A1
WO2018161807A1 PCT/CN2018/077094 CN2018077094W WO2018161807A1 WO 2018161807 A1 WO2018161807 A1 WO 2018161807A1 CN 2018077094 W CN2018077094 W CN 2018077094W WO 2018161807 A1 WO2018161807 A1 WO 2018161807A1
Authority
WO
WIPO (PCT)
Prior art keywords
request message
user
code
authorization server
identity verification
Prior art date
Application number
PCT/CN2018/077094
Other languages
English (en)
French (fr)
Inventor
刘艳
朱锦涛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018161807A1 publication Critical patent/WO2018161807A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN

Definitions

  • Embodiments of the present invention relate to the field of Internet of Things technologies, and in particular, to a user identity verification method and apparatus.
  • some devices are resource-constrained devices, such as game consoles, televisions, multimedia hubs, and the like. This type of device is mainly reflected in the problem of low storage capacity. Usually, such devices need to access the resource server to obtain data. In the process, for the security of the data, the identity of the user who uses the device needs to be verified. Test. In the actual application scenario, since the device still lacks the user interface, that is, the keyboard input is not supported, in the user identity verification process, it is generally required to perform verification by using a terminal such as a mobile phone or a computer.
  • the mainstream verification process is mainly based on the OAuth2.0 protocol
  • the implementation framework includes a device, an authorization server, and a resource server.
  • the main implementation process of the user identity verification includes: the device sends a request message to the authorization server, and the request is sent. The message carries the device identifier, and the authorization server receives the request message. After determining that the device identifier belongs to the device identifier managed by the device, the device allocates and returns a check link and a user check code for the device, and the user can obtain the device through the device. Verify the link and the user check code. After that, the user can start the browser through the terminal and input the check link and the user check code to log in to the authorization server.
  • the authorization server performs login verification based on the user check code. When the login verification is successful, it is determined that the user identity verification is passed. After determining that the user identity verification is passed, the authorization server may send an authorization token to the device, so that the device can use the authorization token to access the data in the resource server.
  • the authorization server since the authorization server only verifies the user identity according to the assigned user verification code, in the actual application scenario, since any user may obtain the user from the terminal, The user check code, therefore, the user identity verification method is inefficient and less secure.
  • the embodiment of the invention provides a user identity verification method and device.
  • the technical solution is as follows:
  • a user identity verification method comprising:
  • the authorization server receives the first request message that carries the device identifier and the ciphertext information sent by the device, and if the device determines that the device belongs to the device managed by the device, assigns a check link and a user check code to the device, and sends the device. At least one of the device or a terminal associated with the device.
  • the terminal displays the display interface based on the verification link, and the user can input the user check code and the security code in the display interface, and then the terminal sends a second request message carrying the user check code and the security code to the authorization server.
  • the authorization server After receiving the second request message, the authorization server obtains the user check code and the security code in the second request message, and if the second request message is determined to be associated with the first message based on the user check code, When the security code decrypts the ciphertext information and obtains the device identifier, it is determined that the user identity verification is passed.
  • the user identity verification is performed not only according to the user check code, but also the ciphertext information and the security code are used for user identity verification, thereby improving the efficiency and security of the user identity verification.
  • the binding code when the first request message is a binding request message, after determining that the user identity verification is passed, the binding code is also sent to the device, and the device is assigned a token request permission, so that the device is based on The binding code updates the security code, and in the subsequent process, requests the authorization server to obtain the authorization token using the updated security code. In this way, the security of the user identity verification is improved.
  • the authorization token is sent to the device, so that the device can be accessed by using the authorization token resource server. data.
  • the authorization server updates the status of the device to the unbind state, and notifies the user that the current device is already unbundled. status.
  • the unbind state the user cannot use the device to request an authorization token from the authorization server until the device is rebinded. In this way, when the device is transferred to a new user, the new user can re-use the device to request authorization server binding.
  • the authorization server before receiving the second request message sent by the terminal, allocates a user check code according to the device identifier carried in the first request message, and determines that the device belongs to the device managed by the authorization server, and The user check code is sent to at least one of the device and the terminal associated with the device, so that the user can obtain the user check code from the device or the terminal, so as to facilitate subsequent use of the user check code.
  • the user identity verification is implemented in combination with the security code, which improves the security of the user identity verification.
  • the specific implementation manner of the verification link and the user verification code being sent to the terminal associated with the device includes: acquiring the stored contact information based on the device identifier, where the contact information includes an email account, a phone number, Any one of the user accounts, by which the verification link and the user verification code are sent to the terminal associated with the device.
  • the method for obtaining the check link corresponding to the device identifier is used to send the check link and the user check code to the terminal, so that the user can directly learn the check link and the user check code from the terminal. Improve the user experience.
  • the authorization server before the obtaining the stored contact mode based on the device identifier, the authorization server sends an increase contact indication to the device, where the added contact indication is used to indicate that the contact information is added in the second request message, and the The contact information is stored corresponding to the device identifier. In this way, the subsequent authorization server can obtain the corresponding contact information according to the device identifier.
  • a user identity verification apparatus configured to implement the user identity verification method described in the above first aspect.
  • an embodiment of the present invention provides a computer storage medium comprising instructions that, when run on a computer, cause the computer to perform the method described in the first aspect above.
  • an embodiment of the present invention further provides a computer program product comprising instructions, which when executed on a computer, cause the computer to perform the method described in the first aspect above.
  • the embodiment of the present invention further provides a communication chip, which is applied to an authorization server, where the communication chip includes: an input/output interface, a memory, and at least one processor, and the memory and the input/output interface are connected through a bus.
  • the at least one processor is in communication, the memory is stored with program code, and the at least one processor is configured to invoke program code, such that the authorization server performs the user identity verification method described in the first aspect above.
  • the technical solution provided by the embodiment of the present invention has the beneficial effects that the authorization server receives the first request message of the device identifier and the ciphertext information sent by the device, and if the authorization server determines, according to the device identifier, the device belongs to the device managed by the device. And assigning a user check code to at least one of the device or a terminal associated with the device, such that the user can learn the user check code from the device or the terminal.
  • the terminal sends a second request message carrying the user check code and the security code to the authorization server, and if the authorization server determines, according to the user check code, the second request message is associated with the first request message.
  • the ciphertext information can be decrypted using the security code in the second request message to obtain the device identifier, it indicates that the user may be the owner of the device, that is, the user identity verification is determined to pass. That is, in the user identity verification process, not only the user verification code is used for verification, but also the ciphertext information and the security code are used for user identity verification, thereby improving the efficiency and security of the user identity verification.
  • FIG. 1A is a schematic diagram showing an implementation environment according to an exemplary embodiment
  • FIG. 1B is a schematic structural diagram of an authorization server 120 according to an exemplary embodiment
  • FIG. 2 is a flowchart of a user identity verification method according to an exemplary embodiment
  • FIG. 3 is a flowchart of a user identity verification method according to another exemplary embodiment
  • FIG. 4 is a flowchart of a user identity verification method according to another exemplary embodiment
  • FIG. 5A is a schematic structural diagram of a user identity verification apparatus according to an exemplary embodiment
  • FIG. 5B is a schematic structural diagram of a user identity verification apparatus according to another exemplary embodiment
  • FIG. 5C is a schematic structural diagram of a user identity verification apparatus according to another exemplary embodiment.
  • FIG. 5D is a schematic structural diagram of a user identity verification apparatus according to another exemplary embodiment.
  • FIG. 5E is a schematic structural diagram of a user identity verification apparatus according to another exemplary embodiment.
  • FIG. 5F is a schematic structural diagram of a user identity verification apparatus according to another exemplary embodiment.
  • FIG. 5G is a schematic structural diagram of a user identity verification apparatus according to another exemplary embodiment.
  • FIG. 1A is a schematic diagram of an implementation environment, according to an exemplary embodiment.
  • the implementation environment mainly includes a device 110, an authorization server 120, and a terminal 130 associated with the device 110.
  • the device 110 and the terminal 130 can be connected to the authorization server 120 through a wired network or wirelessly.
  • the device 110 is a resource-constrained device, which is mainly embodied in the lack of a valid user interface, that is, keyboard input is not supported.
  • the device 110 can be, for example, a Game Console (GC), a television (televisions, TVs). ) and devices such as Multimedia Hubs (MH).
  • GC Game Console
  • TVs television
  • MH Multimedia Hubs
  • the device 110 may be configured with a display device, and the display device may be used to display various information.
  • the terminal 130 may be used by the auxiliary device 110 to send a request message to the authorization server 120 to request a user identity check. Since the device 110 lacks an effective user interface, the user can perform user identity verification by means of the terminal 130 during actual implementation. For example, the terminal 130 can be used to display a display interface for the user based on the verification link allocated by the authorization server 120 (which can be displayed by the two-dimensional code), so that the user can input the security code and the user verification code in the display interface. Therefore, the terminal 130 sends a second request message (check request message) carrying the security code and the user check code to the authorization server 120, so that the authorization server 120 performs user identity verification.
  • the terminal 130 may be a device such as a mobile phone, a tablet computer, or a computer, which is not limited by the embodiment of the present invention.
  • the terminal 130 can connect to the device 110 through a wired network or a wireless network, and transmit data through the connection.
  • the device 110 can use the connection to check the user check code, check link, and the like.
  • the information is sent to the terminal 130.
  • the data transmission may be implemented by using the Out of Band (OOB) technology between the terminal 130 and the device 110.
  • OOB Out of Band
  • the authorization server 120 is mainly used to implement the user identity verification method as described in the following embodiments of FIG. 2 to FIG. 4 .
  • the authorization server 120 may be a server or multiple servers.
  • the server cluster is not limited in this embodiment of the present invention.
  • FIG. 1B is a schematic structural diagram of an authorization server 120 including a transmitter 1201, a receiver 1202, a memory 1203, a processor 1204, and a communication bus 1205, according to an exemplary embodiment. It will be understood by those skilled in the art that the structure of the authorization server 120 shown in FIG. 1B does not constitute a limitation to the authorization server 120, and may include more or less components than those illustrated, or may combine certain components, or different. The component arrangement is not limited in this embodiment of the present application.
  • the transmitter 1201 can be used to send data and/or signaling to the device 110 or the terminal 130.
  • the receiver 1202 can be configured to receive data and/or signaling, etc., transmitted by the device 110 or the terminal 130.
  • the memory 1203 can be used to store data such as contact information, device identification, and the memory 1203 can also be used to store one or more running programs and/or modules for performing the user identity verification method. In a specific implementation, the memory 1203 can also be used to invoke multiple running programs and/or modules in an external software system.
  • the processor 1204 is a control center of the authorization server 120.
  • the processor 1204 can be a general purpose CPU, a microprocessor, an application specific integrated circuit ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.
  • the processor 1204 can be implemented by any of the embodiments of Figures 2, 3, and 4 below by running or executing a software program and/or module stored in the memory 1203, and recalling data stored in the memory 1203. User identity verification method.
  • the meaning of the first request message sent by the device to the authorization server may be multiple, for example, the first request message may be a binding request message or a token acquisition request message. And unbind the request message.
  • the embodiment of the present invention will describe the user identity verification process according to the above three cases.
  • FIG. 2 is a flowchart of a user identity verification method according to an exemplary embodiment.
  • the first request message is used as an example of a binding request message, and may include the following step:
  • Step 201 The device sends a binding request message to the authorization server, and the authorization server receives the binding request message sent by the device, where the binding request message carries the device identifier and ciphertext information, and the ciphertext information is used by the device based on the security code to the device.
  • the identity is encrypted.
  • the device identifier may be used to uniquely identify a device.
  • the device identifier may be information (Identification, ID) information of the device.
  • the device identifier may also be a client identifier, which is not limited in this embodiment of the present invention.
  • the security code is usually an initial security code, which is set and provided by the vendor when the device is shipped from the factory.
  • the user can obtain information from the device, the label, and the like. Know.
  • the security code can be "0000".
  • the binding request is required to obtain the token request permission from the authorization server based on the security code, that is, in the actual application scenario, only after binding
  • the device has permission to request an authorization token from the authorization server. To do this, the device sends a binding (initial binding) request message to the authorization server.
  • the binding request message may be sent by the device when receiving the binding request instruction, and the binding request instruction may be triggered by a user, and the user may trigger by a specified operation, which may be a button operation or the like.
  • the device may be provided with a binding button, and the user may press the binding button.
  • the device detects the user pressing the binding button, it determines that the binding command is received.
  • the device encrypts the device identifier based on the security code to obtain the ciphertext information, and then the device generates a binding request message based on the device identifier and the ciphertext information, and sends the binding request message to the authorization server.
  • the process of encrypting the device identifier based on the security code to obtain the ciphertext information may be referred to the related art.
  • the embodiment of the present invention does not limit the encryption algorithm.
  • Step 202 When the authorization server determines that the device belongs to the device managed by the authorization server based on the device identifier, the user check code is allocated.
  • the device identifier of all devices managed by itself may be pre-stored in the authorization server. After receiving the binding request message, the authorization server queries whether the device identifier is included in all the device identifiers. If the device identifier is included in all the device identifiers, the device can be determined to belong to the device managed by itself.
  • the implementation process of determining whether the device belongs to the managed device based on the device identifier is only exemplary. In an actual implementation process, it may be determined by other means to determine whether the device belongs to the device.
  • the device to be managed is not limited in this embodiment of the present invention.
  • the user check code is assigned when the authorization server determines that the device belongs to the device managed by the authorization server based on the device identifier.
  • the authorization server also allocates a verification link, and the user can request an identity verification from the authorization server by the terminal based on the verification link.
  • the implementation manner of the authorization server to allocate the check link and the user check code can be referred to related technologies.
  • the user check code can be randomly allocated by the authorization server, and the check link can be pre-stored by the authorization server.
  • the root link is generated according to a certain generation strategy, which is not limited by the embodiment of the present invention.
  • Step 203 The authorization server sends the user verification code to at least one of the device and a terminal associated with the device.
  • the authorization server in addition to the user check code, also sends the allocated check link to at least one of the device and the terminal associated with the device.
  • the authorization server may send the check link and the user check code to the device.
  • the device can display the verification link and the user verification code through the display device configured by itself, so that the user can read the verification link displayed by the device and the user verification code from the display device.
  • the device may also send the user check code and the check link to the terminal through the connection described in the embodiment of FIG. 1A, so that the user can learn the check link and the user check from the terminal. code.
  • the authorization server may also send the check link and the user check code to the terminal associated with the device, and the user may directly learn the check link and the terminal from the terminal. User check code.
  • the authorization server may also send the check link and the user check code to the device and the terminal associated with the device.
  • the authorization server may directly send the check link and the user check code to at least one of the device and a terminal associated with the device.
  • the authorization server may also carry the check link and the user check code by using the response message, that is, when the authorization server receives the binding request message sent by the device and determines that the device belongs to the managed device based on the device identifier, Sending a response message to at least one of the device and the terminal associated with the device, the response message carrying the check link and the user check code.
  • Step 204 The terminal sends a second request message to the authorization server, and the authorization server receives the second request message sent by the terminal, where the second request message carries the user check code and the security code.
  • the check link and the user check code may be obtained from the device, or may be received by the terminal from the authorization server.
  • the second request message may be sent by the terminal upon receiving the second request to send instruction, which may be triggered by the user, and the user may be triggered by an operation such as clicking, sliding, or the like.
  • the authorization server sends the check link and the user check code to the device in the foregoing step 203
  • the user may read the check link and the user check code from the device, and then, in the terminal, Log in to the browser and enter the check link in the browser. Thereafter, the terminal displays a display interface based on the verification link, and the user inputs a user verification code and a security code in the display interface.
  • a second request sending option may be provided in the display interface.
  • the second request sending option may be clicked.
  • the terminal detects the click operation of the second request sending option, the terminal determines to receive.
  • the terminal generates a second request message based on the user check code and the security code, and sends the second request message to the authorization server.
  • Step 205 If the authorization server determines that the second request message is associated with the binding request message based on the user check code, when the ciphertext information is decrypted by using the security code carried in the second request message to obtain the device identifier. , to determine the user identity verification passed.
  • the authorization server after receiving the second request message, acquires the user check code in the second request message, and determines that the user check code is allocated after receiving the binding request message. Whether the user check codes are the same, and if they are the same, determining that the second request message is associated with the binding request message.
  • the implementation manner of determining whether the second request message is associated with the binding request message based on the user check code is merely exemplary. In another embodiment, the user may also be based on other methods.
  • the verification code determines whether the second request message is associated with the binding request message, which is not limited by the embodiment of the present invention.
  • the authorization server decrypts the ciphertext information in the binding request message by using the security code carried in the second request message. If the ciphertext information can be decrypted by using the security code in the second request message, and the device identifier is obtained, the user identity verification may be determined to pass; otherwise, the user identity verification is determined to be unsuccessful. User identity verification.
  • the user identity verification method provided by the embodiment of the present invention has been implemented.
  • the security code is provided by the supplier when the device is shipped from the factory, and usually, the security codes of the respective devices may be the same, for example, both are "0000", in which case, the other is caused. It is easy for the user to know the security code and the security is poor.
  • the security code is also updated. For details, refer to the following steps 206 to 208.
  • Step 206 The authorization server sends a binding code to the device, and the device receives the binding code, where the binding code is used by the device to update the security code.
  • the binding code can be randomly generated by the authorization server.
  • the authorization server may carry the binding code by using a binding success message, where the binding success message is used to notify the user that the device has been successfully bound.
  • Step 207 The authorization server allocates a token request permission to the device, so that the device can request the authorization server to acquire the authorization token based on the updated security code.
  • the device in order to record the binding condition of the device, after the binding code is sent to the device, the device is assigned a token request permission. After the authorization server assigns the token request permission to the device, the device can use the updated security code to perform the user identity verification during the subsequent request for obtaining the authorization token.
  • the authorization server assigns the token request permission to the device, the device can use the updated security code to perform the user identity verification during the subsequent request for obtaining the authorization token.
  • Step 208 The device updates the security code based on the binding code.
  • the device may generate a new security code by using a hash algorithm according to the binding code, so as to implement updating the security code.
  • the new security code is generated by using the Hash algorithm as an example.
  • another algorithm may be used to generate a new security code, which is not limited by the embodiment of the present invention.
  • the device only describes the security code according to the binding code as an example.
  • the device may also update the security code based on the binding code and other information.
  • the device may also be based on the binding.
  • the security code is updated by the fixed code and the device identifier, which is not limited by the embodiment of the present invention.
  • the updated security code may be displayed by the display device, or the updated security code may be sent to the terminal associated with the device, so that the user can learn the update. Security code.
  • the specific implementation manner of sending the user verification code to the terminal associated with the device includes: acquiring, according to the device identifier, a stored contact information, where the contact information includes any one of an email account, a phone number, and a user account.
  • the contact information includes any one of an email account, a phone number, and a user account.
  • the user check code is sent to the terminal associated with the device.
  • the verification link may also be sent to the terminal associated with the device in this manner.
  • the authorization server sends an increase contact indication to the device, where the contact information indication is used to indicate that the contact information is added to the second request message, and the contact manner is Corresponding to the device identifier is stored.
  • the added contact indication may be carried by the foregoing response message, that is, the added contact indication may be sent together with the verification link and the user check code, and then the user indicates according to the added contact manner. Add a contact method in the second request message.
  • the authorization server receives the first request message of the device identifier and the ciphertext information sent by the device, and if the authorization server determines, according to the device identifier, that the device belongs to the device managed by the device, the user verification code is allocated. And transmitting to the device or at least one of the terminals associated with the device, such that the user can learn the user check code from the device or the terminal.
  • the terminal sends a second request message carrying the user check code and the security code to the authorization server, and if the authorization server determines, according to the user check code, the second request message is associated with the first request message.
  • the ciphertext information can be decrypted using the security code in the second request message to obtain the device identifier, it indicates that the user may be the owner of the device, that is, the user identity verification is determined to pass. That is, in the user identity verification process, not only the user verification code is used for verification, but also the ciphertext information and the security code are used for user identity verification, thereby improving the efficiency and security of the user identity verification.
  • FIG. 3 is a flowchart of a user identity verification method according to another exemplary embodiment.
  • the first request message is used as an example for the token acquisition request message, and may specifically include The following steps:
  • Step 301 The device sends a token acquisition request message to the authorization server, and the authorization server receives the token acquisition request message sent by the device, where the token acquisition request message carries the device identifier and the ciphertext information, and the ciphertext information is secure by the device.
  • the code is encrypted by the device identifier.
  • the device when a user wants to use a device to access data from a resource server, the device needs to access using an authorization token. Before the device is used, the device needs to obtain the authorization token. In the process of obtaining the authorization token, the authorization server needs to perform user identity verification.
  • the security code is usually a security code determined by updating the initial security code during the binding process. That is, after the authorization server assigns the token request permission to the device, when the device needs to request the authorization server to obtain the authorization token to access the data, the updated security code is used for identity verification.
  • the token acquisition request message is sent by the device after receiving the token acquisition request instruction, and the token acquisition request instruction may be triggered by the user, and the user may configure the device by itself.
  • the token acquisition button is triggered after the specified operation is performed.
  • the specified operation may be an operation such as pressing.
  • Step 302 When the authorization server determines that the device belongs to the managed device based on the device identifier, assign a user check code.
  • step 202 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 303 The authorization server sends the user check code to at least one of the device and a terminal associated with the device.
  • step 203 in the embodiment of FIG. 2, which is not described in detail herein.
  • the device may continuously detect the authorization server according to the local policy, that is, send a probe message to the authorization server to notify the authorization server that it is waiting for identity authentication.
  • Step 304 The terminal sends a second request message to the authorization server, and the authorization server receives the second request message sent by the terminal, where the second request message carries the user check code and the security code.
  • step 204 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 305 If the authorization server determines that the second request message is associated with the token acquisition request message based on the user verification code, decrypting the ciphertext information by using the security code carried in the second request message to obtain the When the device is identified, it is determined that the user identity verification is passed.
  • step 205 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 306 The authorization server sends an authorization token to the device, and the device receives the authorization token, and the authorization token is used by the device to access data from the resource server.
  • the authorization server may send an authorization token to the device, so that the device uses the authorization token from the resource. Access data in the server.
  • the authorization server may directly send the authorization token to the device, or the authorization server may also carry the authorization token through the response message, which is not limited in this embodiment of the present invention.
  • the authorization server may also assign a specified authorization token to the device, for example, the specified authorization token may be a fresh token.
  • the specified authorization token can be used to subsequently re-request the authorization token to the authorization server using the specified authorization token when the authorization token expires or expires. In this way, the device does not need to go through the foregoing user identity verification process to re-request the authorization token to the authorization server by using the specified authorization token, thereby improving the speed of obtaining the authorization token, thereby improving the data access speed.
  • the authorization server receives the first request message of the device identifier and the ciphertext information sent by the device, and if the authorization server determines, according to the device identifier, that the device belongs to the device managed by the device, the user verification code is allocated. And transmitting to the device or at least one of the terminals associated with the device, such that the user can learn the user check code from the device or the terminal.
  • the terminal sends a second request message carrying the user check code and the security code to the authorization server, and if the authorization server determines, according to the user check code, the second request message is associated with the first request message.
  • the ciphertext information can be decrypted using the security code in the second request message to obtain the device identifier, it indicates that the user may be the owner of the device, that is, the user identity verification is determined to pass. That is, in the user identity verification process, not only the user verification code is used for verification, but also the ciphertext information and the security code are used for user identity verification, thereby improving the efficiency and security of the user identity verification.
  • FIG. 4 is a flowchart of a user identity verification method according to another exemplary embodiment.
  • the first request message is used as an example of the unbinding request message, and may specifically include the following. Several steps:
  • Step 401 The device sends an unbinding request message to the authorization server, and the authorization server receives the unbinding request message sent by the device, where the unbinding request message carries the device identifier and the ciphertext information, and the ciphertext information is used by the device based on the security code.
  • the device ID is encrypted.
  • the device may be transferred or sold from one user to another, for example, from user A to user B, in which case, if user B still uses the security code used by user A, since user A This security code is also known, so that for User B, the device lacks security.
  • the first request message may be an unbinding request message.
  • the authorization server still needs to perform user identity verification.
  • the unbinding request message is sent by the device after receiving the unbinding request command, and the unbinding request command may be triggered by the user, and the user may trigger after performing the specified operation by using the unbinding button configured on the device itself.
  • the specified operation may be an operation such as pressing.
  • Step 402 When the authorization server determines that the device belongs to the managed device based on the device identifier, assign a user verification code.
  • step 202 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 403 The authorization server sends the user check code to at least one of the device and a terminal associated with the device.
  • step 203 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 404 The terminal sends a second request message to the authorization server, and the authorization server receives the second request message sent by the terminal, where the second request message carries the user check code and the security code.
  • step 204 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 405 If the authorization server determines that the second request message is associated with the unbind request message based on the user check code, decrypting the ciphertext information by using the security code carried in the second request message to obtain the device. When marking, it is determined that the user identity verification is passed.
  • step 2052 in the embodiment of FIG. 2, which is not described in detail herein.
  • Step 406 The authorization server updates the state of the device to the unbind state, and sends an unbinding notification message to the device, where the device receives the unbinding notification message.
  • Step 407 The authorization server releases the token request authority of the device.
  • the user When it is determined that the user identity verification is passed, the user is legally used by the device.
  • the user may be the original owner user A of the device.
  • the authorization server updates the status of the device to the unbind state, and notifies the user that the current device is already in the unbundled state. In the unbind state, the user cannot use the device to request an authorization token from the authorization server. Even if any request message for identity verification is received, the authorization server returns an error notification message until the device is rebinded. In this way, when the device is transferred to a new user, the new user can re-use the device to request authorization server binding.
  • the authorization server receives the first request message of the device identifier and the ciphertext information sent by the device, and if the authorization server determines, according to the device identifier, that the device belongs to the device managed by the device, the user verification code is allocated. And transmitting to the device or at least one of the terminals associated with the device, such that the user can learn the user check code from the device or the terminal.
  • the terminal sends a second request message carrying the user check code and the security code to the authorization server, and if the authorization server determines, according to the user check code, the second request message is associated with the first request message.
  • the ciphertext information can be decrypted using the security code in the second request message to obtain the device identifier, it indicates that the user may be the owner of the device, that is, the user identity verification is determined to pass. That is, in the user identity verification process, not only the user verification code is used for verification, but also the ciphertext information and the security code are used for user identity verification, thereby improving the efficiency and security of the user identity verification.
  • FIG. 5A is a schematic structural diagram of a user identity verification apparatus, which may be implemented by software, hardware, or a combination of both, according to an exemplary embodiment.
  • the user identity verification device can include:
  • the first receiving module 510 is configured to perform the operations performed by the authorization server in step 201 of the embodiment described above in FIG. 2, the operations performed by the authorization server in step 301 of the embodiment of FIG. 3, and the steps of the embodiment illustrated in FIG. The operation performed by the authorization server in 401;
  • the second receiving module 520 is configured to perform the operations performed by the authorization server in step 204 of the embodiment described above in FIG. 2, the operations performed by the authorization server in step 304 of the embodiment of FIG. 3, and the embodiment in FIG. The operation performed by the authorization server in step 404;
  • the verification module 530 is configured to perform step 205 in the embodiment described above with reference to FIG. 2, step 305 in the embodiment illustrated in FIG. 3, and step 405 in the embodiment illustrated in FIG.
  • the apparatus further includes a first sending module 540 and a rights assigning module 550:
  • the first sending module 540 is configured to perform the operations performed by the authorization server in step 206 in the foregoing embodiment of FIG. 2;
  • the privilege assignment module 550 is configured to perform step 207 in the embodiment described above in FIG.
  • the apparatus further includes a second sending module 560:
  • the second sending module 560 is configured to perform the operations performed by the authorization server in step 306 in the foregoing embodiment of FIG.
  • the apparatus further includes an update module 570 and a release module 580:
  • the update module 570 is configured to perform the operations performed by the authorization server in step 406 in the foregoing embodiment of FIG. 4;
  • the release module 580 is configured to perform step 407 in the embodiment described above in FIG.
  • the apparatus further includes: an information distribution module 590 and a third sending module 511:
  • the information distribution module 590 is configured to perform step 202 in the embodiment of FIG. 2, step 302 in the embodiment in FIG. 3, and step 402 in the embodiment in FIG. 4;
  • the third sending module 511 is configured to perform step 203 in the foregoing embodiment of FIG. 2, step 303 in the embodiment in FIG. 3, and step 403 in the embodiment in FIG.
  • the apparatus further includes an obtaining module 512:
  • the obtaining module 512 is configured to obtain, according to the device identifier, a stored contact information, where the contact information includes any one of an email account, a phone number, and a user account;
  • the third sending module 511 is further configured to send the user check code to the terminal associated with the device by using the contact mode.
  • the apparatus further includes a fourth sending module 514 and a storage module 516:
  • the fourth sending module 514 is configured to send an increase contact indication to the device, where the added contact indication is used to indicate that the contact information is added to the second request message;
  • the storage module 516 is configured to store the contact information and the device identifier.
  • the authorization server receives the first request message of the device identifier and the ciphertext information sent by the device, and if the authorization server determines, according to the device identifier, that the device belongs to the device managed by the device, the user verification code is allocated. And transmitting to the device or at least one of the terminals associated with the device, such that the user can learn the user check code from the device or the terminal.
  • the terminal sends a second request message carrying the user check code and the security code to the authorization server, and if the authorization server determines, according to the user check code, the second request message is associated with the first request message.
  • the ciphertext information can be decrypted using the security code in the second request message to obtain the device identifier, it indicates that the user may be the owner of the device, that is, the user identity verification is determined to pass. That is, in the user identity verification process, not only the user verification code is used for verification, but also the ciphertext information and the security code are used for user identity verification, thereby improving the efficiency and security of the user identity verification.
  • the user identity verification apparatus provided by the foregoing embodiment is only illustrated by the division of the foregoing functional modules. In actual applications, the foregoing function assignments may be different according to requirements.
  • the function module is completed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.
  • the user identity verification apparatus and the user identity verification method embodiment provided in the foregoing embodiments are in the same concept, and the specific implementation process is described in detail in the method embodiment, and details are not described herein again.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, light, Digital Subscriber Line (DSL)) or infinite (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a Digital Video Disk (DVD)), or a semiconductor medium (such as a Solid State Disk (SSD)). )Wait.
  • a magnetic medium eg, a floppy disk, a hard disk, a magnetic tape
  • an optical medium eg, a Digital Video Disk (DVD)
  • DVD Digital Video Disk
  • SSD Solid State Disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例公开了一种用户身份校验方法及装置，属于物联网技术领域。该方法包括：授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，该密文信息由该设备基于安全码对设备标识进行加密得到；当接收到终端发送的携带用户校验码和安全码的第二请求消息时，若基于用户校验码确定第二请求消息与第一请求消息关联，则当使用第二请求消息中携带的安全码对密文信息进行解密处理得到该设备标识时，确定用户身份校验通过。如此，在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。

Description

用户身份校验方法及装置
本申请要求于2017年3月6日提交中国专利局、申请号为201710128222.5、发明名称为“用户身份校验方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及物联网技术领域，特别涉及一种用户身份校验方法及装置。
背景技术
在物联网中，一些设备属于资源受限设备，例如，游戏控制台、电视机、多媒体集线器等。该类设备主要体现在低存储能力等问题上，通常情况下，该类设备需要访问资源服务器来获取数据，在该过程中，为了数据的安全性，需要对使用该类设备的用户身份进行校验。在实际应用场景中，由于该类设备还存在缺乏用户接口的问题，即不支持键盘输入，因此，在用户身份校验过程中，一般需要借助诸如手机、计算机之类的终端进行校验。
相关技术中，主流的校验流程主要基于OAuth2.0协议，其实现框架中包括有设备、授权服务器和资源服务器，用户身份校验的主要实现过程包括：设备向授权服务器发送请求消息，该请求消息中携带设备标识，授权服务器接收该请求消息，当确定该设备标识属于自身管理的设备标识后，为该设备分配并返回校验链接和用户校验码，用户通过该设备即可获取到该校验链接和该用户校验码。之后，用户可以通过终端启动浏览器并输入该校验链接和用户校验码，以登录该授权服务器。该授权服务器基于该用户校验码进行登录校验，当登录校验成功时，确定用户身份校验通过。该授权服务器在确定用户身份校验通过后，可以向该设备发送授权令牌，如此，设备即可使用该授权令牌访问资源服务器中的数据。
然而，上述提供的用户身份校验方法中，由于授权服务器只是根据分配的用户校验码对用户身份进行校验，但是，在实际应用场景中，由于任一用户均可能从终端中获取到该用户校验码，因此，该用户身份校验方法效率低，安全性较差。
发明内容
为了解决现有技术中用户身份校验效率低，安全性较差的问题，本发明实施例提供了一种用户身份校验方法及装置。所述技术方案如下：
第一方面，提供了一种用户身份校验方法，所述方法包括：
授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，如果根据该设备标识确定该设备属于自身所管理的设备，则为该设备分配校验链接和用户校验码，并发送给该设备或与该设备关联的终端中的至少一个。终端基于校验链接展示显示界面，用户可以在该显示界面中输入用户校验码和安全码，之后，终端向授权服务器发送携带该用户校验码和安全码的第二请求消息。授权服务器接收到该第二请求消息后，获取第二请求消息中的用户校验码和安全码，若基于用户校验码确定该第二请求消息为与上述第一消息关联，则当使用获取的安全码对密文信息进行解密处理后得到上述设备标识时，确定用户身 份校验通过。
本发明实施例在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。
在具体实现中，当该第一请求消息为绑定请求消息时，在确定用户身份校验通过后，还向设备发送绑定码，并为该设备分配令牌请求权限，以使该设备基于该绑定码更新安全码，并在后续过程中，使用更新后的安全码向授权服务器请求获取授权令牌。如此，提高了用户身份校验的安全性。
在具体实现中，当所述第一请求消息为令牌获取请求消息时，在确定用户身份校验通过后，向设备发送授权令牌，如此，可以使得设备使用该授权令牌资源服务器中访问数据。
在具体实现中，当所述第一请求消息为解绑请求消息时，在确定用户身份校验通过后，授权服务器将该设备的状态更新为解绑状态，并通知用户当前设备已经处于解绑状态。在解绑状态下，用户无法使用设备向授权服务器请求获取授权令牌，直到该设备重新绑定。如此，便于后续在将该设备转移给新的用户时，新的用户可以重新使用该设备请求授权服务器绑定。
在具体实现中，授权服务器在接收终端发送的第二请求消息之前，若基于第一请求消息中携带的设备标识确定该设备属于该授权服务器所管理的设备时，分配用户校验码，并将该用户校验码发送给该设备和与该设备关联的终端中的至少一个，如此，可以使得用户从该设备或者该终端中获知该用户校验码，以便于后续使用该用户校验码，结合安全码实现用户身份校验，提高了用户身份校验的安全性。
在具体实现中，将该校验链接和用户校验码发送给与该设备关联的终端的具体实现方式包括：基于该设备标识，获取存储的联系方式，该联系方式包括邮箱账号、电话号码、用户账号中的任一种，通过该联系方式，将该校验链接和该用户校验码发送给与该设备关联的终端。
上述通过获取与设备标识对应的联系方式，实现了通过该联系方式将校验链接和该用户校验码发送到终端中，使得用户可以直接从终端中获知校验链接和该用户校验码，提高了用户体验。
在具体实现中，在基于该设备标识获取存储的联系方式之前，授权服务器向该设备发送增加联系方式指示，该增加联系方式指示用于指示在该第二请求消息中增加该联系方式，将该联系方式与该设备标识对应存储。如此，便于后续授权服务器可以根据设备标识，获取对应的联系方式。
第二方面，提供了一种用户身份校验装置，所述装置用于实现上述第一方面所述的用户身份校验方法。
第三方面，本发明实施例提供了一种计算机存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第四方面，本发明实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
第五方面，本发明实施例还提供一种通信芯片，应用于授权服务器中，所述通信芯片包括：输入输出接口、存储器和至少一个处理器，所述存储器、所述输入输出接口通过总线与所述至少一个处理器相通信，所述存储器存储有程序代码，所述至少一个处理器用于 调用程序代码，使得所述授权服务器执行上述第一方面所述的用户身份校验方法。
上述本发明实施例第二方面所获得的技术效果与第一方面中对应的技术手段获得的技术效果近似，在这里不再赘述。
本发明实施例提供的技术方案带来的有益效果是：授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，如果授权服务器根据该设备标识确定该设备属于自身所管理的设备，则分配用户校验码，并发送给该设备或与该设备关联的终端中的至少一个，如此，用户可以从设备或终端获知用户校验码。当用户请求身份校验时，通过该终端向授权服务器发送携带用户校验码和安全码的第二请求消息，若授权服务器根据该用户校验码确定该第二请求消息与第一请求消息关联，则当使用该第二请求消息中的安全码能够对密文信息进行解密得到上述设备标识时，说明该用户可能是设备的拥有者，即确定用户身份校验通过。也即是，在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。
附图说明
图1A是根据一示例性实施例示出的一种实施环境的示意图；
图1B是根据一示例性实施例示出的一种授权服务器120的结构示意图；
图2是根据一示例性实施例示出的一种用户身份校验方法的流程图；
图3是根据另一示例性实施例示出的一种用户身份校验方法的流程图；
图4是根据另一示例性实施例示出的一种用户身份校验方法的流程图；
图5A是根据一示例性实施例示出的一种用户身份校验装置的结构示意图；
图5B是根据另一示例性实施例示出的一种用户身份校验装置的结构示意图；
图5C是根据另一示例性实施例示出的一种用户身份校验装置的结构示意图；
图5D是根据另一示例性实施例示出的一种用户身份校验装置的结构示意图；
图5E是根据另一示例性实施例示出的一种用户身份校验装置的结构示意图；
图5F是根据另一示例性实施例示出的一种用户身份校验装置的结构示意图；
图5G是根据另一示例性实施例示出的一种用户身份校验装置的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
图1A是根据一示例性实施例示出的一种实施环境的示意图。该实施环境中主要包括设备110、授权服务器120和与该设备110关联的终端130。其中，该设备110和该终端130均可以通过有线网络或者无线与该授权服务器120连接。
其中，该设备110为资源受限设备，主要体现在缺乏有效的用户接口，即不支持键盘输入，例如，该设备110可以为诸如游戏控制台(Game Consoles，GC)、电视机(televisions，TVs)和多媒体集线器(Media Hubs，MH)之类的设备。
需要说明的是，在一种可能的实现方式中，该设备110可以配置有显示装置，该显示装置可以用于显示各种信息。
其中，终端130可以用于辅助设备110向授权服务器120发送请求消息以请求用户身份校验。由于设备110缺乏有效的用户接口，因此，在实际实现过程中，用户可以借助该终端130实现用户身份校验。例如，该终端130可以用于基于授权服务器120分配的校验链接(可以通过二维码展示)为用户展示显示界面，如此，用户即可在该显示界面中输入安全码和用户校验码，从而通过该终端130向授权服务器120发送携带该安全码和用户校验码的第二请求消息(校验请求消息)，以使授权服务器120进行用户身份校验，其具体实现可以参见如下图2至图4所述的实施例。其中，该终端130可以为诸如手机、平板电脑、计算机之类的设备，本发明实施例对此不作限定。
在具体实现中，该终端130可以通过有线网络或者无线网络与该设备110连接，并通过该连接来传输数据，例如，该设备110可以通过该连接将该用户校验码、校验链接之类的信息发送给该终端130。在一种可能的实现方式中，终端130和设备110之间可以采用带外数据(Out of Band，OOB)技术实现数据传输，具体实现方式可以参见相关技术，本发明实施例不作限定。
其中，该授权服务器120主要用于实现如下图2至图4实施例所述的用户身份校验方法，在实际实现中，该授权服务器120可以为一台服务器，也可以是由多台服务器组成的服务器集群，本发明实施例对此不作限定。
图1B是根据一示例性实施例示出的一种授权服务器120的结构示意图，该授权服务器120中包括发送器1201、接收器1202、存储器1203、处理器1204以及通信总线1205。本领域技术人员可以理解，图1B中示出的授权服务器120的结构并不构成对授权服务器120的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，本申请实施例对此不做限定。
其中，该发送器1201可以用于向设备110或终端130发送数据和/或信令等。该接收器1202可以用于接收该设备110或终端130发送的数据和/或信令等。该存储器1203可以用于存储诸如联系方式、设备标识之类的数据，并且，该存储器1203也可以用于存储用于执行该用户身份校验方法的一个或多个运行程序和/或模块。在具体实现中，该存储器1203还可以用于调用外部软件系统中的多个运行程序和/或模块。
其中，该处理器1204是该授权服务器120的控制中心。该处理器1204可以一个通用中央处理器CPU，微处理器，特定应用集成电路ASIC，或一个或多个用于控制本申请方案程序执行的集成电路。该处理器1204可以通过运行或执行存储在存储器1203内的软件程序和/或模块，以及调用存储在存储器1203内的数据，来实现下文图2、图3和图4中任一实施例所提供的用户身份校验方法。
在实际应用场景中，根据用户对设备的操作不同，设备向授权服务器发送的第一请求消息的含义可以包括多种，例如，该第一请求消息可以为绑定请求消息、令牌获取请求消息和解绑请求消息中的任一种。接下来，本发明实施例将根据上述三种情况分别对用户身份校验过程进行描述。
请参考图2，图2是根据一示例性实施例示出的一种用户身份校验方法的流程图，这里以该第一请求消息为绑定请求消息为例进行说明，具体可以包括如下几个步骤：
步骤201：设备向授权服务器发送绑定请求消息，授权服务器接收设备发送的绑定请求 消息，该绑定请求消息中携带设备标识和密文信息，该密文信息由该设备基于安全码对设备标识进行加密得到。
其中，该设备标识可以用于唯一标识一个设备，例如，该设备标识可以为设备的身份(Identification，ID)信息等。
需要说明的是，当该设备属于客户端设备类型时，该设备标识也可以为客户端标识，本发明实施例对此不作限定。
在这里，该安全码通常为初始安全码，该初始安全码是由供应商在该设备出厂时设置和提供，在一种可能的实现方式中，用户可以从该设备的说明书、标签等信息中获知。例如，该安全码可以为“0000”。
在本发明实施例中，为了设备使用的安全性，在使用之前，需要基于该安全码向授权服务器请求绑定以获取令牌请求权限，也即是，在实际应用场景中，只有绑定后的设备才具有权限向授权服务器请求获取授权令牌。为此，设备向授权服务器发送绑定(初始绑定)请求消息。
其中，该绑定请求消息可以是由该设备在接收到绑定请求指令时发送，该绑定请求指令可以由用户触发，该用户可以通过指定操作触发，该指定操作可以为按键操作等等。
例如，该设备可以提供有绑定按键，用户可以按动该绑定按键，当设备检测到用户对该绑定按键的按动操作时，确定接收到绑定指令。该设备基于安全码对该设备标识进行加密处理，得到密文信息，之后，该设备基于该设备标识和该密文信息生成绑定请求消息，并向授权服务器发送该绑定请求消息。
需要说明的是，基于安全码对该设备标识进行加密处理得到密文信息的过程可以参见相关技术，本发明实施例不对加密算法进行限定。
步骤202：当授权服务器基于该设备标识确定该设备属于授权服务器所管理的设备时，分配用户校验码。
在具体实现中，授权服务器中可以预先存储有自身所管理的所有设备的设备标识。授权服务器接收到该绑定请求消息后，从存储的所有设备标识中查询是否包括该设备标识，如果存储的所有设备标识中包括该设备标识，则可以确定该设备属于自身所管理的设备。
需要说明的是，上述基于该设备标识判断该设备是否属于所管理的设备的实现过程仅是示例性的，在实际实现过程中，还可能通过其它方式来基于该设备标识判断该设备是否属于自身所管理的设备，本发明实施例对此不作限定。
当授权服务器基于该设备标识确定该设备属于该授权服务器所管理的设备时，分配用户校验码。除此之外，在实际实现过程中，授权服务器还分配校验链接，用户可以通过终端基于该校验链接，可以向授权服务器请求身份校验。
需要说明的是，授权服务器分配校验链接和用户校验码的实现方式可以参见相关技术，例如，该用户校验码可以由授权服务器随机分配，该校验链接可以由授权服务器基于预先存储的根链接，按照一定的生成策略生成得到，本发明实施例对此不作限定。
步骤203：授权服务器将该用户校验码发送给该设备和与该设备关联的终端中的至少一个。
需要说明的是，在实际实现过程中，除了用户校验码外，授权服务器还将所分配的校验链接也一同发送给设备和与设备关联的终端中的至少一个。
在一种可能的实现方式中，该授权服务器可以将该校验链接和用户校验码发送给该设备。此时，该设备可以通过自身配置的显示装置显示该验链接和该用户校验码，如此，用户可以从该显示装置中读取该设备所显示的校验链接和该用户校验码。或者，该设备也可以通过图1A实施例中所述的连接将该用户校验码和该校验链接发送给该终端，如此，用户即可从该终端中获知该校验链接和用户校验码。
在另一种可能的实现方式中，该授权服务器也可以将该校验链接和用户校验码发送给与该设备关联的终端，此时，用户可以直接从该终端中获知该校验链接和用户校验码。
在又一种可能的实现方式中，该授权服务器还可以将该校验链接和用户校验码同时发送给该设备和与该设备关联的终端。
在具体实现中，授权服务器可以直接将该校验链接和该用户校验码发送给该设备和与该设备关联的终端中的至少一个。或者，授权服务器也可以通过响应消息携带该校验链接和该用户校验码，即当该授权服务器接收到设备发送的绑定请求消息并基于设备标识确定该设备属于所管理的设备时，可以向该设备和与该设备关联的终端中的至少一个发送响应消息，该响应消息中携带该校验链接和用户校验码。
步骤204：终端向授权服务器发送第二请求消息，授权服务器接收该终端发送的第二请求消息，该第二请求消息中携带用户校验码和安全码。
如前文所述，该校验链接和该用户校验码可以从设备中获取得到，或者，也可以由终端从授权服务器中接收得到。
另外，该第二请求消息可以由终端在接收到第二请求发送指令时发送，该第二请求发送指令可以由用户触发，该用户可以通过诸如点击、滑动等之类的操作触发。
具体地，当上述步骤203中授权服务器将该校验链接和用户校验码发送给设备时，用户可以从该设备中读取该校验链接和该用户校验码，之后，在该终端中登录浏览器，并在该浏览器中输入该校验链接。之后，终端基于该校验链接展示显示界面，用户在该显示界面中输入用户校验码和安全码。
进一步地，该显示界面中可以提供有第二请求发送选项，当用户输入结束后，可以点击该第二请求发送选项，当终端检测到用户对该第二请求发送选项的点击操作时，确定接收到第二请求发送指令，终端基于该用户校验码和该安全码生成第二请求消息，并向授权服务器发送该第二请求消息。
步骤205：若授权服务器基于用户校验码确定该第二请求消息与该绑定请求消息关联，则当使用第二请求消息中携带的安全码对该密文信息进行解密处理得到上述设备标识时，确定用户身份校验通过。
在一种可能的实现方式中，授权服务器接收到该第二请求消息后，获取该第二请求消息中的用户校验码，并判断该用户校验码与之前接收到绑定请求消息后分配的用户校验码是否相同，若相同，则确定该第二请求消息为与上述绑定请求消息关联。
需要说明的是，上述基于用户校验码判断该第二请求消息是否与该绑定请求消息关联的实现方式仅是示例性的，在另一实施例中，还可以通过其它方式，基于用户校验码判断该第二请求消息是否与该绑定请求消息关联，本发明实施例对此不作限定。
当确定该第二请求消息与上述绑定请求消息关联时，授权服务器使用第二请求消息中携带的安全码对上述绑定请求消息中的密文信息进行解密处理。如果使用该第二请求消息 中的安全码能够对密文信息进行解密处理且得到上述设备标识，则可以确定用户身份校验通过，否则，确定用户身份校验未通过，如此，即实现了对用户身份的校验。
至此，已经实现了本发明实施例提供的用户身份校验方法。然而，如前文所述，由于安全码是由供应商在该设备出厂时提供，并且，通常下各个设备的安全码均可能相同，例如，均为“0000”，在该种情况下，导致其它用户很容易获知到该安全码，安全性较差。为此，本发明实施例在绑定过程中，确定用户身份校验通过后，还对该安全码进行更新，具体请参见如下步骤206至步骤208。
步骤206：授权服务器向该设备发送绑定码，设备接收该绑定码，该绑定码用于该设备更新该安全码。
其中，该绑定码可以由该授权服务器随机生成。另外，在具体实现中，授权服务器可以通过绑定成功消息携带该绑定码，该绑定成功消息用于通知用户已经成功绑定该设备。
步骤207：授权服务器为该设备分配令牌请求权限，以使该设备能够基于更新后的安全码向授权服务器请求获取授权令牌。
对于授权服务器来说，为了记录设备的绑定情况，当向该设备发送绑定码后，为该设备分配令牌请求权限。授权服务器为该设备分配令牌请求权限后，在后续请求获取授权令牌过程中，设备即可使用该更新后的安全码进行用户身份校验。具体实现可参见图3所述的实施例。
步骤208：设备基于该绑定码更新该安全码。
在具体实现过程中，该设备可以根据该绑定码，通过Hash算法生成新的安全码，以实现对该安全码进行更新。
需要说明的是，这里仅是以采用Hash算法生成新的安全码为例进行说明，在另一实施例中，还可以采用其它算法生成新的安全码，本发明实施例对此不作限定。
另外，这里仅是以设备根据该绑定码更新安全码为例进行说明，在实际实现过程中，该设备还可以基于绑定码和其它信息更新该安全码，例如，该设备还可以基于绑定码和该设备标识更新该安全码，本发明实施例对此不作限定。
进一步地，该设备更新该安全码后，可以通过显示装置显示该更新后的安全码，或者，也可以将该更新后的安全码发送给与该设备关联的终端，如此，用户可以获知更新后的安全码。
需要说明的是，在实际实现过程中，上述步骤207和步骤208没有先后的执行顺序。
进一步地，上述将用户校验码发送给与该设备关联的终端的具体实现方式包括：基于该设备标识，获取存储的联系方式，该联系方式包括邮箱账号、电话号码、用户账号中的任一种，通过该联系方式，将该用户校验码发送给与该设备关联的终端。需要说明的是，校验链接也可以采用该种方式发送给与该设备关联的终端。
进一步地，在基于该设备标识获取存储的联系方式之前，授权服务器向该设备发送增加联系方式指示，该增加联系方式指示用于指示在该第二请求消息中增加该联系方式，将该联系方式与该设备标识对应存储。
在具体实现中，该增加联系方式指示可以通过上述响应消息携带，也即是，该增加联系方式指示可以与上述校验链接和用户校验码一同发送，之后，用户根据该增加联系方式指示，在第二请求消息中增加联系方式。
在本发明实施例中，授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，如果授权服务器根据该设备标识确定该设备属于自身所管理的设备，则分配用户校验码，并发送给该设备或与该设备关联的终端中的至少一个，如此，用户可以从设备或终端获知用户校验码。当用户请求身份校验时，通过该终端向授权服务器发送携带用户校验码和安全码的第二请求消息，若授权服务器根据该用户校验码确定该第二请求消息与第一请求消息关联，则当使用该第二请求消息中的安全码能够对密文信息进行解密得到上述设备标识时，说明该用户可能是设备的拥有者，即确定用户身份校验通过。也即是，在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。
请参考图3，该图3是根据另一示例性实施例示出的一种用户身份校验方法的流程图，这里以该第一请求消息为令牌获取请求消息为例进行说明，具体可以包括如下几个步骤：
步骤301：设备向授权服务器发送令牌获取请求消息，授权服务器接收设备发送的令牌获取请求消息，该令牌获取请求消息中携带设备标识和密文信息，该密文信息由该设备基于安全码对该设备标识进行加密得到。
在实际应用场景中，当用户想要使用设备从资源服务器中访问数据时，设备需要使用授权令牌进行访问。在使用之前，设备需要获取到该授权令牌，而在获取授权令牌过程中，授权服务器需要进行用户身份校验。
在这里，该安全码通常为在绑定过程中对初始安全码进行更新后确定得到的安全码。也即是，在授权服务器为设备分配令牌请求权限后，当设备需要向授权服务器请求获取授权令牌以访问数据时，使用更新后的安全码进行身份校验。
在一种可能的实现方式中，该令牌获取请求消息是由设备在接收到令牌获取请求指令后发送，该令牌获取请求指令可以由用户触发，该用户可以通过对该设备自身配置的令牌获取按键执行指定操作后触发，该指定操作可以为诸如按动之类的操作，具体实现可以参见图2实施例中设备向授权服务器发送绑定请求消息的实现过程。
步骤302：当授权服务器基于该设备标识确定该设备属于所管理的设备时，分配用户校验码。
其具体实现过程与实现原理可参见图2实施例中的步骤202，这里不再详细介绍。
步骤303：授权服务器将该用户校验码发送给该设备和与该设备关联的终端中的至少一个。
其具体实现过程与实现原理可参见图2实施例中的步骤203，这里不再详细介绍。
在具体实现中，设备在接收到该授权服务器发送的用户校验码后，可以根据本地策略持续探测授权服务器，即向授权服务器发送探测消息，以通知授权服务器正在等待身份认证。
步骤304：终端向授权服务器发送第二请求消息，授权服务器接收该终端发送的第二请求消息，该第二请求消息中携带用户校验码和安全码。
其具体实现过程与实现原理可参见图2实施例中的步骤204，这里不再详细介绍。
步骤305：若授权服务器基于该用户校验码确定该第二请求消息与该令牌获取请求消息关联，则当使用该第二请求消息中携带的安全码对该密文信息进行解密处理得到该设备标 识时，确定用户身份校验通过。
其具体实现过程与实现原理可参见图2实施例中的步骤205，这里不再详细介绍。
步骤306：授权服务器向该设备发送授权令牌，设备接收该授权令牌，该授权令牌用于该设备从资源服务器中访问数据。
当确定用户身份校验通过时，说明该用户具有使用该设备访问该资源服务器的权限，在该种情况下，授权服务器可以向该设备发送授权令牌，以便于设备使用该授权令牌从资源服务器中访问数据。
需要说明的是，在实际实现过程中，授权服务器可以直接将该授权令牌发送给设备，或者，授权服务器也可以通过响应消息携带该授权令牌，本发明实施例对此不做限定。
此外，授权服务器还可以为该设备分配指定授权令牌，例如，该指定授权令牌可以为更新令牌(fresh token)。该指定授权令牌可以用于后续在授权令牌超时或失效时，设备直接使用该指定授权令牌向该授权服务器重新请求获取授权令牌。如此，设备不需要经过上述用户身份校验过程即可使用该指定授权令牌向该授权服务器重新请求获取授权令牌，提高了获取授权令牌的速度，进而提高了数据访问速度。
在本发明实施例中，授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，如果授权服务器根据该设备标识确定该设备属于自身所管理的设备，则分配用户校验码，并发送给该设备或与该设备关联的终端中的至少一个，如此，用户可以从设备或终端获知用户校验码。当用户请求身份校验时，通过该终端向授权服务器发送携带用户校验码和安全码的第二请求消息，若授权服务器根据该用户校验码确定该第二请求消息与第一请求消息关联，则当使用该第二请求消息中的安全码能够对密文信息进行解密得到上述设备标识时，说明该用户可能是设备的拥有者，即确定用户身份校验通过。也即是，在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。
请参考图4，该图4是根据另一示例性实施例示出的一种用户身份校验方法的流程图，这里以该第一请求消息为解绑请求消息为例进行说明，具体可以包括如下几个步骤：
步骤401：设备向授权服务器发送解绑请求消息，授权服务器接收设备发送的解绑请求消息，该解绑请求消息中携带设备标识和密文信息，该密文信息由该设备基于安全码对该设备标识进行加密得到。
在实际应用中，设备可能从一个用户转移或变卖给另一个用户，例如，从用户A转移给用户B，在该种情况下，如果用户B仍使用用户A所使用的安全码，由于用户A也获知该安全码，因此，对于用户B来说，设备缺乏安全性。为此，在本发明实施例中，还提供了解绑实现过程，即该第一请求消息可以为解绑请求消息。在解绑过程中，为了避免其它用户非法将该设备解绑，授权服务器仍需要进行用户身份校验。
其中，该解绑请求消息由该设备在接收到解绑请求指令后发送，该解绑请求指令可以由用户触发，该用户可以通过对该设备自身配置的解绑按键执行指定操作后触发，该指定操作可以为诸如按动之类的操作，具体可以参见图2实施例中设备向授权服务器发送绑定请求消息的实现过程。
步骤402：当授权服务器基于该设备标识确定该设备属于所管理的设备时，分配用户校 验码。
其具体实现过程与实现原理可参见图2实施例中的步骤202，这里不再详细介绍。
步骤403：授权服务器将该用户校验码发送给该设备和与该设备关联的终端中的至少一个。
其具体实现过程与实现原理可参见图2实施例中的步骤203，这里不再详细介绍。
步骤404：终端向授权服务器发送第二请求消息，授权服务器接收该终端发送的第二请求消息，该第二请求消息中携带用户校验码和安全码。
其具体实现过程与实现原理可参见图2实施例中的步骤204，这里不再详细介绍。
步骤405：若授权服务器基于该用户校验码确定该第二请求消息与该解绑请求消息关联，则当使用该第二请求消息中携带的安全码对该密文信息进行解密处理得到该设备标识时，确定用户身份校验通过。
其具体实现过程与实现原理可参见图2实施例中的步骤2052，这里不再详细介绍。
步骤406：授权服务器更新该设备的状态为解绑状态，并向该设备发送解绑通知消息，设备接收该解绑通知消息。
步骤407：授权服务器解除该设备的令牌请求权限。
当确定用户身份校验通过时，说明该用户合法使用该设备，例如，如前文所述，该用户可能为设备的原来的拥有者用户A。在该种情况下，授权服务器将该设备的状态更新为解绑状态，并通知用户当前设备已经处于解绑状态。在解绑状态下，用户无法使用设备向授权服务器请求获取授权令牌，即便接收到任何关于身份校验的请求消息，授权服务器均会返回错误通知消息，直到该设备重新绑定。如此，便于后续在将该设备转移给新的用户时，新的用户可以重新使用该设备请求授权服务器绑定。
需要说明的是，重新绑定的具体实现请参见图2所述的实施例。
在本发明实施例中，授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，如果授权服务器根据该设备标识确定该设备属于自身所管理的设备，则分配用户校验码，并发送给该设备或与该设备关联的终端中的至少一个，如此，用户可以从设备或终端获知用户校验码。当用户请求身份校验时，通过该终端向授权服务器发送携带用户校验码和安全码的第二请求消息，若授权服务器根据该用户校验码确定该第二请求消息与第一请求消息关联，则当使用该第二请求消息中的安全码能够对密文信息进行解密得到上述设备标识时，说明该用户可能是设备的拥有者，即确定用户身份校验通过。也即是，在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。
图5A是根据一示例性实施例示出的一种用户身份校验装置的结构示意图，该用户身份校验装置可以由软件、硬件或者两者的结合实现。该用户身份校验装置可以包括：
第一接收模块510，用于执行上述图2所述实施例的步骤201中授权服务器执行的操作、图3所述实施例的步骤301中授权服务器执行的操作以及图4所述实施例的步骤401中授权服务器执行的操作；
第二接收模块520，用于执行上述图2所述实施例的步骤204中授权服务器执行的操作、图3所述实施例的步骤304中授权服务器执行的操作、以及图4所述实施例中的步骤404 中授权服务器执行的操作；
校验模块530，用于执行上述图2所述实施例中的步骤205、图3所述实施例中的步骤305和图4所述实施例中的步骤405。
可选地，请参考图5B，该装置还包括第一发送模块540和权限分配模块550：
该第一发送模块540，用于执行上述图2所述实施例中的步骤206中授权服务器执行的操作；
该权限分配模块550，用于执行上述图2所述实施例中的步骤207。
可选地，请参考图5C，该装置还包括第二发送模块560：
该第二发送模块560，用于执行上述图3所述实施例中的步骤306中授权服务器执行的操作。
可选地，请参考图5D，该装置还包括更新模块570和解除模块580：
该更新模块570，用于执行上述图4所述实施例中的步骤406中授权服务器执行的操作；
该解除模块580，用于执行上述图4所述实施例中的步骤407。
可选地，请参考图5E，该装置还包括：信息分配模块590和第三发送模块511：
该信息分配模块590，用于执行上述图2所述实施例中步骤202、图3所述实施例中的步骤302和图4所述实施例中的步骤402；
该第三发送模块511，用于执行上述图2所述实施例中步骤203、图3所述实施例中的步骤303和图4所述实施例中的步骤403。
可选地，请参考图5F，该装置还包括获取模块512：
该获取模块512，用于基于所述设备标识，获取存储的联系方式，该联系方式包括邮箱账号、电话号码、用户账号中的任一种；
第三发送模块511，还用于通过该联系方式，将该用户校验码发送给与该设备关联的终端。
可选地，请参考图5G，该装置还包括第四发送模块514和存储模块516：
该第四发送模块514，用于向该设备发送增加联系方式指示，该增加联系方式指示用于指示在该第二请求消息中增加该联系方式；
该存储模块516，用于将该联系方式与设备标识对应存储。
在本发明实施例中，授权服务器接收设备发送的携带设备标识和密文信息的第一请求消息，如果授权服务器根据该设备标识确定该设备属于自身所管理的设备，则分配用户校验码，并发送给该设备或与该设备关联的终端中的至少一个，如此，用户可以从设备或终端获知用户校验码。当用户请求身份校验时，通过该终端向授权服务器发送携带用户校验码和安全码的第二请求消息，若授权服务器根据该用户校验码确定该第二请求消息与第一请求消息关联，则当使用该第二请求消息中的安全码能够对密文信息进行解密得到上述设备标识时，说明该用户可能是设备的拥有者，即确定用户身份校验通过。也即是，在用户身份校验过程中，不仅依据用户校验码进行校验，还结合密文信息和安全码进行用户身份校验，提高了用户身份校验的效率和安全性。
需要说明的是：上述实施例提供的用户身份校验装置在实现用户身份校验方法时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全 部或者部分功能。另外，上述实施例提供的用户身份校验装置与用户身份校验方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述不用以限制本发明实施例，凡在本发明实施例的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明实施例的保护范围之内。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光线、数字用户线(Digital Subscriber Line，DSL))或无限(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字化视频光盘(Digital Video Disk，DVD))、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。

Claims (14)

  1. 一种用户身份校验方法，其特征在于，所述方法包括：
    授权服务器接收设备发送的第一请求消息，所述第一请求消息中携带设备标识和密文信息，所述密文信息由所述设备基于安全码对所述设备标识进行加密得到；
    所述授权服务器接收终端发送的第二请求消息，所述第二请求消息中携带用户校验码和安全码，所述用户校验码由所述授权服务器基于所述设备标识确定所述设备属于所述授权服务器所管理的设备后分配的；
    若所述授权服务器基于所述用户校验码确定所述第二请求消息与所述第一请求消息关联，则当使用所述第二请求消息中携带的安全码对所述密文信息进行解密处理得到所述设备标识时，确定用户身份校验通过。
  2. 如权利要求1所述的方法，其特征在于，当所述第一请求消息为绑定请求消息时，所述确定用户身份校验通过之后，还包括：
    向所述设备发送绑定码，所述绑定码用于所述设备更新所述安全码；
    为所述设备分配令牌请求权限，以使所述设备能够基于更新后的安全码向所述授权服务器请求获取授权令牌。
  3. 如权利要求1所述的方法，其特征在于，当所述第一请求消息为令牌获取请求消息时，所述确定用户身份校验通过之后，还包括：
    向所述设备发送授权令牌，所述授权令牌用于所述设备从资源服务器中访问数据。
  4. 如权利要求1所述的方法，其特征在于，当所述第一请求消息为解绑请求消息时，所述确定用户身份校验通过之后，还包括：
    更新所述设备的状态为解绑状态，并向所述设备发送解绑通知消息；
    解除所述设备的令牌请求权限。
  5. 如权利要求1所述的方法，其特征在于，所述授权服务器接收终端发送的第二请求消息之前，还包括：
    当基于所述设备标识确定所述设备属于所述授权服务器所管理的设备时，分配所述用户校验码；
    将所述用户校验码发送给所述设备和与所述设备关联的终端中的至少一个。
  6. 如权利要求5所述的方法，其特征在于，所述将所述用户校验码发送给与所述设备关联的终端之前，还包括：
    基于所述设备标识，获取存储的联系方式，所述联系方式包括邮箱账号、电话号码、用户账号中的任一种；
    相应地，所述将所述用户校验码发送给与所述设备关联的终端，包括：
    通过所述联系方式，将所述用户校验码发送给与所述设备关联的终端。
  7. 如权利要求6所述的方法，其特征在于，所述基于所述设备标识，获取存储的联系方式之前，还包括：
    向所述设备发送增加联系方式指示，所述增加联系方式指示用于指示在所述第二请求消息中增加所述联系方式；
    将所述联系方式与所述设备标识对应存储。
  8. 一种用户身份校验装置，应用于授权服务器中，其特征在于，所述装置包括：
    第一接收模块，用于接收设备发送的第一请求消息，所述第一请求消息中携带设备标识和密文信息，所述密文信息由所述设备基于安全码对所述设备标识进行加密得到；
    第二接收模块，用于接收终端发送的第二请求消息，所述第二请求消息中携带用户校验码和安全码，所述用户校验码由所述授权服务器基于所述设备标识确定所述设备属于所述授权服务器所管理的设备后分配的；
    校验模块，用于若基于所述用户校验码确定所述第二请求消息与所述第一请求消息关联，则当使用所述第二请求消息中携带的安全码对所述密文信息进行解密处理得到所述设备标识时，确定用户身份校验通过。
  9. 如权利要求8所述的装置，其特征在于，所述装置还包括：
    第一发送模块，用于向所述设备发送绑定码，所述绑定码用于所述设备更新所述安全码；
    权限分配模块，用于为所述设备分配令牌请求权限，以使所述设备能够基于更新后的安全码向授权服务器请求获取授权令牌。
  10. 如权利要求8所述的装置，其特征在于，所述装置还包括：
    第二发送模块，用于向所述设备发送授权令牌，所述授权令牌用于所述设备从资源服务器中访问数据。
  11. 如权利要求8所述的装置，其特征在于，所述装置还包括：
    更新模块，用于更新所述设备的状态为解绑状态，并向所述设备发送解绑通知消息；
    解除模块，用于解除所述设备的令牌请求权限。
  12. 如权利要求8所述的装置，其特征在于，所述装置还包括：
    信息分配模块，用于当基于所述设备标识确定所述设备属于所述授权服务器所管理的设备时，分配所述用户校验码；
    第三发送模块，用于将所述用户校验码发送给所述设备和与所述设备关联的终端中的至少一个。
  13. 如权利要求12所述的装置，其特征在于，所述装置还包括：
    获取模块，用于基于所述设备标识，获取存储的联系方式，所述联系方式包括邮箱账号、电话号码、用户账号中的任一种；
    相应地，所述第三发送模块还用于：
    通过所述联系方式，将所述用户校验码发送给与所述设备关联的终端。
  14. 如权利要求13所述的装置，其特征在于，所述装置还包括：
    第四发送模块，用于向所述设备发送增加联系方式指示，所述增加联系方式指示用于指示在所述第二请求消息中增加所述联系方式；
    存储模块，用于将所述联系方式与所述设备标识对应存储。
PCT/CN2018/077094 2017-03-06 2018-02-24 用户身份校验方法及装置 WO2018161807A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710128222.5 2017-03-06
CN201710128222.5A CN108540433B (zh) 2017-03-06 2017-03-06 用户身份校验方法及装置

Publications (1)

Publication Number Publication Date
WO2018161807A1 true WO2018161807A1 (zh) 2018-09-13

Family

ID=63448059

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077094 WO2018161807A1 (zh) 2017-03-06 2018-02-24 用户身份校验方法及装置

Country Status (2)

Country Link
CN (1) CN108540433B (zh)
WO (1) WO2018161807A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109361535A (zh) * 2018-09-27 2019-02-19 北京小米移动软件有限公司 智能设备绑定方法、装置及存储介质
CN111401672A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种基于区块链的合法性校验方法、设备及系统
CN111726396A (zh) * 2020-06-01 2020-09-29 安徽华米信息科技有限公司 设备绑定方法及装置、云端、存储介质
CN111984936A (zh) * 2019-05-23 2020-11-24 腾讯科技（深圳）有限公司 授权分配方法、装置、服务器及存储介质
CN112443870A (zh) * 2019-08-29 2021-03-05 宁波方太厨具有限公司 室内吸油烟机绑定方法及采用该方法的集中式排烟系统
US20210288802A1 (en) * 2020-03-13 2021-09-16 Mavenir Networks, Inc. Client authentication and access token ownership validation
CN114338055A (zh) * 2020-09-25 2022-04-12 腾讯科技（深圳）有限公司 一种身份认证方法及装置
CN115470464A (zh) * 2022-06-10 2022-12-13 慧之安信息技术股份有限公司 基于硬件指纹的授权管理系统
CN115842720A (zh) * 2021-08-19 2023-03-24 青岛海尔科技有限公司 智能设备绑定方法及装置、存储介质及电子设备

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108718323A (zh) * 2018-06-29 2018-10-30 北京东方英卡数字信息技术有限公司 一种身份认证方法和系统
CN109150849A (zh) * 2018-07-27 2019-01-04 国政通科技有限公司 一种身份认证方法和系统
CN110677248B (zh) * 2019-10-30 2022-09-30 宁波奥克斯电气股份有限公司 一种基于窄带物联网的安全绑定方法和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101094226A (zh) * 2006-06-19 2007-12-26 华为技术有限公司 管理网络安全框架及其信息处理方法
CN104113551A (zh) * 2014-07-28 2014-10-22 百度在线网络技术（北京）有限公司 一种平台授权方法、平台服务端及应用客户端和系统
CN105407074A (zh) * 2014-09-11 2016-03-16 腾讯科技（深圳）有限公司 身份验证方法、装置及系统
CN106211152A (zh) * 2015-04-30 2016-12-07 杭州华三通信技术有限公司 一种无线接入认证方法及装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010077129A2 (en) * 2008-12-30 2010-07-08 Chee Boon Moh Secure locker system and method with time-based security code
CN103051631B (zh) * 2012-12-21 2015-07-15 国云科技股份有限公司 PaaS平台与SaaS应用系统的统一安全认证方法
CN103634796B (zh) * 2013-12-06 2017-02-01 北京航空航天大学 一种空天信息网络漫游可信安全接入方法
CN103905457B (zh) * 2014-04-10 2017-06-27 北京数码视讯科技股份有限公司 服务器、客户端、认证系统及用户认证和数据访问方法
CN104079562B (zh) * 2014-06-09 2017-07-11 中国建设银行股份有限公司 一种基于支付终端的安全认证方法及相关装置
CN104065653B (zh) * 2014-06-09 2015-08-19 北京石盾科技有限公司 一种交互式身份验证方法、装置、系统和相关设备
CN104539701B (zh) * 2014-12-29 2018-04-27 飞天诚信科技股份有限公司 一种在线激活移动终端令牌的设备和系统的工作方法
CN105139193B (zh) * 2015-07-31 2017-04-12 腾讯科技（深圳）有限公司 一种电子资源处理方法、装置及服务器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101094226A (zh) * 2006-06-19 2007-12-26 华为技术有限公司 管理网络安全框架及其信息处理方法
CN104113551A (zh) * 2014-07-28 2014-10-22 百度在线网络技术（北京）有限公司 一种平台授权方法、平台服务端及应用客户端和系统
CN105407074A (zh) * 2014-09-11 2016-03-16 腾讯科技（深圳）有限公司 身份验证方法、装置及系统
CN106211152A (zh) * 2015-04-30 2016-12-07 杭州华三通信技术有限公司 一种无线接入认证方法及装置

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109361535A (zh) * 2018-09-27 2019-02-19 北京小米移动软件有限公司 智能设备绑定方法、装置及存储介质
CN111401672A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种基于区块链的合法性校验方法、设备及系统
CN111401672B (zh) * 2019-01-02 2023-11-28 中国移动通信有限公司研究院 一种基于区块链的合法性校验方法、设备及系统
CN111984936A (zh) * 2019-05-23 2020-11-24 腾讯科技（深圳）有限公司 授权分配方法、装置、服务器及存储介质
CN112443870A (zh) * 2019-08-29 2021-03-05 宁波方太厨具有限公司 室内吸油烟机绑定方法及采用该方法的集中式排烟系统
CN112443870B (zh) * 2019-08-29 2022-11-29 宁波方太厨具有限公司 室内吸油烟机绑定方法及采用该方法的集中式排烟系统
US11757635B2 (en) * 2020-03-13 2023-09-12 Mavenir Networks, Inc. Client authentication and access token ownership validation
US20210288802A1 (en) * 2020-03-13 2021-09-16 Mavenir Networks, Inc. Client authentication and access token ownership validation
CN111726396A (zh) * 2020-06-01 2020-09-29 安徽华米信息科技有限公司 设备绑定方法及装置、云端、存储介质
CN111726396B (zh) * 2020-06-01 2022-07-29 安徽华米信息科技有限公司 设备绑定方法及装置、云端、存储介质
CN114338055A (zh) * 2020-09-25 2022-04-12 腾讯科技（深圳）有限公司 一种身份认证方法及装置
CN114338055B (zh) * 2020-09-25 2023-10-13 腾讯科技（深圳）有限公司 一种身份认证方法及装置
CN115842720A (zh) * 2021-08-19 2023-03-24 青岛海尔科技有限公司 智能设备绑定方法及装置、存储介质及电子设备
CN115470464A (zh) * 2022-06-10 2022-12-13 慧之安信息技术股份有限公司 基于硬件指纹的授权管理系统

Also Published As

Publication number Publication date
CN108540433B (zh) 2020-10-27
CN108540433A (zh) 2018-09-14

Similar Documents

Publication Publication Date Title
WO2018161807A1 (zh) 用户身份校验方法及装置
US11956361B2 (en) Network function service invocation method, apparatus, and system
US10412061B2 (en) Method and system for encrypted communications
US10911436B2 (en) Method and device for registering and certifying device in wireless communication system
US8954741B2 (en) Apparatus and method for supporting family cloud in cloud computing system
CN103746812B (zh) 一种接入认证方法及系统
WO2018145605A1 (zh) 鉴权方法及服务器、访问控制装置
US9548975B2 (en) Authentication method, authentication system, and service delivery server
JP6522159B2 (ja) 音声通信処理方法及びシステム、電子装置、並びに記憶媒体
WO2016095540A1 (zh) 一种处理授权的方法、设备和系统
US8453220B2 (en) Device association
WO2016202200A1 (zh) 数据校验方法、装置和智能电视系统
WO2013097588A1 (zh) 应用程序登录方法、装置和移动终端
JP2018517367A (ja) サービスプロバイダ証明書管理
US11108888B2 (en) Digital rights list for device groups
US20150295935A1 (en) Voucher authorization for cloud server
JP2014534515A (ja) ユーザーのアクセス許可の方法、システム、クライアントおよびサーバ
JP2014534515A5 (zh)
CN113783829B (zh) 跨平台实现设备接入的方法和装置
CN109831435A (zh) 一种数据库操作方法、系统及代理服务器和存储介质
CN114760112B (zh) 一种面向无线局域网络的智能家居设备入网方法、系统、设备及存储介质
KR102340693B1 (ko) 사용자 권한 설정 방법 및 이를 수행하는 홈 사물 인터넷 서비스 시스템
JP2019530058A (ja) メッセージングシステム内のメッセージチャネルのアクセス制御
CN109460647B (zh) 一种多设备安全登录的方法
US11962465B2 (en) Control system, electronic device, and control method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18764415

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18764415

Country of ref document: EP

Kind code of ref document: A1