WO2022042198A1

WO2022042198A1 - Identity authentication method and apparatus, computer device, and storage medium

Info

Publication number: WO2022042198A1
Application number: PCT/CN2021/109292
Authority: WO
Inventors: 李岩
Original assignee: 百果园技术(新加坡)有限公司; 李岩
Priority date: 2020-08-31
Filing date: 2021-07-29
Publication date: 2022-03-03
Also published as: CN112055008B; CN112055008A

Abstract

Embodiments of the present application provide an identity authentication method and apparatus, a computer device, and a storage medium. The method comprises: receiving an authentication request sent by a client, the authentication request comprising a username, authentication digest information, and a user counter; looking up registration parameters recorded when the client is registered and associated with the user name, the registration parameters comprising a service counter and standard ciphertext; matching the user counter with the service counter to detect consistency between a reduced value of the user counter and a reduced value of the service counter during identity authentication; and in response to successful matching between the user counter and the service counter, authenticating the identity of the client according to a difference between the standard ciphertext and the authentication digest information.

Description

Authentication method, apparatus, computer equipment and storage medium

The present disclosure claims the priority of a Chinese patent application with application number 202010895360.8 filed with the Chinese Patent Office on August 31, 2020, the entire contents of which are incorporated into the present disclosure by reference.

technical field

The embodiments of the present application relate to the technical field of information security, for example, to an identity verification method, apparatus, computer device, and storage medium.

Background technique

Password authentication is a widely used authentication method, that is, the user registers the username and password on the server, and the server persistently stores the username and password. When the user logs in to the account using password authentication, the user enters the username and password through the client, the client sends the username and password to the server, and the server receives the username and password, and retrieves the same username and password stored in the database. For comparison, if both the user name and the password are consistent, the user's authentication is successful, and if the user name and at least one of the passwords are inconsistent, the authentication fails.

Password authentication protocols used in the related art include Password Authentication Protocol (PAP).

In PAP, the server stores the user name and the password in plain text during registration, and when verifying, the client directly submits the user name and password in plain text entered by the user. In an insecure network environment, the password in plaintext can be used by attackers using eavesdropping and replay attacks to successfully log in as a legitimate user; and the server stores the password in plaintext. Once the database is breached, the password will be leaked directly. , resulting in the possibility of user identity being impersonated.

SUMMARY OF THE INVENTION

The embodiments of the present application provide an identity verification method, apparatus, computer equipment, and storage medium.

In a first aspect, an embodiment of the present application provides an identity verification method, including:

Receive a verification request sent by the client, where the verification request includes a user name, verification digest information, and a user counter, and the verification digest information is the digest information generated by using the user counter as the number of times to calculate the digest and the password calculation digest;

Find the registration parameters associated with the username recorded when the client registers, where the registration parameters include a service counter and standard ciphertext;

matching the user counter with the service counter to detect the consistency of the reduced value of the user counter and the reduced value of the service counter during authentication;

In response to a successful match between the user counter and the service counter, the identity of the client is verified according to the difference between the standard ciphertext and the verification digest information.

In a second aspect, the embodiments of the present application also provide an identity verification device, including:

The verification request receiving module is configured to receive the verification request sent by the client, the verification request includes a user name, verification summary information, and a user counter, and the verification summary information is the number of times the user counter is used to calculate the summary, and the password is calculated. Abstract, the generated summary information;

a registration parameter search module, configured to search for the registration parameters associated with the username recorded when the client registers, and the registration parameters include a service counter and a standard ciphertext;

A counter matching module, configured to match the user counter with the service counter, to detect the consistency between the reduced value of the user counter and the reduced value of the service counter during authentication;

A difference verification module, configured to verify the identity of the client according to the difference between the standard ciphertext and the verification digest information in response to a successful match between the user counter and the service counter.

In a third aspect, an embodiment of the present application further provides a computer device, the computer device comprising:

at least one processor;

memory, arranged to store at least one program,

The at least one processor is configured to execute the at least one program to implement the authentication method according to the first aspect.

In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the identity verification as described by the first party is implemented method.

Description of drawings

1 is a flowchart of an identity verification method provided in Embodiment 1 of the present application;

FIG. 2 is a signaling diagram of a registration process according to Embodiment 1 of the present application;

3 is a flowchart of an identity verification method provided in Embodiment 2 of the present application;

FIG. 4 is a signaling diagram of a verification process according to Embodiment 2 of the present application;

5 is a flowchart of an identity verification method provided in Embodiment 3 of the present application;

FIG. 6 is a schematic structural diagram of an identity verification device according to Embodiment 4 of the present application;

FIG. 7 is a schematic structural diagram of a computer device according to Embodiment 5 of the present application.

detailed description

Password authentication protocols used in the related art include PAP and a challenge-response based password authentication protocol CRAM-MD5.

In CRAM-MD5, the server uses a one-way hash function to calculate the digest information for the password during the registration phase, and stores the user name and digest information in the database. When logging in, the client initiates a verification request to the server; after the server receives the verification request, it generates a random number and sends it to the client. After the client calculates the digest information for the password entered by the user, it calculates the digest again together with the random number. information, send the user name entered by the user and the final summary information to the server; the server retrieves the summary information associated with the user name from the database, and recalculates the summary information together with the random number. If the digest information finally calculated by the client is consistent, the user's authentication is successful. If the digest information sent by the client is inconsistent with the digest information finally calculated by the server, the user's authentication fails.

For each verification, the server sends an additional random number to the client to challenge, causing the verification between the client and the server to require 2-RTT (Round-Trip Time, round-trip delay), 2-RTT is two interactions, The verification takes a long time; in addition, the server uses a one-way hash function to calculate the digest information for the password, and the digest information is leaked, and it is still possible for an attacker to use a dictionary attack to crack the password.

In view of the above-mentioned defects in the above-mentioned identity verification technologies in the related art, the embodiments of the present application provide a new type of identity verification methods, that is, the embodiments of the present application disclose an identity verification method, device, computer equipment, and storage medium for In the case of reducing the verification time, it can prevent eavesdropping attacks and replay attacks during insecure network transmission, and prevent the threat of dictionary attacks caused by database leakage on the server side.

The present application will be described below with reference to the accompanying drawings and embodiments.

Example 1

FIG. 1 is a flowchart of an identity verification method provided in Embodiment 1 of the present application. This embodiment can perform the registration behavior of the client, and the method can be performed by an identity verification device, and the identity verification device can be performed by software and/or hardware. Realization, the authentication device can be configured in a computer device, such as a server, a workstation, a personal computer, etc., the computer device, as a server server, establishes a secure transmission channel with the client Client, such as applying hypertext transmission security Protocol (Hyper Text Transfer Protocol over SecureSocket Layer, HTTPS), so that the server server communicates with the client client. The method includes the following steps:

Step 101: Receive a registration request sent by a client.

In this embodiment, when the user registers the identity with the server server, the user name username and password password can be input in the user interface (User Interface, UI) provided by the client terminal Client.

In general, the client client is an independent application, such as a live broadcast application, a short video application, an instant messaging tool, a payment application, a shopping application, etc. The application can generate and count the user counter CT.

If the browser can support storing the user counter CT locally, the browser can also participate in the registration and verification of the identity as a client client.

In addition, the username username can also be called a user account, a user identification (Identity, ID), etc. The username username is the information that identifies the user, and the password password can also be called a password. The user can set the password according to business rules. The password password is set to a combination of numbers, letters, symbols, and so on.

As shown in Figure 2, during registration, the client Client assembles the user name username and password as registration parameters into the registration request _M11 , and sends the registration request _M11 to the server server, that is, the registration request _M11 includes Username username, password password.

The server server can receive the registration request M ₁₁ sent by the client client, and read the username and password from the registration request M ₁₁ .

Step 102: Set a target value, use the target value as the number of times to calculate digests, generate digest information for the password, and use the generated digest information as standard digest information.

In this embodiment, as shown in FIG. 2 , the server server may set a value of a suitable length as the target value N _max according to the requirements of the business scenario for verifying the user's identity.

The target value N _max is the maximum ordinal number set by the server, and the target value N _max can be an integer, indicating the initial number of times and the upper limit of times for calculating digests for the password, which can be set according to the security policy.

The length of the target value N _max is negatively correlated with the security of the target value N _max , and positively correlated with the validity period of the target value N _max , that is, the larger the length of the target value N _max , the lower the security and the longer the validity period. The shorter the length of N _max , the higher the security and the shorter the validity period.

In application scenarios with lower security requirements, a larger target value N _max can be generated to reduce the frequency of registration. In application scenarios with higher security requirements, a shorter target value N _max can be generated , to improve the security of authentication.

For example, if the business scenario is login, the user experience is more important. If the user logs in twice a day on average, the target value N _max can be set to 400. In this way, the target value N _max is valid for half a year, that is, the client terminal will be valid for about half a year. The time does not need to modify the password password, re-register.

For another example, if the application scenario is payment, security is more important. If the user pays an average of 5 times a week, the target value N _max can be set to 20. In this way, the validity period of the target value N _max is about 1 month, guaranteeing a The password should be updated once a month to prevent economic losses caused by the leakage of the password of the client client.

After the number of times of calculating the digest information (ie, the target value N _max ) is determined, the serial one-way hash function can be used to calculate the digest information for the password, and the calculated digest information is used as the standard digest information.

In addition, the so-called serial one-way hash function

In order to use the one-way hash function H, continuously calculate the summary information for N _max times for the input password password of any length, and the summary information obtained after calculating the summary information for N _max times is regarded as the standard summary information D ₁ , which is expressed as follows:

where N _max ≥ 0; when N _max =0, H ⁰ (password)=password, when N _max =1, H ¹ (password)=H (password), and so on.

In one embodiment, the one-way hash function H is a standard secure one-way hash function, which can calculate and generate L-byte fixed-length digest information B ₀ B ₁ B ₂ . . . B _L-2 B _{L- 1.} The one-way hash function H may include Message Digest Algorithm 5 (MD5), Secure Hash Algorithm (SHA), and so on. Among them, MD5 outputs 16B digest information, SHA1 outputs 20B digest information, SHA256 outputs 32B digest information, SHA512 outputs 64B digest information, and so on.

Step 103: Encrypt the standard digest information to obtain standard ciphertext.

In this embodiment, as shown in FIG. ₂ , an encryption method may be preset, and the standard digest information D1 is encrypted according to the encryption method, and the encrypted ciphertext is the standard ciphertext D.

In an encryption method, random functions such as rand() and srand() can be called to randomly generate a value as a random number Salt to prevent Man-in-the-Middle Attack (MITM attack) and replay attacks. Increase security.

Among them, the man-in-the-middle attack is an indirect intrusion attack. This attack mode is to virtually place a computer controlled by the intruder between two communication computers connected by the network through various technical means. This computer is called middleman.

Combine the standard digest information D ₁ and the random number Salt into a registered array according to a preset combination method. For example, the random number Salt is connected to the end of the standard digest information D ₁ , and the random number Salt is inserted into the byte specified by the standard digest information D ₁ . After that, wait.

Calculate the digest information for the registration array, and then the standard ciphertext D can be obtained. The standard ciphertext D is expressed as:

D=H(D ₁ |Salt)

The above method of generating standard ciphertext is only _an example. When implementing the embodiments of the present application, other methods of generating standard ciphertext may be set according to actual conditions. _The information D1 is XORed bitwise with the mask, resulting in standard ciphertext, and so on. In addition, in addition to the above-mentioned methods for generating standard ciphertext, those skilled in the art may also adopt other methods for generating standard ciphertext according to actual needs.

Step 104: Assign the target value to the service counter.

In this embodiment, as shown in FIG. 2 , a counter is set in the server server, as the service counter N, and the service counter is set to record the number of times the serial one-way hash function currently calculates the digest.

When the client client is registered, the target value N _max can be assigned to the service counter N, expressed as N=N _max , to realize the initialization of the service counter N.

Step 105: Store the user name, standard ciphertext, service counter and target value as registration parameters.

In this embodiment, as shown in FIG. 2 , after receiving the registration request M ₁₁ of the client Client, the server server responds to the registration request M ₁₁ to register the client Client, and when the registration is successful, the registration process is The user name username, the standard ciphertext D, the service counter N and the target value N _max are used as registration parameters, and are stored in the local database of the computer device.

In one embodiment, if the server server uses other parameters other than the username username, the service counter N, and the target value N _max to generate the standard ciphertext D, the other parameters can be used as registration parameters for persistence. storage.

In an example, as shown in Figure 2, if the random number Salt is used to generate the standard ciphertext D, the user name username, the standard ciphertext D, the service counter N, the target value Nmax and the random number Salt can be used as the registration parameters for registration. Persistent storage, that is, storing the tuple {username, D, N, N _max , Salt}.

In addition, for the password password, it is deleted when the registration is completed, and it is not stored persistently.

Step 106: Send the service counter to the client.

In this embodiment, as shown in _FIG . ₂ , the server server encapsulates the service counter N into the registration response M12, and sends the registration response M12 to the client client Client.

_The client Client generates a counter locally as a user counter CT. When receiving the registration response M12, it can read the service counter N from the registration response M12, and assign the value _of the service counter N to the local user counter CT, At this point, the client Client completes the registration with the server server.

During the registration process, the computer device receives the registration request sent by the client, the registration request includes the user name and the password, sets the target value, uses the target value as the number of times to calculate the digest, generates digest information for the password, and the generated digest information serves as the standard Digest information, encrypt the standard digest information, obtain the standard ciphertext, assign the target value to the service counter, store the user name, standard ciphertext, service counter and target value as registration parameters, and send the service counter to the client, The client is set to assign the value of the service counter to the local user counter, and uses the irreversibility of the one-way hash function to encrypt and store the password during the registration process to prevent potential dictionary attacks when the password is stored and improve The security of the user's identity is ensured, and the computer device and the client synchronize the count to support the calculation of the digest of the password in a decremented manner during the authentication process and keep it consistent.

Embodiment 2

FIG. 3 is a flowchart of an identity verification method according to Embodiment 2 of the present application. This embodiment may not be based on the foregoing embodiments, or, this embodiment may be based on the foregoing embodiments, and an operation of identity verification may be added. The method includes the following steps:

Step 301: Receive a verification request sent by a client.

As shown in FIG. 4 , when the client client registers with the server server, the user counter CT of the client client synchronizes the service counter N of the server server.

When a user authenticates, information such as username and password can be entered in the user interface provided by the client client.

The client Client extracts the locally stored user counter CT, uses the value stored in the current user counter CT as the number of times to calculate the digest and the digest information generated for the password, and obtains the verification digest information D _c , which is expressed as follows:

D _c = H ^CT (password)

The client client Client encapsulates the username username, the verification summary information _Dc , and the user counter CT into the verification request _M21 , and sends the verification request message _M21 to the server server, that is, the verification request _M21 includes the username username, verification Summary information Dc, user counter CT.

The server server can receive the verification request M ₂₁ sent by the client client, and read the username username, verification summary information Dc, and user counter CT from the verification request M ₂₁ .

Step 302 , look up the registration parameters associated with the user name recorded when the client is registered.

As shown in Figure 4, when the client client registers with the server server, the server server can persist parameters such as username, standard ciphertext D, service counter N, target value N _max and random number Salt as registration parameters. storage.

When the client Client receives the verification request _M21 , it can use the username username in the verification request _M21 as an index, search the database in the server server for the same username username, and extract the registration parameters associated with the username username .

In this embodiment, the registration parameters extracted by the server server include at least a service counter N and a standard ciphertext D.

Step 303: Match the user counter with the service counter to detect the consistency between the decreasing value of the user counter and the decreasing value of the service counter during authentication.

As shown in Figure 4, in the process of authentication, the user counter CT of the client client and the service counter N of the server server decrease the value in the same way to realize the adjustment of the count. The number of times that the password is digested is less than the number of times that the client Client calculates the digest for the password in the last authentication.

Therefore, in this embodiment, the server server can match the user counter CT with the service counter N to detect whether the decrease in the value of the user counter CT is consistent with the decrease in the value of the service counter N during the authentication process. .

If the decreasing value of the user counter CT is consistent with the decreasing value of the service counter N, it can be considered that the matching of the user counter CT and the service counter N is successful.

If the decreasing value of the user counter CT is not consistent with the decreasing value of the service counter N, it may be considered that the matching of the user counter CT and the service counter N fails.

In a matching method, considering that there will be some errors during the running of the client client, the user counter CT will be counted incorrectly.

In order to improve the fault tolerance capability and ensure that the client client performs authentication normally, in this mode, the user counter CT and the service counter N can be compared.

If the user counter CT is less than or equal to the service counter N (that is, CT≤N), it may be that the client client is running normally, the user counter CT and the service counter N are both accurate and equal, or the client client runs incorrectly and the user The counter CT is smaller than the service counter N. At this time, it can be determined that the decreasing value of the user counter CT is consistent with the decreasing value of the service counter N, that is, the matching of the user counter CT and the service counter N is successful.

If the user counter CT is greater than the service counter N (that is, CT>N), the client Client may experience a replay attack. At this time, it can be determined that the decreasing value of the user counter CT is not consistent with the decreasing value of the service counter N. , that is, the user counter CT fails to match the service counter N.

Step 304: In response to the successful matching between the user counter and the service counter, verify the identity of the client according to the difference between the standard ciphertext and the verification digest information.

As shown in Figure 4, if the user counter CT and the service counter N are successfully matched, the standard ciphertext D and the verification digest information Dc can be compared, and the difference between the standard ciphertext D and the verification digest information Dc can be compared, and the Authentication.

In an authentication method, in order to improve the fault tolerance capability and ensure the normal authentication of the client client, the target value N _max can be extracted from the registration parameter of the client client.

In this method, the difference between the target value N _max and the user counter CT is used as the number of times to calculate the digest, and the digest information is generated for the verification digest information D _c , and the generated digest information is used as the intermediate digest information D ₂ , which is expressed as follows:

_The intermediate digest information D2 is encrypted according to a preset encryption method to obtain the verification ciphertext D'.

Exemplarily, the random number Salt can be extracted from the registration parameters of the client client, and the intermediate summary information D ₂ and the random number Salt can be combined into a verification array. For example, the random number Salt is connected to the tail of the intermediate summary information D ₂ , and the random number Salt is inserted after the bytes specified by the intermediate digest information D2, and so _on .

Calculate the digest information for the verification array, and use the calculated digest information as the verification ciphertext D', then the standard ciphertext D' is expressed as:

D'=H(D ₂ |Salt)

The verification ciphertext D' is compared with the standard ciphertext D.

If the verification ciphertext D' is the same as the standard ciphertext D (ie D'=D), it is determined that the authentication of the client is successful.

If the verification ciphertext D' is different from the standard ciphertext D (ie D'≠D), it is determined that the authentication of the client fails.

For example, the difference between the standard ciphertext and the verification digest information can be characterized as the difference between the standard ciphertext and the verification ciphertext. The corresponding verification ciphertext may be determined according to the verification summary information.

In this embodiment, the difference between the target value and the user counter is used as the number of times to calculate the digest, and digest information is generated for the verification digest information, and the generated digest information is used as the intermediate digest information, and the intermediate digest information is encrypted according to a preset encryption method. Perform encryption, obtain the verification ciphertext, compare the verification ciphertext with the standard ciphertext, and verify the identity of the client, which can achieve fault tolerance for the situation where the client runs incorrectly and causes a count error, improves the success rate of authentication, and avoids the need for customers to The terminal is repeatedly authenticated.

In one example, assume the target value N _max =100, the service counter N=90, and the user counter CT=80.

During registration, the server server can generate standard digest information D ₁ =H ¹⁰⁰ (password), and then can generate standard cipher text D=H(D ₁ |Salt)=H(H ¹⁰⁰ (password)|Salt).

During verification, the client client generates verification summary information D _c =H ⁸⁰ (password), and the server server determines the user counter CT (ie 80) < service counter N (ie 90), and calculates the intermediate summary information D ₂ =H ^{100 -80} (H ⁸⁰ (password))=H ¹⁰⁰ (password), correspondingly, the verification ciphertext D′=H (H ¹⁰⁰ (password)|Salt) can be generated.

Therefore, the standard ciphertext D=verified ciphertext D', and the authentication of the client client Client succeeds.

In addition, in the case of non-fault tolerance, the verification digest information D _c can be encrypted according to the preset encryption method to obtain the verification ciphertext D', and the verification ciphertext D' is compared with the standard ciphertext D to verify the identity of the client. authenticating.

In the verification process, the verification request sent by the client is received, and the verification request includes the user name, verification summary information, and user counter. Look up the registration parameters associated with the username recorded at the time of client registration, the registration parameters include the service counter, standard ciphertext, and match the user counter with the service counter to detect the decrease of the user counter and the service counter during authentication In response to a successful match between the user counter and the service counter, the identity of the client is verified according to the difference between the standard ciphertext and the verification digest information. In this embodiment, on the one hand, within 1-RTT (one interaction), the client completes the verification of the password, which reduces the number of RTTs and reduces the time-consuming of verification. On the other hand, using the irreversibility of the one-way hash function, During the verification process, the number of times to calculate the digest of the password is decreased, which can prevent the eavesdropping attack and replay attack of the password in the network transmission process, and prevent the potential dictionary attack when the password is stored, which improves the security of the user's identity. .

Embodiment 3

5 is a flowchart of an identity verification method provided in Embodiment 3 of the present application. Based on the foregoing embodiment, this embodiment adds an operation of verifying a response, and the method includes the following steps:

Step 501: Receive a verification request sent by a client.

The verification request includes the username username, verification summary information Dc, and user counter CT, and the verification summary information Dc is the summary information generated for the password using the user counter CT as the number of times of calculating the digest and the password.

Step 502 , look up the registration parameters associated with the user name recorded when the client is registered.

The registration parameters include service counter N and standard ciphertext D.

Step 503: Match the user counter with the service counter to detect the consistency between the decreasing value of the user counter and the decreasing value of the service counter during authentication.

Step 504: In response to the failure to match the user counter with the service counter, determine that the authentication of the client fails.

As shown in Figure 4, if the user counter CT fails to match the service counter N (for example, CT>N), the client Client may experience a replay attack. The identity of the client is verified to prevent replay attacks and protect user data security.

Step 505: In response to the successful matching between the user counter and the service counter, verify the identity of the client according to the difference between the standard ciphertext and the verification digest information.

Step 506: Decrease the value of the user counter in response to the successful authentication of the client.

Step 507: Assign the user counter after the reduced value to the service counter.

As shown in FIG. 4 , in the case that the authentication of the client is successful, the server of the server may generate an identification indicating successful authentication, such as success, and encapsulate the identification indicating successful authentication into the authentication response _M22 .

In addition, the user counter CT of the client client and the service counter N of the server server are both set to record the number of times the digest of the password is calculated using the serial one-way hash function.

In this embodiment, the one-way property of the one-way hash function is used, that is, the relationship from the summary information to the original data is irreversible. In the case that the authentication of the client is successful, the user counter CT of the client and the service The service counter N of the end server is decremented to prevent the replay attack of the password during network transmission.

For example, when the client client authenticated the identity last time, it calculated 5 digests for the password, which is represented as H ⁵ (password) ^. password), assuming that the attacker intercepts H ⁵ (password) during network transmission, given the one-way nature of the one-way hash function, it is difficult for the attacker to replay from H ⁵ (password) to H ⁴ (password).

In one embodiment, in order to maximize the duration of use of the user counter CT of the client client and the service counter N of the server server, and reduce the frequency of re-registration, the user counter CT of the client client and the service counter N of the server server The value reduced each time is the value of the smallest unit, such as 1, that is, the process of reducing the value can be expressed as follows:

N=CT-1

N=CT-1 means that the user counter CT is decremented by 1, and the value of CT-1 is assigned to the service counter N.

In order to prevent replay attacks and improve the security of the password during network transmission, in addition to the minimum unit value (such as 1), other values can also be set, such as 2, 3, 4, and so on.

Step 508: Send the service counter to the client.

As shown in FIG. 4 , after reducing the value of the service counter N, the server server can encapsulate the service counter N into the verification response M ₂₂ and send the verification response M ₂₂ to the client.

After receiving the verification response M ₂₂ , the client Client reads, from the verification response M ₂₂ , an identifier indicating successful verification, such as success, and a service counter N. On the one hand, the client Client performs business operations based on the identifier indicating successful authentication, such as performing operations such as login and payment, on the other hand, assigns the service counter N to the local user counter CT, that is, CT=N, and reduces the local user counter The value of CT is consistent with the service counter N of the server server to ensure the accuracy of subsequent verification.

Step 509: In response to the service counter being less than or equal to the preset threshold, notify the client to modify the password to re-register.

In this embodiment, the server server can check the service counter N, and compare the value of the service counter N with a preset threshold. If the value of the service counter N is less than or equal to the threshold, it means that the value of the service counter N is low, To avoid the failure of authentication due to the exhaustion of the service counter N, a prompt message can be sent to the client server, prompting the user to modify the password, re-register, and change the password to ensure the security of user data.

By setting the mechanism for reducing the counter value, the usage time of the user counter CT of the client client and the service counter N of the server server is also increased as much as possible, and the frequency of re-registration is reduced.

Step 510: In response to the authentication failure of the client, send the service counter to the client.

As shown in Figure 4, for the case where the authentication of the client client fails, it may be that the user counter CT fails to match the service counter N, or the difference between the standard ciphertext D and the verification digest information Dc does not satisfy the verification. condition.

On the one hand, the server server can generate an identifier indicating a verification failure, such as failure, and encapsulate the identifier representing the verification failure in the verification response _M22 ; on the other hand, the server server encapsulates the local service counter N into the verification response _M22 . , and send the verification response M ₂₂ to the client client.

After receiving the verification response M ₂₂ , the client Client reads the identification indicating the verification failure, such as failure, and the service counter N, from the verification response M _22. On the one hand, the client Client performs business operations based on the identification indicating the verification failure. , such as prompting authentication failure, prohibit login, payment and other operations, on the other hand, assign the service counter N to the local user counter CT, that is, CT=N, the local user counter CT of the client and the service counter N of the server server Keep it consistent and reduce authentication failures caused by client operation errors, network transmission errors, and other factors.

another embodiment

An identity registration method provided by another embodiment of the present application includes the following steps:

Receive a registration request sent by the client, where the registration request includes a user name and a password;

A target value is set, and the target value is used as the number of times to calculate the digest, and digest information is generated for the password, and the generated digest information is used as standard digest information;

Encrypting the standard digest information to obtain standard ciphertext;

assigning the target value to the service counter;

storing the username, the standard ciphertext, the service counter and the target value as registration parameters;

Sending the service counter to the client, wherein the client is configured to assign the value of the service counter to a local user counter.

In an embodiment, the encrypting the standard digest information to obtain standard ciphertext includes:

Randomly generate a value as a random number;

combining the standard summary information and the random number into a registration array;

Calculate summary information for the registration array to obtain standard ciphertext;

The storing of the user name, the standard ciphertext, the service counter and the target value as registration parameters includes:

The user name, the standard ciphertext, the service counter, the target value and the random number are stored as registration parameters.

In order to simplify the description, the method embodiments are expressed as a combination of actions in a type of manner, but those skilled in the art should know that the embodiments of the present application are not limited by the described sequence of actions, because according to the embodiments of the present application, some steps may be In another order or simultaneously.

Embodiment 4

6 is a structural block diagram of an identity verification device provided in Embodiment 4 of the present application, which may include the following modules:

The verification request receiving module 601 is configured to receive a verification request sent by a client, the verification request includes a user name, verification summary information, and a user counter, and the verification summary information is the user counter as the number of times to calculate the summary, the corresponding password Calculate the summary, the generated summary information;

A registration parameter search module 602, configured to search for the registration parameters associated with the user name recorded when the client registers, the registration parameters include a service counter and a standard ciphertext;

Counter matching module 603 is configured to match the user counter with the service counter, to detect the consistency of the reduced value of the user counter and the reduced value of the service counter during identity verification;

The difference verification module 604 is configured to verify the identity of the client according to the difference between the standard ciphertext and the verification digest information in response to the successful matching between the user counter and the service counter.

In an embodiment of the present application, the counter matching module 603 includes:

a counter comparison submodule, configured to compare the user counter with the service counter;

A matching success submodule, configured to determine that the user counter and the service counter are successfully matched in response to the user counter being less than or equal to the service counter;

A matching failure submodule, configured to determine that the user counter fails to match the service counter in response to the user counter being greater than the service counter.

In an embodiment of the present application, the registration parameter further includes a target value;

The difference verification module 604 includes:

an intermediate summary information calculation submodule, configured to use the difference between the target value and the user counter as the number of times to calculate the summary, generate summary information for the verification summary information, and use the generated summary information as the intermediate summary information;

A verification ciphertext encryption submodule, configured to encrypt the intermediate digest information to obtain a verification ciphertext;

A verification success submodule, configured to determine that the authentication of the client is successful in response to the verification ciphertext being the same as the standard ciphertext;

The verification failure submodule is configured to determine that the authentication of the client fails in response to the verification ciphertext being different from the standard ciphertext.

In an embodiment of the present application, the registration parameter further includes a random number;

The verification ciphertext encryption submodule includes:

A verification array combination unit, configured to combine the intermediate digest information and the random number into a verification array;

The verification ciphertext calculation unit is configured to calculate digest information for the verification array, and the calculated digest information is used as the verification ciphertext.

In an embodiment of the present application, it also includes:

A numerical value reduction module, configured to reduce the numerical value of the user counter in response to the successful authentication of the client;

A lowering value assignment module is set to assign the user counter after the lowering value to the service counter;

The first counter synchronization module is configured to send the service counter to the client, wherein the client is configured to assign the service counter to a local user counter.

In an embodiment of the present application, it also includes:

A verification failure determination module, configured to determine that the authentication of the client has failed in response to the failure to match the user counter with the service counter;

The second counter synchronization module is configured to send the service counter to the client in response to the authentication failure of the client, wherein the client is configured to assign the service counter to a local user counter.

In an embodiment of the present application, it also includes:

An update notification module, configured to notify the client to modify the password in response to the service counter being less than or equal to a preset threshold.

In an embodiment of the present application, it also includes:

a registration request receiving module, configured to receive a registration request sent by the client, where the registration request includes a user name and a password;

A standard summary information calculation module, configured to set a target numerical value, using the target numerical value as the number of times of calculating the summary, generating summary information for the password, and the generated summary information as the standard summary information;

a standard ciphertext encryption module, configured to encrypt the standard digest information to obtain a standard ciphertext;

A target value assignment module, configured to assign the target value to a service counter;

a registration parameter storage module, configured to store the user name, the standard ciphertext, the service counter and the target value as registration parameters;

A third counter synchronization module is configured to send the service counter to the client, wherein the client is configured to assign the value of the service counter to a local user counter.

In an embodiment of the present application, the standard ciphertext encryption module includes:

The random number generation sub-module is set to randomly generate a value as a random number;

A registration array combination submodule, configured to combine the standard abstract information and the random number into a registration array;

A standard ciphertext calculation submodule, configured to calculate summary information for the registration array to obtain standard ciphertext;

The registration parameter storage module is also set to:

The identity verification device provided by the embodiment of the present application can execute the identity verification method provided by any embodiment of the present application, and has corresponding functional modules and beneficial effects of the execution method.

another embodiment

An identity registration device provided by another embodiment of the present application includes:

The registration parameter storage module is also set to:

Embodiment 5

FIG. 7 is a schematic structural diagram of a computer device according to Embodiment 5 of the present application. FIG. 7 shows a block diagram of an exemplary computer device 12 suitable for implementing embodiments of the present application. The computer device 12 shown in FIG. 7 is only one example.

As shown in FIG. 7, computer device 12 takes the form of a general-purpose computing device. Components of computer device 12 may include: one or more processors or processing units 16 , system memory 28 , and bus 18 connecting various system components including system memory 28 and processing unit 16 .

Computer device 12 typically includes a variety of computer system readable media, including both volatile and nonvolatile media, removable and non-removable media.

System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and/or cache 32 . Computer device 12 may include other removable/non-removable, volatile/non-volatile computer system storage media. For example only, storage system 34 may be configured to read and write to non-removable, non-volatile magnetic media. System memory 28 may include at least one program product having a set (eg, at least one) of program modules configured to perform the functions of various embodiments of the present application.

A program/utility 40 having a set (eg, at least one) of program modules 42 , which may generally perform the functions and/or methods of the embodiments described herein, may be stored, for example, in memory 28 .

Computer device 12 may also communicate with one or more external devices 14 (eg, keyboard, pointing device, display 24, etc.). Such communication may take place through input/output (I/O) interface 22 . Also, computer device 12 may communicate with one or more networks through network adapter 20 . As shown in FIG. 7 , network adapter 20 communicates with other modules of computer device 12 via bus 18 . Other hardware and/or software modules may be used in conjunction with computer device 12 .

The processing unit 16 executes a variety of functional applications and data processing by running programs stored in the system memory 28, for example, to implement the identity verification method provided by the embodiments of the present application.

Embodiment 6

Embodiment 6 of the present application also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, multiple processes of the above-mentioned identity verification method are implemented, and the same technology can be achieved. The effect, in order to avoid repetition, is not repeated here.

The computer-readable storage medium may include, for example, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses or devices, or any combination of the above. Examples of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (Erasable Programmable Read-Only Memory (EPROM), flash memory, fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing, a non-exhaustive list. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

Claims

An authentication method that includes:

Receive a verification request sent by the client, where the verification request includes a user name, verification summary information, and a user counter, and the verification summary information is the summary information generated by using the user counter as the number of times to calculate the summary and the password calculation summary;

Find the registration parameters associated with the username recorded when the client registers, where the registration parameters include a service counter and standard ciphertext;

matching the user counter with the service counter to detect the consistency of the decreasing value of the user counter with the decreasing value of the service counter upon authentication;

In response to a successful match between the user counter and the service counter, the identity of the client is verified according to the difference between the standard ciphertext and the verification digest information.
10. The method of claim 1, wherein the matching of the user counter with the service counter to detect consistency of a decrease in the user counter with a decrease in the service counter upon authentication ,include:

comparing the user counter with the service counter;

In response to the user counter being less than or equal to the service counter, determining that the user counter is successfully matched with the service counter;

In response to the user counter being greater than the service counter, it is determined that the user counter fails to match the service counter.
The method of claim 1, wherein the registration parameter further includes a target value;

The verifying the identity of the client according to the difference between the standard ciphertext and the verification digest information includes:

Using the difference between the target value and the user counter as the number of times of calculating the digest, generating digest information for the verification digest information, and the generated digest information as the intermediate digest information;

Encrypting the intermediate digest information to obtain a verification ciphertext;

In response to the verification ciphertext being the same as the standard ciphertext, determining that the authentication of the client is successful;

In response to the verification ciphertext being different from the standard ciphertext, it is determined that authentication of the client has failed.
The method of claim 3, wherein the registration parameter further comprises a random number;

Encrypting the intermediate digest information to obtain a verification ciphertext, including:

combining the intermediate digest information and the random number into a verification array;

Digest information is calculated for the verification array, and the calculated digest information is used as the verification ciphertext.
The method according to any one of claims 1-4, further comprising:

decreasing the value of the user counter in response to successful authentication of the client;

assigning the user counter after decreasing the value to the service counter;

The service counter is sent to the client, wherein the client is configured to assign the service counter to a local user counter.
The method according to any one of claims 1-4, further comprising:

In response to the user counter failing to match the service counter, determining that authentication of the client has failed;

In response to the authentication failure of the client, the service counter is sent to the client, wherein the client is arranged to assign the service counter to a local user counter.
The method according to any one of claims 1-4, further comprising:

In response to the service counter being less than or equal to a preset threshold, the client is notified to modify the password.
The method according to any one of claims 1-4, further comprising:

Receive a registration request sent by the client, where the registration request includes a user name and a password;

A target value is set, and the target value is used as the number of times to calculate the digest, and digest information is generated for the password, and the generated digest information is used as standard digest information;

Encrypting the standard digest information to obtain standard ciphertext;

assigning the target value to the service counter;

storing the username, the standard ciphertext, the service counter and the target value as registration parameters;

Sending the service counter to the client, wherein the client is configured to assign the value of the service counter to a local user counter.
The method of claim 8, wherein,

Encrypting the standard digest information to obtain standard ciphertext, including:

Randomly generate a value as a random number;

combining the standard summary information and the random number into a registration array;

Calculate summary information for the registration array to obtain standard ciphertext;

The storing of the user name, the standard ciphertext, the service counter and the target value as registration parameters includes:

The user name, the standard ciphertext, the service counter, the target value and the random number are stored as registration parameters.
An identity verification device, comprising:

The verification request receiving module is configured to receive the verification request sent by the client, the verification request includes a user name, verification summary information, and a user counter, and the verification summary information is the number of times that the user counter is used as the calculation summary, and the password is calculated. Abstract, the generated summary information;

a registration parameter search module, configured to search for the registration parameters associated with the username recorded when the client registers, and the registration parameters include a service counter and a standard ciphertext;

A counter matching module, configured to match the user counter with the service counter, to detect the consistency between the reduced value of the user counter and the reduced value of the service counter during authentication;

A difference verification module, configured to verify the identity of the client according to the difference between the standard ciphertext and the verification digest information in response to a successful match between the user counter and the service counter.
A computer device comprising:

at least one processor;

memory, arranged to store at least one program,

The at least one processor is configured to execute the at least one program to implement the authentication method according to any one of claims 1-9.
A computer-readable storage medium, storing a computer program on the computer-readable storage medium, when the computer program is executed by a processor, the authentication method according to any one of claims 1-9 is implemented.