CN106209742A - Safe verification method and system - Google Patents

Abstract

The present application provides a security verification method and system, wherein the security verification method includes: receiving the user name and static password input by the user transmitted by the terminal device; performing the first security verification based on the user name and static password; providing the user with At least two ways to return the dynamic verification information generated by the user-side application; receiving the dynamic verification information returned by the user through one of the at least two ways; and receiving the dynamic verification information returned by the user through one of the at least two ways The verification information is compared with the locally generated dynamic verification information, so as to perform the second security verification. This application avoids the security problem caused by the static password being easily cracked in the first security verification, and effectively guarantees the safety and reliability of user identity verification.

Description

Safety Verification Method and System

technical field

The present application relates to the field of computers, in particular to a safety verification method and system.

Background technique

With the rapid development and application of the Internet, network security issues have become one of the most concerned issues for network providers and users. Security verification of user identity is a necessary means to ensure network security. Currently, most network services use usernames and static passwords to securely authenticate user identities. In order to ensure security, the static password needs to be set more complicated, which makes the password difficult to remember and inconvenient to input. In addition, static passwords also have the risk of being cracked by means such as brute force cracking, credentialing, dragging, peeping, and Trojan horses.

Therefore, there is a risk that the static password is easy to be cracked in the current means of securely verifying the user identity based on the user name and the static password. Therefore, the security of the user identity verification is not high enough.

Contents of the invention

One of the technical problems solved by the present application is to provide a security verification method and system to further improve the security of user identity verification.

According to an embodiment of one aspect of the present application, a security verification method is provided, including:

Receive the user name and static password input by the user transmitted by the terminal device;

performing first security verification based on the username and static password;

Provide the user with at least two ways to return the dynamic verification information generated by the user-side application;

receiving the dynamic verification information returned by the user through one of the at least two ways;

The second security verification is performed by comparing the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information.

According to an embodiment of another aspect of the present application, a security verification system is provided, including:

The first receiving unit is used to receive the user name and static password input by the user transmitted by the terminal device;

A first security verification unit, configured to perform first security verification based on the user name and static password;

A providing unit, configured to provide the user with at least two ways to return the dynamic verification information generated by the user-side application;

A second receiving unit, configured to receive the dynamic verification information returned by the user through one of the at least two ways;

The second security verification unit is configured to compare the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information, so as to perform the second security verification.

In the embodiment of the present application, on the basis of performing the first security verification based on the user name and the static password, the second security verification based on the dynamic verification information is performed. Because the dynamic verification information is dynamically generated, if the person trying to crack is not configured with the same user-side application (dynamic verification information application) that generates the dynamic verification information as the user, it is difficult to crack. Therefore, the safety problem caused by the static password being easily cracked in the first security verification is avoided, and the safety and reliability of user identity verification are effectively guaranteed. And this embodiment provides at least two ways to return the dynamic verification information generated by the user-side application for the second security verification, which overcomes the problem of only providing one way to return the dynamic verification information generated by the user-side application for the second security verification. In the case of the method, due to the limitation of the network environment of the terminal device and/or the terminal capability, the dynamic verification information cannot be returned through this method, resulting in the problem that the second security verification cannot be performed, which effectively ensures the timely and accurate acquisition of dynamic verification information. Thereby further ensuring the reliability of user authentication.

Those of ordinary skill in the art will appreciate that although the following detailed description will refer to illustrated embodiments and accompanying drawings, the application is not limited to these embodiments. Rather, the scope of the application is broad and it is intended that the scope of the application be limited only by the appended claims.

Description of drawings

Other characteristics, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

Fig. 1a is a flowchart of an implementation sequence of a security verification method according to an embodiment of the present application.

Fig. 1b is a flowchart of another implementation sequence of the security verification method according to an embodiment of the present application.

Fig. 2 is a schematic diagram of an interface with an input box for receiving dynamic verification information according to an embodiment of the present application.

Fig. 3 is a schematic diagram of an interface prompting a user to confirm on a verification page according to an embodiment of the present application.

Fig. 4 is a schematic diagram of an interface where a user-side application prompts a user for confirmation according to an embodiment of the present application.

Fig. 5 is a block diagram of a security verification system according to an embodiment of the present application.

The same or similar reference numerals in the drawings represent the same or similar components.

detailed description

Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe operations as sequential processing, many of the operations may be performed in parallel, concurrently, or simultaneously. In addition, the order of operations can be rearranged. The process may be terminated when its operations are complete, but may also have additional steps not included in the figure. The processing may correspond to a method, function, procedure, subroutine, subroutine, or the like.

The computer equipment includes user equipment and network equipment. Wherein, the user equipment includes, but is not limited to, computers, smart phones, PDAs, etc.; Or a cloud composed of network servers, among them, cloud computing is a kind of distributed computing, a super virtual computer composed of a group of loosely coupled computer sets. Wherein, the computer device can operate independently to realize the present application, and can also access the network and realize the present application by interacting with other computer devices in the network. Wherein, the network where the computer device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a VPN network, and the like.

It should be noted that the user equipment, network equipment, and network are only examples, and other existing or future computer equipment or networks that are applicable to this application should also be included in the scope of protection of this application, and Included herein by reference.

The methods discussed below, some of which are illustrated by flowcharts, can be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine or computer readable medium such as a storage medium. The processor(s) can perform the necessary tasks.

Specific structural and functional details disclosed herein are representative only and are for purposes of describing example embodiments of the present application. This application may, however, be embodied in many alternative forms and should not be construed as limited to only the embodiments set forth herein.

It will be understood that although the terms "first", "second", etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of example embodiments. As used herein, the term "and/or" includes any and all combinations of one or more of the associated listed items.

It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may be present. In contrast, when an element is referred to as being "directly connected" or "directly coupled" to another element, there are no intervening elements present. Other words used to describe the relationship between elements should be interpreted in a similar fashion (e.g., "between" as opposed to "directly between", "adjacent to" as opposed to than "directly adjacent to" etc.).

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms "a", "an" and "an" are intended to include the plural unless the context clearly dictates otherwise. It should also be understood that the terms "comprising" and/or "comprising" as used herein specify the presence of stated features, integers, steps, operations, units and/or components, but do not exclude the presence or addition of one or more Other features, integers, steps, operations, units, components and/or combinations thereof.

It should also be noted that in some alternative implementations, the functions/acts noted may occur out of the order noted in the figures. For example, two figures shown in succession may, in fact, be executed substantially concurrently or may sometimes be executed in the reverse order, depending upon the functionality/acts involved.

As mentioned above, since the method of securely verifying the user identity based on the user name and the static password has the risk that the static password is easily cracked, the security is not high. In order to solve this problem, the embodiments of the present application perform security verification based on dynamic verification information on the basis of security verification based on user names and static passwords, which effectively improves the security and reliability of user identity verification.

For the convenience of description, in the following embodiments of the present application, the security verification based on the user name and the static password is called the first security verification, and the security verification based on the dynamic verification information is called the second security verification.

The technical solution of the present application will be described in further detail below in conjunction with the accompanying drawings.

Figures 1a-1b are flowcharts of two different execution sequences of a security verification method according to an embodiment of the present application. The security authentication method can be implemented by a server capable of implementing security authentication, or can be implemented by a group of servers. The group of servers may be, for example, two servers, one of which is a server for implementing the first security verification, and the other is a server for implementing the second security verification. The group of servers may also be a cloud server group including multiple servers. As shown in Figure 1a-b, the security verification method mainly includes the following steps:

S10. Receive the user name and static password input by the user transmitted by the terminal device;

S11. Perform first security verification based on the user name and static password;

S12. Provide the user with at least two ways to return the dynamic verification information generated by the user-side application;

S13. Receive the dynamic verification information returned by the user through one of the at least two ways;

S14. Perform a second security verification by comparing the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information.

The above steps will be further described in detail below.

Wherein, steps S10 and S11 are the implementation process of the first security verification, and the embodiment of the present application does not specifically limit the first security verification method, which can be realized by using existing technologies.

Steps S12-S14 are the implementation process of the second security verification. It should be noted that the second security verification in the embodiment of the present application can be verified after the first security verification is passed, as shown in FIG. During the first security verification, the second verification is performed based on the dynamic verification information, as shown in FIG. 1b.

The user-side application is an application that is pre-bound with the user name (or ID) of the user and can generate dynamic verification information, and can be carried in the smart mobile terminal. The dynamic verification information is generated by the following algorithm in the user-side application:

Dynamic verification information = f (random character string, time factor, password length) (1)

The server also generates a dynamic verification message through the same algorithm as above. If the dynamic verification information reported by the user-side application to the server in real time is consistent with the dynamic verification information generated by the server in real time, the second security verification is passed.

In order to realize the security verification based on the dynamic verification information, in the embodiment of the present application, the user-side application or the server (hereinafter referred to as the server) used to realize the second security verification can generate the random character string, and simultaneously use the user-side application and the server to generate the random character string. Save the random character string, wherein the random character string is stored in association with the user-side application ID, and the user-side application ID is bound to the user name of the user who owns the terminal where the user-side application is installed. The random character string can be found through the user's username on both the user side application side and the server side, and the random character strings found for the same user are the same. In this way, it is guaranteed that the random character string variables in the above algorithm (1) at the user side application side and the server side are the same.

During the initial configuration of the dynamic verification information application, let the dynamic verification information application communicate with the server to obtain the current system time of the server, and then save the time difference between the server's system time and the system time of the system where the user-side application is located in the user-side application. When the user-side application needs to generate dynamic verification information, the system time of the system where the current user-side application is located plus the time difference is used as the time factor (actually the calculated system time of the current server), and is substituted into the algorithm (1 ). When the server generates dynamic authentication information, the current system time of the server is used to substitute into algorithm (1). In this way, it is ensured that the time factor in the above algorithm (1) at the user side application side and the server side is the same.

During the initial configuration of the dynamic verification information application, the password length used by the dynamic verification information application in algorithm (1) is also configured to be the same as the password length used by the server in algorithm (1).

In this way, at the same moment, the dynamic verification information generated by the user-side application in real time through the above algorithm (1) and reported to the server should be consistent with the dynamic verification information generated by the server in real time through the above algorithm (1). If it is verified that the dynamic verification information reported by the user-side application to the server in real time is consistent with the dynamic verification information generated by the server in real time, the second security verification is passed.

The ways to return the dynamic verification information generated by the user-side application in step S12 include but are not limited to the following three ways:

Approach 1) Provide the user with an input box for inputting dynamic verification information generated by the user-side application.

Wherein, the input box can be an input box different from receiving a static password, that is, an input box is provided separately for receiving dynamic verification information, as shown in FIG. 2 , an input box for receiving dynamic verification information is provided on the verification page. Input box;

The input box can also be the same input box as the input box that receives the static password. For example, for scenarios such as Outlook that do not support changing the verification page, the input box that receives the static password is directly used as the input box that receives the dynamic verification information, and Recognize the password with the specified number of digits in the input information received through the input box as the dynamic verification information input by the user. In this embodiment, the dynamic verification information is entered after the static password is entered in the static password input box.

In a specific implementation, the dynamic verification information received through the input box for receiving the dynamic verification information may be directly transmitted to the server for implementing the second security verification. The dynamic verification information may also be transmitted to the user's second security verification server through the server for the first security verification (this is the scenario where the static password input box and the dynamic verification information input box are the same input box).

Approach 2) Sending a pending confirmation message to the user-side application of the user, triggering the user-side application to send a verification request carrying the dynamic verification information generated by the user-side application.

Sending a pending confirmation message to the user-side application of the user, that is, sending a pending confirmation message to the user-side application bound to the username. The pending confirmation message includes the username and event to be confirmed, for example, the content of the pending confirmation message is: XX account requests login.

For example, send a pending confirmation message to the user-side application bound to the user, and at the same time prompt the user to go to the user-side application for confirmation on the verification page, as shown in Figure 3, prompting the user "Please turn on the mobile phone to confirm login".

The confirmation message is displayed in the user-side application for the user to confirm, and the user can choose to accept or reject to confirm, and the confirmation result will be sent to the server in the form of a verification request together with the dynamic verification information generated by the user-side application.

It can be understood that the verification request sent by the user-side application and carrying the confirmation result and dynamic verification information may also include the ID of the user-side application.

Approach 3) providing the user with a two-dimensional code picture, so that the user-side application triggers sending a verification request carrying dynamic verification information generated by the user-side application by scanning the two-dimensional code picture.

For example, a QR code picture can be displayed on the verification page, and the user is prompted to scan the QR code picture to complete the verification. After the user scans the QR code through the user-side application, the interface shown in Figure 4 appears on the user-side application.

Wherein, the application on the user side can obtain the message to be confirmed in the picture of the two-dimensional code by scanning the picture of the two-dimensional code, and the message to be confirmed includes the user name and event to be confirmed, for example, the content of the message to be confirmed is: XX account requests to log in. The user can choose to accept or reject in the user-side application interface (as shown in Figure 4) to confirm, and the confirmation result will be sent to the server in the form of a verification request together with the dynamic verification information generated by the user-side application.

It can be understood that the verification request sent by the user-side application and carrying the confirmation result and dynamic verification information may also include the ID of the user-side application.

Since one of the above three methods is provided separately, there are certain disadvantages. For example, if the method 1 is provided separately, the user needs to manually input dynamic verification information, and the user experience is poor; if the method 2 is provided separately, network support is required , in the case of poor network quality, there is a delay; if the method 3) is provided separately, network support is required, and providing a QR code image requires a certain display space. For terminals that do not support displaying QR code images, such as VPN ( Virtual PrivateNetwork (Virtual Private Network) terminal, or SSH (Secure Shell Protocol, secure shell protocol) terminal cannot be displayed.

The embodiment of the present application provides at least two ways to return dynamic verification information at the same time, which can effectively avoid the problems existing in a single way, so as to obtain dynamic verification information in time, perform second security verification based on dynamic verification information, and improve verification speed.

In addition, it should be noted that, in another embodiment, the server may determine which dynamic verification information generated by the user-side application is returned to the user according to the network environment of the terminal device and/or the terminal capability of the terminal device. That is, step S12 may include:

Obtaining the network environment where the terminal device is located and/or the terminal capability of the terminal device;

According to the acquired network environment where the terminal device is located and/or the terminal capability of the terminal device, provide the user with at least two ways to return the dynamic verification information generated by the user-side application.

The current network environment includes: whether to connect to the network, network speed, network signal strength, and the like. The terminal capabilities include: whether to support the display of two-dimensional codes, whether to support the provision of dynamic verification information input boxes, and so on. The acquiring includes: receiving and/or detecting. Examples of receiving For example, a box for filling in the network environment of the terminal device and/or the terminal capabilities of the user can be set on the verification interface of the terminal device, and the user can input, and the server can obtain the content filled in by the user to know the location of the terminal device. The network environment and/or terminal capabilities of the terminal device. An example of detection is, for example, that the server detects that the terminal device is currently connected to the network or not connected to the network, which is achievable in the current technology.

For example, the server detects that the network environment where the terminal device is located is connected to the network, but the terminal does not support the display of two-dimensional codes. At this time, the server only provides the above-mentioned method 1) and method 2) to the user instead of providing all the methods to the user. .

Step S13 is to receive the dynamic verification information returned by the user through one of the at least two ways, that is, the user can return the dynamic verification information through any one of the at least two ways. For example, if the above three methods are provided at the same time, the user can directly verify the verification message in the user-side application through method 2) and send a verification request carrying the dynamic verification information generated by the user-side application. This process does not require the user to enter dynamic verification information. Of course, the dynamic verification information can also be returned through approach 1) or approach 3).

Step S14 is to compare the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information, so as to perform a second security verification.

The principle of the second security verification is as described above. The locally generated dynamic verification information is the dynamic verification information locally generated by the server performing the second security verification, and the server is a server bound to the user-side application.

In the embodiment of the present application, on the basis of the first security verification based on the user name and static password, the second security verification based on the dynamic verification information is performed, which avoids the security problem caused by the static password being easily cracked in the first security verification. Effectively guarantee the safety and reliability of user authentication. And this embodiment provides at least two ways to return the dynamic verification information generated by the user-side application for the second security verification, which effectively ensures timely and accurate acquisition of dynamic verification information to ensure the execution of the second security verification, thereby further ensuring Reliability of user authentication.

The embodiment of the present application also provides a security verification system corresponding to the above security verification method. The security verification system may include a group of servers. The group of servers may be, for example, two servers, one of which is a server for implementing the first security verification, and the other is a server for implementing the second security verification. Of course, the group of servers may also be a cloud server group including multiple servers. A kind of security verification system shown in Fig. 5, comprises:

The first receiving unit 20 is configured to receive the user name and static password input by the user transmitted by the terminal device;

The first security verification unit 21 is configured to perform first security verification based on the user name and static password;

A providing unit 22, configured to provide the user with at least two ways to return the dynamic verification information generated by the user-side application;

The second receiving unit 23 is configured to receive the dynamic verification information returned by the user through one of the at least two ways;

The second security verification unit 24 is configured to compare the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information, so as to perform the second security verification.

Optionally, one of the at least two ways of returning the dynamic verification information generated by the user-side application is: providing an input box for the user to input the dynamic verification information generated by the user-side application.

Optionally, one of the at least two ways of returning the dynamic verification information generated by the user-side application is: sending a message to be confirmed to the user-side application of the user, triggering the user-side application to send a message carrying the A verification request for dynamic verification information generated by the user-side application.

Optionally, one of the at least two ways of returning the dynamic verification information generated by the user-side application is: providing the user with a two-dimensional code picture, so that the user-side application scans the two-dimensional code picture And trigger sending a verification request carrying the dynamic verification information generated by the user-side application.

Optionally, the providing unit is further configured to:

Obtaining the network environment where the terminal device is located and/or the terminal capability of the terminal device;

According to the acquired network environment where the terminal device is located and/or the terminal capability of the terminal device, provide the user with at least two ways to return the dynamic verification information generated by the user-side application.

It should be noted that the present application can be implemented in software and/or a combination of software and hardware, for example, it can be implemented by using an application specific integrated circuit (ASIC), a general-purpose computer or any other similar hardware devices. In one embodiment, the software program of the present application can be executed by a processor to realize the steps or functions described above. Likewise, the software program (including associated data structures) of the present application can be stored in a computer-readable recording medium such as RAM memory, magnetic or optical drive or floppy disk and the like. In addition, some steps or functions of the present application may be implemented by hardware, for example, as a circuit that cooperates with a processor to execute each step or function.

In addition, a part of the present application can be applied as a computer program product, such as a computer program instruction. When it is executed by a computer, the method and/or technical solution according to the present application can be invoked or provided through the operation of the computer. The program instructions for invoking the method of the present application may be stored in a fixed or removable recording medium, and/or transmitted through a data stream in a broadcast or other signal-carrying medium, and/or stored in a in the working memory of the computer device on which the program instructions described above are executed. Here, an embodiment according to the present application includes an apparatus comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, triggering The operation of the device is based on the foregoing methods and/or technical solutions according to multiple embodiments of the present application.

It will be apparent to those skilled in the art that the present application is not limited to the details of the exemplary embodiments described above, but that the present application can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Accordingly, the embodiments should be considered exemplary and non-restrictive in all points of view, and the scope of the application is defined by the appended claims rather than the foregoing description, and it is intended that the scope of the present application be defined by the appended claims rather than by the foregoing description. All changes within the meaning and range of equivalents of the elements are embraced in this application. Any reference sign in a claim should not be construed as limiting the claim concerned. In addition, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or devices stated in the system claims may also be realized by one unit or device through software or hardware. The words first, second, etc. are used to denote names without implying any particular order.

Claims (10)

1. A safety verification method, characterized in that, comprising: Receive the user name and static password input by the user transmitted by the terminal device; performing first security verification based on the username and static password; Provide the user with at least two ways to return the dynamic verification information generated by the user-side application; receiving the dynamic verification information returned by the user through one of the at least two ways; The second security verification is performed by comparing the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information. 2. The security verification method according to claim 1, wherein one of the at least two ways to return the dynamic verification information generated by the user-side application is: An input box for inputting dynamic verification information generated by the user-side application is provided to the user. 3. The security verification method according to claim 1, wherein one of the at least two ways to return the dynamic verification information generated by the user-side application is: Sending a pending confirmation message to the user-side application of the user, triggering the user-side application to send a verification request carrying the dynamic verification information generated by the user-side application. 4. The security verification method according to claim 1, wherein one of the at least two ways to return the dynamic verification information generated by the user-side application is: A two-dimensional code picture is provided to the user, so that the user-side application triggers sending a verification request carrying dynamic verification information generated by the user-side application by scanning the two-dimensional code picture. 5. The security verification method according to claim 1, wherein providing the user with at least two ways to return the dynamic verification information generated by the user-side application includes: Obtaining the network environment where the terminal device is located and/or the terminal capability of the terminal device; According to the acquired network environment where the terminal device is located and/or the terminal capability of the terminal device, provide the user with at least two ways to return the dynamic verification information generated by the user-side application. 6. A safety verification system, characterized in that, comprising: The first receiving unit is used to receive the user name and static password input by the user transmitted by the terminal device; A first security verification unit, configured to perform first security verification based on the user name and static password; A providing unit, configured to provide the user with at least two ways to return the dynamic verification information generated by the user-side application; A second receiving unit, configured to receive the dynamic verification information returned by the user through one of the at least two ways; The second security verification unit is configured to compare the dynamic verification information returned by the user through one of the at least two ways with the locally generated dynamic verification information, so as to perform the second security verification. 7. The security verification system according to claim 6, wherein one of the at least two ways to return the dynamic verification information generated by the user-side application is: An input box for inputting dynamic verification information generated by the user-side application is provided to the user. 8. The security verification system according to claim 6, wherein one of the at least two ways to return the dynamic verification information generated by the user-side application is: Sending a pending confirmation message to the user-side application of the user, triggering the user-side application to send a verification request carrying the dynamic verification information generated by the user-side application. 9. The security verification system according to claim 6, wherein one of the at least two ways to return the dynamic verification information generated by the user-side application is: A two-dimensional code picture is provided to the user, so that the user-side application triggers sending a verification request carrying dynamic verification information generated by the user-side application by scanning the two-dimensional code picture. 10. The safety verification system according to claim 6, wherein the providing unit is further configured to: Obtaining the network environment where the terminal device is located and/or the terminal capability of the terminal device; According to the acquired network environment where the terminal device is located and/or the terminal capability of the terminal device, provide the user with at least two ways to return the dynamic verification information generated by the user-side application.