CN107979467B - Verification method and device - Google Patents

Abstract

The embodiment of the present invention discloses a verification method and device. The method is used in a verification plug-in or a client, and includes: generating a verification code by itself; displaying the verification code; obtaining user input formed based on the display of the verification code; The user input generates a verification result; based on the verification result, a service request is sent to the service server. With the solution provided in this embodiment, the verification code can be generated by itself for offline verification without the participation of the verification server, thereby avoiding the phenomenon of large verification delay or failure to perform verification caused by heavy load or failure of the verification server.

Description

Verification method and device

technical field

The invention relates to the field of information technology, and in particular, to an offline verification method and device.

Background technique

In order to ensure information security and property security, the device may need to be authenticated when performing certain operations. Usually authentication is dependent on the authentication server. However, once the verification server fails, such as being attacked by hackers or overloaded, it will easily lead to problems such as large verification delay, unsafe or unverifiable verification, and then lead to problems that verification-based business operations or application operations cannot be performed.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention are expected to provide a verification method and apparatus to at least partially solve the problem of long verification delay or failure to verify due to an abnormal verification server or excessive compliance.

In order to achieve the above object, the technical scheme of the present invention is achieved in this way:

A first aspect of the embodiments of the present invention provides a verification method for verifying a plug-in or a client, including:

Generate verification code by yourself;

Display verification code;

obtaining user input formed based on the verification code display;

generating a verification result based on the user input;

Based on the verification result, a service request is sent to the service server.

Based on the above scheme, the method further includes:

Request a verification code from the verification server;

The self-generated verification code includes:

When the verification server returns abnormal information or does not receive the verification code returned by the verification server within a predetermined time, the verification code is automatically generated.

Based on the above solution, the sending of a service request to the service server based on the verification result includes:

Perform signature processing on the verification result to generate verification signature information;

Sending a service request including the verification signature information to the service server; wherein the verification signature information is used to trigger the service server to respond to the service request when a first preset condition is satisfied.

Based on the above solution, performing signature processing on the verification result to generate verification signature information, including:

When the verification result indicates that the verification is passed, signature processing is performed on the verification result to obtain the verification signature information.

Based on the above solution, performing signature processing on the verification result to generate verification signature information, including:

Get the first time information of the current time;

Perform signature processing on the verification result and the first time information to obtain the verification signature information; wherein the first time information is used by the service server to determine whether to respond to the service request based on the first time information.

Based on the above solution, performing signature processing on the verification result to generate verification signature information, including:

obtaining the first application signature information of the application that generates the service request;

Perform signature processing on the verification result and the application signature information to obtain the verification signature information; the application signature information is used by the service server to prevent illegal applications from calling the application.

Based on the above solution, performing signature processing on the verification result to generate verification signature information, including:

Obtain device identification information;

Perform signature processing on the verification result and the device identification information to obtain the verification signature information; wherein, the device identification information is used for whether the current service request of the service server is from a legal device or the like.

A second aspect of the embodiments of the present invention provides a verification method, including:

Receive the service request sent based on the verification plug-in or the client based on the verification result; wherein, the verification result is formed based on the verification code generated by the verification plug-in or the client;

When the service request satisfies the second preset condition, the service request is responded to.

Based on the above solution, the receiving is based on the service request sent by the verification plug-in or the client based on the verification result, including:

Receive a service request that includes verification signature information; wherein, the verification signature information is generated based on the verification result of the verification code generated by itself;

The method also includes:

Use the verification public key to process the verification signature information to obtain a first verification digest;

Use the verification private key to process the verification signature information to obtain the original information for generating the verification signature information; wherein, the original information at least includes the verification result;

Perform signature processing on the original information to obtain a second verification digest;

comparing the first verification digest and the second verification digest;

The responding to the service request when the service request satisfies the second preset condition includes:

When the first verification digest and the second verification digest are consistent, the service request is responded to.

Based on the above solution, the verification signature information is generated based on the verification result and the first time information of the verification code generated by the self-generated verification code;

the original information includes the first time information;

The method also includes:

Get the second time information of the current time;

Compare the first time information with the second time information;

When the first verification digest and the second verification digest are consistent, responding to the service request, including:

When the time difference corresponding to the first time information and the second time information is within a preset range, and the first verification digest and the second verification digest are consistent, the service request is responded to.

Based on the above solution, the verification signature information is generated based on the verification result of the verification code generated by itself and the first application signature information;

The performing signature processing on the original information to obtain a second verification digest, including:

Perform signature processing on the verification result in the original information and the second application signature information of the legitimate application to obtain the second verification digest.

Based on the above solution, the verification signature information is generated based on the verification result and device identification information of the verification code generated by itself;

The original information also includes device identification information;

The method also includes:

Verify the legitimacy of the device according to the device identification information;

When the first verification digest and the second verification digest are consistent, responding to the service request, including:

When the device is legitimate and the first verification digest and the second verification digest are consistent, the service request is responded to.

A third aspect of the embodiments of the present invention provides a verification device, which is located in a verification plug-in or a client, including:

The generation unit is used to generate the verification code by itself;

A display unit for displaying the verification code;

an obtaining unit, configured to obtain user input formed based on the verification code display;

a verification unit for generating a verification result based on the user input;

A sending unit, configured to send a service request to the service server based on the verification result.

Based on the above solution, the sending unit is further configured to request a verification code from the verification server;

The generating unit is specifically configured to generate the verification code by itself when the verification server returns abnormal information or does not receive the verification code returned by the verification server within a predetermined time.

Based on the above solution, the device further includes:

a signature unit, configured to perform signature processing on the verification result, and generate verification signature information;

The sending unit is specifically configured to send a service request including the verification signature information to the service server; wherein the verification signature information is used to trigger the service server to respond to the service request when a first preset condition is satisfied .

Based on the above solution, the signature unit is specifically configured to perform signature processing on the verification result to obtain the verification signature information when the verification result indicates that the verification is passed.

Based on the above solution, the signature unit is specifically configured to obtain the first time information of the current time; perform signature processing on the verification result and the first time information to obtain the verification signature information; wherein, the first The time information is used by the service server to determine whether to respond to the service request based on the first time information.

Based on the above solution, the signature unit is specifically configured to obtain the first application signature information of the application that generates the service request; perform signature processing on the verification result and the application signature information to obtain the verification signature information; The application signature information is used by the service server to prevent illegal applications from calling the application.

Based on the above solution, the signature unit is further configured to acquire device identification information; perform signature processing on the verification result and the device identification information to obtain the verification signature information; wherein the device identification information is used for the Whether the current service request of the business server comes from a legitimate device.

A fourth aspect of the embodiments of the present invention provides a verification device, including:

a receiving unit, configured to receive a service request including verification signature information; wherein, the verification signature information is generated based on a verification result verified by a verification code generated by itself;

A response unit, configured to respond to the service request when the service request satisfies a second preset condition.

Based on the above solution, the receiving unit is specifically configured to receive a service request including verification signature information; wherein, the verification signature information is generated based on a verification result verified by a verification code generated by itself;

The device also includes:

a first obtaining unit, configured to process the verification signature information by using the verification public key to obtain a first verification digest;

a second obtaining unit, configured to process the verification signature information by using the verification private key to obtain original information for generating the verification signature information; wherein the original information at least includes the verification result;

a third obtaining unit, configured to perform signature processing on the original information to obtain a second verification digest;

a comparison unit for comparing the first verification digest and the second verification digest;

The response unit is configured to respond to the service request when the first verification digest and the second verification digest are consistent.

Based on the above solution, the verification signature information is generated based on the verification result and the first time information of the verification code generated by the self-generated verification code;

the original information includes the first time information;

The comparison unit is also used to obtain the second time information of the current time;

Compare the first time information with the second time information;

The response unit is specifically configured to respond to the service when the time difference corresponding to the first time information and the second time information is within a preset range, and the first verification digest and the second verification digest are consistent ask.

Based on the above solution, the verification signature information is generated based on the verification result of the verification code generated by itself and the first application signature information;

The third obtaining unit is configured to perform signature processing on the verification information in the original information and the second signature information of the legitimate application to obtain a second verification digest.

Based on the above solution, the verification signature information is generated based on the verification result and device identification information of the verification code generated by itself;

The original information also includes device identification information;

The device also includes:

a verification unit, configured to verify the legitimacy of the device according to the device identification information;

The response unit is further configured to respond to the service request when the device is legal and the first verification digest and the second verification digest are consistent.

The verification method and device provided by the embodiments of the present invention can generate verification by themselves to perform verification, and obtain verification results; and send a service request to the server based on the verification results. In this way, even if the verification server is abnormal, verification can be carried out as usual, which can reduce the need for verification. The server cannot return the verification code and other verification information in time, which causes the problem of long verification delay or unverifiable verification, which improves the verification efficiency and reduces the probability of unverifiable verification.

Description of drawings

1 is a schematic flowchart of a first verification method provided by an embodiment of the present invention;

2 is a schematic flowchart of a second verification method provided by an embodiment of the present invention;

3 is a schematic structural diagram of a first verification device provided by an embodiment of the present invention;

4 is a schematic structural diagram of a second verification device provided by an embodiment of the present invention;

5 is a schematic structural diagram of a verification plug-in provided by an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a third verification method provided by an embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be further elaborated below with reference to the accompanying drawings and specific embodiments of the description.

As shown in FIG. 1, this embodiment provides a verification method for verifying a plug-in or a client, including:

Step S110: generate a verification code by itself;

Step S120: display the verification code;

Step S130: obtaining user input formed based on the verification code display;

Step S140: generating a verification result based on the user input;

Step S150: Based on the verification result, send a service request to the service server.

The execution subject of the verification method described in this embodiment may be a verification plug-in running in the client or the operating system of the client itself.

In this embodiment, the verification plug-in or client will generate the verification code by itself, and display the verification code; after the user sees the displayed verification code, the user enters the verification information according to the verification prompt displayed at the same time or different from the verification code to form the above-mentioned verification code. User input. The verification plug-in or client will compare the user input with the verification code to obtain the verification result. If the verification result is true, it means that the user input is consistent with the generated verification code, and it can be considered that the verification result indicates that the verification is passed, otherwise the verification fails. In step S150, a service request will be sent to the service server based on the verification result. For example, when the verification is passed, the service request is sent to the service server, and when the verification fails, the service request is not sent to the service server. The step S150 may further include carrying the verification result in the service request and sending it to the service server, so that the service server can respond to the service request according to the verification result. The verification result may be carried in the service request in the form of plaintext or in the form of ciphertext and sent to the service server. For example, after the verification result is signed, it is carried in the service request and sent to the service server.

The service request here may include various service requests such as a login request for logging in to a certain application, website or account, a payment request for requesting to perform payment, and a viewing request for granting viewing. After receiving the service request, the service server can determine whether the verification is passed by processing the verification signature information, and if the verification is passed, it will respond to the service request.

In this way, the client does not need to interact with the verification server for verification, and the business server does not need to obtain information on whether the verification is passed or not from the verification server. In this way, there will be no problems such as failure of verification and large verification delay caused by abnormality such as downtime of the verification server itself or overloaded operation, which will further lead to the problem of large response delay of service requests.

In this embodiment, the method further includes:

Request a verification code from the verification server;

The step S110 may include:

When the verification server returns abnormal information or does not receive the verification code returned by the verification server within a predetermined time, the verification code is automatically generated.

In this embodiment, the verification plug-in or client will first send a request to the verification server to request a verification code before performing verification. If the current verification server is abnormal, the abnormal information may be restored to the verification plug-in or client. If the current load of the verification server is heavy, it may not respond to the verification plug-in or client for a long time. At this time, the verification and verification plug-in or client will automatically Generate a verification code instead of waiting for the verification server to return the verification code, so as to improve the verification failure, reduce the verification delay, and ensure the smooth verification.

In some embodiments, the step S150 may include:

Step S151: Perform signature processing on the verification result to generate verification signature information;

Step S152: Send a service request including the verification signature information to the service server; wherein the verification signature information is used to trigger the service server to respond to the service request when a first preset condition is satisfied.

In this embodiment, signature processing is performed on the verification to generate verification signature information. The verification signature information will be sent to the service server along with the service request. In this way, the client does not need to interact with the verification server for verification, and the business server does not need to obtain information on whether the verification is passed or not from the verification server. In this way, there will be no problems such as failure of verification and large verification delay caused by abnormal downtime of the verification server itself or overloaded operation, which further leads to the problem of large response delay of service requests.

In some embodiments,

The step S151 may include:

When the verification result indicates that the verification is passed, signature processing is performed on the verification result to obtain the verification signature information.

The verification result indicates that the verification is passed, that is, the verification result is true, and if the verification result is false, the verification result obviously fails. In this embodiment, in order to reduce the load of the service server, only when the verification result is true, the verification result is signed and the verification signature information is obtained. When the verification result indicates that the verification fails, that is, the verification result is false, the verification code is generated again by itself for the next verification.

When the verification signature information is generated in step S151, it is not limited to perform signature processing on the verification result, and other information can also be subjected to signature processing together with the verification result. Several optional methods are provided below.

Option 1:

The step S151 may include:

Get the first time information of the current time;

Perform signature processing on the verification result and the first time information to obtain the verification signature information; wherein the first time information is used by the service server to determine whether to respond to the service request based on the first time information.

The first time information may be information representing the current time, such as a timestamp or a time point. In this case, after the service server receives the service request, it can obtain the first time information through information processing; according to the first time information, the service server finds that the verification signature information was formed a long time ago, and may attack If the user obtains the service request sent by the previous verification plug-in or client, it will not respond to the service request, thereby achieving defense against attacks or repeated responses to service requests caused by network confusion.

In a specific implementation, the step S151 may be to obtain the first time information of the current time when the verification result indicates that the verification is passed, so as to avoid an invalid processing operation when the verification fails.

Option 2:

The step S151 may include:

obtaining the first application signature information of the application that generates the service request;

Perform signature processing on the verification result and the application signature information to obtain the verification signature information; the application signature information is used by the business server to prevent illegal applications from calling the verification plug-in or the corresponding function of the client to form illegal services. ask.

In this way, problems caused by some unauthorized applications that use the function of the verification plug-in or client, or some illegal applications maliciously calling the function of the verification plug-in or client are prevented, and the verification security is improved.

Of course, the step S151 may be, when the verification result is true, the first application signature information is acquired, and the verification result and the application signature information are signed at the same time to obtain the verification signature information.

Option three:

The step S151 may include:

When the verification result indicates that the verification is passed, obtain the device identification information;

Perform signature processing on the verification result and the device identification information to obtain the verification signature information; wherein, the device identification information is used for whether the current service request of the service server is from a legal device or the like.

For example, the legal device may include a real device, and sometimes the authentication plug-in may be installed on a virtual machine, or a device authorized to use, for example, when some services are only available to paid users, the Device identification information to identify paying users. The user identification information may be identification information such as an international device identification, so as to prevent some illegal persons from using illegal devices such as virtual machines to steal services.

Of course, the step S151 described in this method may also be the step of obtaining the device identification information when it is determined that the verification result is true.

In a specific application process, the step S151 may include: when the verification result is passed, acquiring the first time information, application signature information and device identification information; performing signature processing on these information to obtain the verification signature information, which is convenient for The service server performs the above processing according to the verification signature information, respectively, to ensure the security and reliability of the verification.

In order to improve the security of the verification, the verification result will also be encrypted. Of course, when one or more of the first time information, the application signature information and the device identification information are signed together with the verification result At the same time, the information can also be encrypted to reduce the probability of the information being stolen during the transmission process and improve the information security.

As shown in Figure 2, this embodiment provides a verification method, including:

Step S210: Receive a service request sent based on the verification plug-in or the client based on the verification result; wherein, the verification result is formed based on the verification code generated by the verification plug-in or the client;

Step S220: When the service request satisfies the second preset condition, respond to the service request.

The verification method described in this embodiment may be a method applied to a service server, and the service server will directly receive a service request including verification signature information from a client or a verification plug-in.

The service request in this embodiment is sent based on the verification result, and the verification result is formed based on the verification code generated by the verification plug-in or the client itself, which has the characteristics of small verification delay and timely response to the service request.

The second preset condition may include responding to the service request when the verification result is true. For example, the verification result may be carried in the service request in plaintext or in plaintext, in this case, the service server can view the verification result and determine whether to respond to the business service according to the verification result.

In some embodiments, the step S210: receiving a service request including verification signature information; wherein, the verification signature information is generated based on a verification result verified by a verification code generated by itself;

The step S220 includes:

Step S221: use the verification public key to process the verification signature information to obtain a first verification digest;

Step S222: Use the verification private key to process the verification signature information to obtain the original information for generating the verification signature information;

Step S223: Perform signature processing on the original information to obtain a second verification digest;

Step S224: Compare the first verification digest with the second verification digest;

Step S225: When the first verification digest is consistent with the second verification digest, respond to the service request.

After receiving the verification signature information, the verification signature information is processed by using the verification public key, thereby obtaining the first verification digest corresponding to the verification result.

At the same time, the service server will also process the verification information by using the verification private key to obtain the original information, where the original information is at least the verification result described by Boakai. The second verification digest is obtained by performing information processing on the original information by using a hash function or the like.

The service server will compare the first verification digest with the second verification digest, and when the two digests are found to be consistent, it can be considered that the verification result has not been tampered with, so the security and reliability are guaranteed. In a specific implementation process, the verification signature information is generated based on a verification result indicating that the verification is passed, or the service server responds to the service request only when the verification result is obtained and the verification result is determined to be true.

In some embodiments, the verification signature information is generated based on the verification result of the verification code generated by itself and the first time information;

the original information includes the first time information;

The method also includes:

Get the second time information of the current time;

Compare the first time information with the second time information;

The step S225 may include:

When the time difference corresponding to the first time information and the second time information is within a preset range, and the first verification digest and the second verification digest are consistent, the service request is responded to.

Usually, once the verification signature information is generated, it will be sent to the business server immediately. After the business server receives the service request, it will obtain time information. The time difference between the two time information should be small. Otherwise, if the currently obtained verification signature information is formed a long time ago, the verification service information is stolen and reused by an illegal person, which may lead to insecurity of the service or duplication of the service. response to the question. Therefore, in this embodiment, both the first time information and the second time information can be timestamps. By comparing the two time differences, it is found that the time points corresponding to the two timestamps are within a preset range. For example, the time difference can be In the time range of 1 minute, 120 seconds, etc., it can be considered that there is no security problem, and it is determined whether to respond to the service request based on whether the two verification digests are consistent.

In some embodiments, the verification signature information is generated based on the verification result of the verification code generated by itself and the first application signature information; the step S225 may include: verifying the verification result and legality in the original information. The second application signature information of the application is subjected to signature processing to obtain the second verification digest. Since the first verification digest is formed based on the first application signature information, and the second verification digest is generated by using the second verification signature information to replace the signature of the first application signature information, if the verification signature information has not been tampered with, illegal processing such as , the signature information of the first application and the signature information of the second application should be the same, so the comparison of the two verification digests will not be affected, so that malicious attacks of illegal applications can be prevented.

In some other embodiments, the verification signature information is generated based on the verification result of the verification code generated by the self-generated verification code and the first application signature information; the original information further includes the first application signature information; the method further includes : comparing the first application signature information with the second signature information of the legal application; the step S225 may include: when the first application signature information and the second application signature information are compared and consistent and the first application signature information is consistent When the verification digest is consistent with the second verification digest, the service request is responded to.

In this embodiment, it is also determined that the first application signature information is provided by a verification plug-in or a client, and the second application signature information is stored in the service server. The service server stores application signature information of legitimate applications that can provide services, and the application signature information is referred to as second application signature information. If the first application signature information can be one of the second application signature information, it is confirmed that the service request is initiated by a legitimate application, thereby improving the security and reliability of verification again.

In some embodiments, the verification signature information is generated based on the verification result and device identification information of the verification code generated by itself; the original information also includes device identification information;

The method also includes:

Verify the legitimacy of the device according to the device identification information;

The step S225 may include:

When the device is legitimate and the first verification digest and the second verification digest are consistent, the service request is responded to.

In this embodiment, through the acquisition of the device identification information, the legitimacy of the device can be known. For example, through the verification of whether the device is legal, it can be determined whether the device or client currently running the verification plug-in is a real device rather than a virtual device. machine, whether it is an authorized device, etc., thus ensuring the security and reliability of the verification again.

As shown in FIG. 3, this embodiment provides a verification device, which is located in a verification plug-in or a client, including:

The generating unit 110 is used to generate the verification code by itself;

a display unit 120 for displaying the verification code;

an obtaining unit 130, configured to obtain a user input formed based on the verification code display;

The sending unit 140 is configured to send a service request to the service server based on the verification result.

The verification device in this embodiment may correspond to the aforementioned verification plug-in, or correspond to the aforementioned client with an offline verification function processing module. The verification plug-in can be installed in various devices, for example, various electronic devices such as mobile phones, tablet computers or notebook computers or wearable devices.

The generating unit 110 will generate the verification code by itself. The verification code here can be a text verification code or an image verification code. At the same time, the generating unit 110 may also generate verification prompt information to prompt the user to perform verification.

The display unit 120 may correspond to various structures capable of controlling the display screen to display. The display screen may include a display structure such as a liquid crystal display screen, an electronic ink display screen, a projection display screen or an organic light-emitting diode OLED, etc., to control the display of the verification code. It is convenient for users to compare and input.

The acquiring unit 130 may correspond to various human-computer interaction interfaces and acquire various user inputs. The human-computer interaction interface may include a keyboard, a touch screen or a voice input interface.

The sending unit 140 corresponds to a communication interface, where the communication interface can be a wireless interface or a wired interface, which can facilitate communication.

In conclusion, this embodiment provides a device that can not perform verification without interacting with the verification server, thereby improving verification efficiency and reducing the phenomenon of delaying the service server's response to the service request.

In some embodiments, the sending unit 140 is further configured to request a verification code from the verification server;

The generating unit 110 is specifically configured to generate a verification code by itself when the verification server returns abnormal information or does not receive the verification code returned by the verification server within a predetermined time.

In the device described in this embodiment, only when it is determined that the verification server cannot provide the verification code in time, the verification code is generated by itself and the verification result is generated by itself.

The device also includes:

a verification unit for generating a verification result based on the user input;

a signature unit, configured to perform signature processing on the verification result, and generate verification signature information;

The sending unit 140 is configured to send a service request including the verification signature information to the service server; wherein the verification signature information is used to trigger the service server to respond to the service request when a first preset condition is satisfied .

The verification unit and the signature unit may correspond to a processor or a processing circuit. The processor may include a central processing unit, a microprocessor, a digital signal processor, a programmable array, or an application processor, among others. The processing circuit may include an application specific integrated circuit or the like. The processor or processing circuit may implement the above operations through the execution of predetermined codes.

In some embodiments, the signature unit is specifically configured to perform signature processing on the verification result to obtain the verification signature information when the verification result indicates that the verification is passed. In this embodiment, in order to reduce the processing load of the service server, the processing of verifying the signature information is performed only when the verification result is true. In some embodiments, the generating unit 110 is configured to generate a verification code by itself again when the verification result is false for the next verification.

In some embodiments, the signature unit is specifically configured to obtain the first time information of the current time; perform signature processing on the verification result and the first time information to obtain the verification signature information; wherein, the The first time information is used for the service server to determine whether to respond to the service request based on the first time information. Through the signature processing of the first time information, in this case, the business server will obtain the first time information, preventing attackers from stealing the data that has been used by the verification plug-in or the client, and making another service request, which improves the security again. , which can also reduce the problem of repeated requests caused by network latency.

In some embodiments, the signature unit is specifically configured to acquire first application signature information of an application that generates the service request; perform signature processing on the verification result and the application signature information to obtain the verification signature information ; The application signature information is used by the service server to prevent illegal applications from calling the application. In this embodiment, the signature unit also generates verification signature information by obtaining the signature information of the first application and combining the signature information of the first application, which can prevent malicious operations of illegal applications and improve security again.

In some embodiments, the signature unit is further configured to acquire device identification information; perform signature processing on the verification result and the device identification information to obtain the verification signature information; wherein the device identification information is used for Whether the current service request of the service server comes from a legal device or not. In this embodiment, the verification signature information is obtained based on at least the verification result and the device identification information, which facilitates the service server to determine whether the service request is sent by a legitimate device, so as to improve the security again.

As shown in FIG. 4 , this embodiment also provides another verification device, including:

a receiving unit 210, configured to receive a service request including verification signature information; wherein, the verification signature information is generated based on a verification result of verification by a verification code generated by itself;

The responding unit 220 is configured to respond to the service request when the service request satisfies the second preset condition.

The verification device described in this embodiment may be a device applied to a service server. The receiving unit 210 may include a receiving interface capable of receiving the service request, where the service request carries verification signature information.

The response unit 220 may correspond to a processor or a processing circuit. For the structures of the processor and the processing circuit, reference may be made to the corresponding parts of the foregoing embodiments, which will not be repeated here.

In some embodiments, the receiving unit is specifically configured to receive a service request including verification signature information; wherein the verification signature information is generated based on a verification result verified by a verification code generated by itself; the apparatus further includes : a first obtaining unit, used to process the verification signature information by using the verification public key to obtain a first verification digest; a second obtaining unit, used to process the verification signature information by using the verification private key, and obtain the generated data. The original information of the verification signature information; wherein, the original information includes at least the verification result; a third obtaining unit is used to perform signature processing on the original information to obtain a second verification digest; a comparison unit is used to compare For the first verification digest and the second verification digest; the response unit 220 is configured to respond to the service request when the first verification digest and the second verification digest are consistent.

The first obtaining unit, the second obtaining unit, the third obtaining unit, the comparing unit, and the responding unit 220 may correspond to a processor or a processing circuit. For the structures of the processor and the processing circuit, reference may be made to the corresponding parts of the foregoing embodiments, which will not be repeated here.

In some embodiments, the verification signature information is generated based on a verification result of verification code generated by itself and first time information; the original information includes the first time information; the comparison unit further Used to obtain the second time information of the current time; compare the first time information and the second time information; the response unit 220 is specifically used for when the time difference corresponding to the first time information and the second time information is preset When the first verification digest is consistent with the second verification digest, the service request is responded to.

In some embodiments, the verification signature information is generated based on the verification result of the verification code generated by itself and the first application signature information; the third obtaining unit is configured to verify the verification information in the original information and the second signature information of the legitimate application to perform signature processing to obtain a second verification digest. The second verification digest generated in this way can verify whether the service request is sent by a legitimate application.

In some embodiments, the verification signature information is generated based on the verification result of the verification code generated by itself and the first application signature information; the original information further includes the first application signature information; the comparison unit, It is also used to compare the first application signature information with the second signature information of the legal application; the response unit 220 is specifically configured to compare the first application signature information and the second application signature information when the pair of the first application signature information and the second application signature information are consistent and all When the first verification digest and the second verification digest are consistent, the service request is responded to.

In some embodiments, the verification signature information is generated based on the verification result and device identification information of the verification code generated by itself; the original information further includes device identification information; the apparatus further includes: a verification unit, which uses The response unit 220 is further configured to respond to the service request when the device is legal and the first verification digest and the second verification digest are consistent. The verification unit here can also correspond to the aforementioned processor or processing circuit.

Several specific examples are provided below in conjunction with any of the above-mentioned embodiments:

Example one:

This example provides an authentication plugin. The authentication plug-in can be used in the installation client. The verification plug-in generates the verification code locally, provides the display of the verification code, collects user input, and verifies the user input. If the verification is passed, the verification result will be digitally signed, and then a login request will be sent to the business server; The signature is verified to confirm that the verification result has not been tampered with and that the verification result comes from a reliable client request. Through the above solution, the local generation and verification of the verification code is realized, and the situation in the prior art that the verification server cannot run normally when the verification server is down due to a hacker attack or a machine failure is solved. The data includes verification results, timestamps, device information, and digital signatures of application signature information for verification, which ensures the reliability and integrity of the data transmitted by the client and prevents the possibility of external tampering.

The authentication plug-in on the client side is embedded in the application in the form of a software development kit (Software Development Kit, SDK). The client provided in this embodiment may be a mobile client or a fixed client.

As shown in Figure 5, the verification plug-in includes:

The verification server abnormal identification module is used for verification abnormal identification of the verification server. Specifically, it can be used to request the verification code from the verification server, and detect the return information of the verification server. If the abnormal information is returned or the verification code is not obtained within a predetermined time, it is considered that A validation exception occurred;

a verification code generation module, used to generate a verification code locally; the verification generation module is equivalent to the generation unit 110 in the foregoing embodiment;

The verification code display module is used to control the display of the verification code generated locally; the verification code display module is equivalent to the aforementioned display unit 120;

The user input answer collection module is used to collect the user input based on the display of the verification code; the user input answer collection module is equivalent to the composition structure of the aforementioned obtaining unit 120;

The user input answer verification module is used to verify the user input to form a verification result; the user input answer verification module is equivalent to the aforementioned verification unit;

The verification result digital signature module is used to perform signature processing on the verification result indicating that the verification is passed to form verification signature information; the verification result digital signature module is equivalent to the aforementioned signature unit;

The verification result encryption module is used to encrypt the verification result.

The above modules are all implemented in the code provided by the predetermined file, for example, can be implemented by the so file, which has been obfuscated to prevent malicious cracking.

Example two:

As shown in Figure 6, this example provides a verification method including:

Step 1: The client or the verification plug-in requests the verification code from the verification code service.

Step 2: Verify that the server fails to respond in time due to hacker attacks, machine failures, etc., due to downtime or too many requests.

Step 3: The verification server returns abnormal information, and the abnormal information may include a network connection error code, such as connection timeout, network request unreachable, and the like. The exception code may include 404 and the like.

Step 4: The verification plug-in generates the verification code locally and displays the verification code on the client side.

Step 5: Get the verification answer entered by the user.

Step 6: The verification plug-in verifies the verification answer input by the user to obtain the verification result.

Step 7: If the verification result is true, the verification is passed, and the verification plug-in digitally signs the verification result, timestamp, device fingerprint information and application signature information, and sends a verification request to the service server. The device fingerprint information here is one of the aforementioned device identification information. This step may specifically include: the verification result digital signature module first obtains the current timestamp, device fingerprint information, and application signature information. The verification result digital signature module uses a hash function to generate a digest of the verification result, timestamp, device fingerprint information, and application signature information, and then encrypts the digest with the secure private key stored in the SDK to generate a digital signature containing the verification result. If the verification result is false, it means that the verification fails, and the verification plug-in continues to generate a new verification code.

Step 8: The service server verifies the requested data to confirm the reliability and integrity of the requested data.

Step 9: The business server returns the final verification result.

When the verification result is true, the verification plug-in sends a login request to the business server. The specific process is as follows: The device fingerprint information, etc. are sent to the service server. The business server processes the data requested by the client, wherein the business server has securely stored the public key for digital signature verification, the private key for decrypting the verification result, and the application signature information. The specific steps are as follows:

The service server parses the data requested by the client, and obtains the digital signature, time stamp, device fingerprint information and encrypted verification result containing the verification result.

The service server decrypts the requested digital signature containing the verification result through the locally stored public key, and obtains a digest containing the verification result.

The business server decrypts the encrypted verification result through the locally stored private key, and then generates a summary of the verification result, timestamp, device fingerprint information, and locally stored application signature information through a hash function.

Compare the above steps to obtain whether the two digests are consistent. If they are consistent, it means that the data requested by the client has not been tampered with, and the user's verification code input answer is correct. If the comparison is consistent, check whether the difference between the time stamp and the local time stamp obtained by the business server exceeds 120 seconds. If it times out, the verification fails. By comparing the timestamps, the attacker can effectively prevent the attacker from forging the client's data to repeatedly send the login request. On the other hand, the comparison is consistent, indicating that the signature information of the client sending the login request is consistent with the local application signature information of the business server, which effectively prevents the verification plug-in from being called by malicious applications.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms. of.

The unit described above as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may all be integrated into one processing module, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integration The unit can be implemented either in the form of hardware or in the form of hardware plus software functional units.

Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by program instructions related to hardware, the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, execute Including the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: a mobile storage device, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk and other various A medium on which program code can be stored.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention. should be included within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (22)

1. An authentication method for authenticating a plug-in or a client, comprising:

requesting a verification code from a verification server;

generating a verification code by self; wherein the self-generated verification code comprises: when the verification server returns abnormal information or does not receive the verification code returned by the verification server within preset time, the verification server generates the verification code by itself;

displaying the verification code;

acquiring user input formed based on the verification code display; wherein the user input formed based on the verification code display comprises: inputting verification information based on a verification prompt displayed by the verification code; forming the user input based on the verification information;

generating a verification result based on the user input;

based on the verification result, sending a service request to a service server; wherein the sending a service request to a service server based on the verification result comprises: carrying out signature processing on the verification result to generate verification signature information; and sending a service request comprising the verification signature information to a business server.

2. The method of claim 1,

and the verification signature information is used for triggering the service server to respond to the service request when a first preset condition is met.

3. The method of claim 2,

the signing the verification result to generate verification signature information includes:

and when the verification result shows that the verification passes, performing signature processing on the verification result to obtain verification signature information.

4. The method of claim 2,

the signing the verification result to generate verification signature information includes:

acquiring first time information of current time;

performing signature processing on the verification result and the first time information to obtain verification signature information; wherein the first time information is used for the traffic server to determine whether to respond to the service request based on the first time information.

5. The method of claim 2,

the signing the verification result to generate verification signature information includes:

acquiring first application signature information of an application generating the service request;

performing signature processing on the verification result and the first application signature information to obtain the verification signature information; the first application signature information is used for preventing illegal application from calling illegal service requests formed by corresponding functions of the verification plug-in or the client side by the service server.

6. The method of claim 2,

the signing the verification result to generate verification signature information includes:

acquiring equipment identification information;

performing signature processing on the verification result and the equipment identification information to obtain verification signature information; wherein the device identification information is used for the service server to determine whether the current service request is from a legal device.

7. A method of authentication, comprising:

receiving a service request sent by an authentication plug-in or a client based on an authentication result;

the verification result is formed by user input formed by verification code display generated by the verification plug-in or the client; wherein, the user input formed based on the verification code display generated by the verification plug-in or the client comprises: inputting verification information based on a verification prompt displayed by the verification code; forming the user input based on the verification information; wherein, the verification plug-in or the client generates the verification code by itself, including: when the verification server returns abnormal information or does not receive the verification code returned by the verification server within preset time, the verification plug-in or the client generates the verification code by self;

when the service request meets a second preset condition, responding to the service request;

wherein, the receiving of the service request sent by the verification plug-in or the client based on the verification result includes: receiving a service request including verification signature information; the verification signature information is generated based on a verification result of verification performed by a self-generated verification code.

8. The method of claim 7,

the method further comprises the following steps:

processing the verification signature information by using a verification public key to obtain a first verification abstract;

processing the verification signature information by using a verification private key to obtain original information for generating the verification signature information; wherein the original information comprises at least the verification result;

carrying out signature processing on the original information to obtain a second verification abstract;

comparing the first verification digest with the second verification digest;

when the service request meets a second preset condition, responding to the service request comprises:

responding to the service request when the first verification digest and the second verification digest are consistent.

9. The method of claim 8,

the verification signature information is generated based on a verification result of verification performed by a self-generated verification code and first time information;

the original information comprises the first time information;

the method further comprises the following steps:

acquiring second time information of the current time;

comparing the first time information with the second time information;

the responding to the service request when the first verification digest and the second verification digest are consistent includes:

and responding the service request when the time difference corresponding to the first time information and the second time information is within a preset range and the first verification abstract is consistent with the second verification abstract.

10. The method of claim 8,

the verification signature information is generated based on a verification result of verification performed by a self-generated verification code and the first application signature information;

the signing the original information to obtain a second verification digest includes:

and performing signature processing on the verification result in the original information and the second application signature information of the legal application to obtain the second verification abstract.

11. The method of claim 8,

the verification signature information is generated based on a verification result of verification performed by a self-generated verification code and equipment identification information;

the original information further comprises equipment identification information;

the method further comprises the following steps:

verifying the equipment validity according to the equipment identification information;

the responding to the service request when the first verification digest and the second verification digest are consistent includes:

and responding to the service request when the equipment is legal and the first verification abstract is consistent with the second verification abstract.

12. An authentication apparatus, located in an authentication plug-in or a client, comprising:

the generating unit is used for generating the verification code by self; the generation unit is specifically used for generating a verification code by itself when the verification server returns abnormal information or the verification code returned by the verification server is not received within a preset time; the display unit is used for displaying the verification code;

an acquisition unit configured to acquire a user input formed based on the verification code display; wherein the user input formed based on the verification code display comprises: inputting verification information based on a verification prompt displayed by the verification code; forming the user input based on the verification information;

an authentication unit for generating an authentication result based on the user input;

the signature unit is used for carrying out signature processing on the verification result to generate verification signature information;

a sending unit, configured to send a service request to a service server based on the verification result; wherein the sending the service request to the service server includes: sending a service request including the verification signature information to a service server;

the sending unit is further configured to request the verification code from the verification server.

13. The apparatus of claim 12,

and the verification signature information is used for triggering the service server to respond to the service request when a first preset condition is met.

14. The apparatus of claim 13,

the signature unit is specifically configured to, when the verification result indicates that verification passes, perform signature processing on the verification result to obtain the verification signature information.

15. The apparatus of claim 13,

the signature unit is specifically used for acquiring first time information of the current time; performing signature processing on the verification result and the first time information to obtain verification signature information; wherein the first time information is used for the traffic server to determine whether to respond to the service request based on the first time information.

16. The apparatus of claim 13,

the signature unit is specifically configured to acquire first application signature information of an application that generates the service request; performing signature processing on the verification result and the first application signature information to obtain the verification signature information; the first application signature information is used for preventing illegal application from calling illegal service requests formed by corresponding functions of the verification plug-in or the client side by the service server.

17. The apparatus of claim 13,

the signature unit is further used for acquiring equipment identification information; performing signature processing on the verification result and the equipment identification information to obtain verification signature information; wherein the device identification information is used for the service server to determine whether the current service request is from a legal device.

18. An authentication apparatus, comprising:

a receiving unit configured to receive a service request including verification signature information; wherein the verification signature information is formed based on a user input formed from a self-generated verification code display; wherein the displaying of the formed user input based on the self-generated passcode comprises: inputting verification information based on a verification prompt displayed by the verification code; forming the user input based on the verification information; wherein the self-generated verification code comprises: when the verification server returns abnormal information or does not receive the verification code returned by the verification server within preset time, the verification plug-in or the client generates the verification code by self;

the response unit is used for responding to the service request when the service request meets a second preset condition;

the receiving unit is specifically configured to receive a service request including verification signature information; and the verification signature information is generated based on a verification result of verification performed by the self-generated verification code.

19. The apparatus of claim 18, further comprising:

the first obtaining unit is used for processing the verification signature information by using a verification public key to obtain a first verification abstract;

the second obtaining unit is used for processing the verification signature information by using a verification private key to obtain original information for generating the verification signature information; wherein the original information comprises at least the verification result;

a third obtaining unit, configured to perform signature processing on the original information to obtain a second verification digest;

a comparison unit, configured to compare the first verification digest with the second verification digest;

the response unit is used for responding to the service request when the first verification abstract is consistent with the second verification abstract.

20. The apparatus of claim 19,

the verification signature information is generated based on a verification result of verification performed by a self-generated verification code and first time information;

the original information comprises the first time information;

the comparison unit is further used for acquiring second time information of the current time;

comparing the first time information with the second time information;

the response unit is specifically configured to respond to the service request when a time difference between the first time information and the second time information is within a preset range and the first verification digest and the second verification digest are consistent.

21. The apparatus of claim 19,

the verification signature information is generated based on a verification result of verification performed by a self-generated verification code and the first application signature information;

and the third obtaining unit is used for performing signature processing on the verification result in the original information and the second application signature information of the legal application to obtain a second verification abstract.

22. The apparatus of claim 19,

the verification signature information is generated based on a verification result of verification performed by a self-generated verification code and equipment identification information;

the original information further comprises equipment identification information;

the device further comprises:

the verification unit is used for verifying the equipment validity according to the equipment identification information;

the response unit is further configured to respond to the service request when the device is legal and the first verification digest and the second verification digest are consistent.

Images