CN100583762C - Online authentication method and system - Google Patents

Abstract

An online authentication method and system, the method includes: a user connecting to a telecommunication operator database by using a mobile phone; the telecommunication operator database transmits a user identification code of the mobile phone to an authentication database, and the authentication database records the user identification code and an account number which is owned by a user and corresponds to the user identification code in advance, and the account number enables the user to have the authority of using the service provided by a service provider database; and the authentication database transmits the account number corresponding to the user identification code of the mobile phone to the service provider database to start the account number, so that the user can log in the service provider database by using the account number and the corresponding password to obtain the service provided by the service provider database.

Description

Method and system for online authentication

technical field

The invention relates to an authentication method and system, in particular to an online authentication method and system utilizing a mobile phone.

Background technique

With the development of Internet-related technologies, people can use Internet devices (such as personal computers) to connect to service servers set up by remote service providers to obtain required services. Among these services, some users can freely access them once they are connected to the Internet, such as the information browsing services provided by general websites, while others require users to enter their account numbers and corresponding passwords before they can be obtained. The authority of services, such as game services provided by online game operators or cash flow services provided by financial operators, etc. However, even if the service server has used some authentication mechanism to ensure the security of network access after the user enters the account and password, hackers may still steal the user's account and password to log in to the service server. devices for unlawful gain.

Contents of the invention

The main purpose of the present invention is to provide an online authentication method, which can be used to improve the security of the user accessing the service provided by the service provider through the Internet.

An online authentication method of the present invention includes the following steps. A user connects to a carrier database of a particular carrier using a mobile phone. Then, the carrier database transmits a user ID of the mobile phone to an authentication database, wherein the authentication database has pre-recorded the user ID and a The account corresponding to the user identification code, the account enables the user to use the service provided by a service provider database. Then, the authentication database transmits the account number corresponding to the user identification code of the mobile phone to the service provider database, so as to activate the account number, so that the user can use the account number and the corresponding password to log in to the service provider provider database to obtain the services provided by the service provider database.

Another object of the present invention is to provide an online authentication system, which can be used to improve the security of users accessing services provided by service providers through the Internet.

An online authentication system of the present invention is suitable for a user to set an account into a locked state and release the locked state through a mobile phone, so that the user can use an Internet access device to obtain A service, wherein the account number enables the user to have the authority to use the service, and the online authentication system includes a telecom operator database, an authentication database and a service provider database. The telecom operator database is used for accepting the connection of the mobile phone and sending out a user identification code of the mobile phone. The authentication database can be used to store the account number and the corresponding user identification code after a pre-executed application registration process of the account anti-theft service is completed, and can be used to receive the telecommunication operator during the unlocking process of the locked state. The user identification code transmitted from the database, and the account corresponding to the user identification code is sent out, wherein the account enters the locked state through the application registration process. The service provider database is used to receive the account number sent by the authentication database, so as to unlock the account number, and then provide the service that the user can obtain by using the Internet access device.

Description of drawings

Below in conjunction with accompanying drawing and embodiment the present invention is described in detail:

Fig. 1 is a block diagram illustrating the system architecture of a preferred embodiment of the online authentication system of the present invention;

Fig. 2 is a flowchart illustrating the application registration process of the account anti-theft service in the first preferred embodiment of the online authentication method of the present invention;

FIG. 3 is a flow chart illustrating the process of using a mobile phone to send a short message to unlock an account in the first preferred embodiment;

Fig. 4 is a flowchart illustrating the process of using the mobile phone to dial a specific phone number to select the unlocking option of the IVR and unlock the account in the first preferred embodiment;

FIG. 5 is a flow chart illustrating the application and registration process of the account anti-theft service in the second preferred embodiment of the online authentication method of the present invention;

Fig. 6 is a flow chart, illustrates the process that utilizes WAP to get online in the second preferred embodiment to unlock the account;

Fig. 7 is a flowchart illustrating the process of suspending the account anti-theft service in the second preferred embodiment by means of WAP accessing the Internet;

Fig. 8 is a flow chart, illustrates the process of canceling the account anti-theft service by utilizing the WAP online mode in the second preferred embodiment;

Fig. 9 is a flowchart illustrating the process of using the WAP Internet access method to forcibly log out the account in the second preferred embodiment; and

FIG. 10 is a flow chart illustrating the process of canceling the account anti-theft service when the mobile phone is lost in the second preferred embodiment.

Detailed ways

Referring to Fig. 1, a preferred embodiment of the online authentication system of the present invention is applicable to a user 1 who can set an account to a locked state, and through a mobile phone 12 that can be connected to the telecommunications network To release the locked state, thereby enabling the user to obtain a service using an Internet access device 11 (such as a personal computer) that can be connected to the Internet, wherein the account enables the user 1 to have the authority to use the service, And the service can be, for example, an online game service provided by an online game company or a cash flow service provided by a financial company.

The online authentication system includes a telecom operator database 23, an authentication database 22 and a service provider database 21, wherein the telecom operator database 23, the authentication database 22, and the service provider database 21 are established through Virtual private network (Virtual Private Network, VPN) to connect. The virtual private line network is similar to a local area network, and is not connected to the Internet, which can prevent hackers from stealing user 1's account number and password and other related information.

The carrier database 23 is used for accepting the connection of the mobile phone 12, and sending a user identification code (User ID, UID) of the mobile phone 12 to the authentication database 22. After a pre-executed application registration process (refer to FIG. 2 and FIG. 5) of the account anti-theft service is completed, the authentication database 22 can be used to store the account number and the corresponding user identification code, wherein the account number is registered through the application process to enter the locked state. As for, during the unlocking process of the locked state, the authentication database 22 can be used to receive the user identification code transmitted from the carrier database 23, and transmit the account number corresponding to the user identification code to the service provider information Library 21. The service provider database 21 is used to receive the account number sent by the authentication database 21, so as to unlock the account number, and then provide the service that the user 1 can obtain by using the Internet access device 11, wherein the service provides The operator database 21 can be, for example, a game database of an online game operator or a cash flow database of a financial operator.

With reference to Fig. 2, the first preferred embodiment of the online authentication method of the present invention needs to go through the registration application process as shown in Fig. 2, including the following steps. As shown in step 31, through the Internet, the user 1 uses the Internet access device 11, account number and corresponding password to log in to the service provider database 21, and selects SMS (ShortMessage Service, SMS) or interactive voice guidance (Interactive Voice Response, IVR) account anti-theft option.

Next, as shown in step 32 , the service provider database 21 transmits the account number to the authentication database 22 . Next, as shown in step 33 , the user 1 selects a telecom operator on the application service web page of the authentication database 22 . Next, as shown in step 34, the user 1 enters the phone number of the mobile phone 12 and the password of the subscriber identity module (Subscriber Identity Module, SIM) card on the service application webpage of the telecommunications company. Next, as shown in step 35 , the carrier database 23 sends the user ID of the mobile phone 12 to the authentication database 22 . Then, as shown in step 36 , the account number and user identification code are correspondingly stored in the authentication database 22 . Then, the authentication database 22 sends the corresponding account number and user identification code to the service provider database 21 to complete the entire application process, and the account enters a locked state.

Referring to FIGS. 1 and 3, if the user selects a text message in step 31 of FIG. 2, then the process shown in FIG. 3 needs to be performed to unlock the account. As shown in step 371, the user 1 uses the mobile phone 12 to directly dial the phone number designated by the carrier to send a short message to the carrier's database.

Next, as shown in step 372 , the carrier database 23 transmits the corresponding user identification code of the mobile phone 12 to the authentication database 22 according to the received SMS. Next, as shown in step 373 , the authentication database 22 sends the account corresponding to the user ID to the service provider database 21 . Next, as shown in step 374 , the service provider database 21 unlocks the account to activate the account, and sends a text message to inform the user 1 that the account has been successfully unlocked. In addition, after the account has been successfully unlocked, if the user 1 does not log in to the service within a preset time (such as 5 minutes), the system of the present invention can automatically close the account again, so as to prevent the account from being opened for too long. After a long time, hackers were able to take the opportunity to log in.

Then, as shown in step 375 , the user 1 can use the Internet access device 11 to log in the service provider database 21 with the account number and the corresponding password. Then, as shown in step 376, the service provider database 21 checks whether the account is locked? If the checking result is yes, the user 1 cannot obtain the service provided by the service provider database 21 . On the contrary, if the checking result is negative, as shown in step 377 , the user 1 can obtain the service provided by the service provider database 21 online. However, as soon as the user 1 enters the state where the service can be obtained, as shown in step 378, the service provider database 21 restores the locked state of the account immediately, and informs the authentication database 22 that the account has been locked again. The mechanism of recovering the lock can prevent hackers and the user 1 from robbing the service account.

Referring to Figures 1 and 4, if the user selects IVR in step 31 of Figure 2, then the process shown in Figure 4 needs to be carried out to remove the locked state of the account. As shown in step 381, the user 1 utilizes the mobile phone 12 to directly dial a specific phone number to enter the IVR system of the telecommunication provider, and the method specified by the IVR system (such as pressing the number key "1" of the mobile phone) Select the unlock option.

Next, as shown in step 382 , the carrier database 23 transmits the user ID of the mobile phone 12 to the authentication database 22 . Next, as shown in step 383 , the authentication database 22 sends the account corresponding to the user ID to the service provider database 21 . Next, as shown in step 384, the service provider database 21 unlocks the account to activate the account.

Then, as shown in step 385 , the user 1 can use the Internet access device 11 to log in the service provider database 21 with the account number and the corresponding password. Next, as shown in step 386, the service provider database 21 checks whether the account is locked? If the checking result is yes, the user 1 cannot obtain the service provided by the service provider database 21 . On the contrary, if the checking result is negative, as shown in step 387 , the user 1 can obtain the service provided by the service provider database 21 online. However, as soon as the user 1 enters the state where the service can be obtained, as shown in step 388, the service provider database 21 immediately recovers the locked state of the account, and informs the authentication database 22 that the account has been locked again. . The mechanism of recovering the lock can prevent hackers and the user 1 from robbing the service account.

Referring to Figures 1 and 5, the second preferred embodiment of the online authentication method of the present invention needs to go through the registration application process as shown in Figure 5, including the following steps. As shown in step 411, the user 1 logs in the Wireless Application Protocol (WAP) network with the mobile phone 12 . Then, the webpage browsed by the user 1 with the mobile phone 12 is immediately switched to the value-added service webpage of the authentication database 22, for the user 1 to apply for opening the anti-theft service, and to make the authentication database 22 notify the telecom operator database to activate the service .

Next, as shown in step 412 , the user 1 enters the account number and the corresponding password on the web page of the authentication database 22 , and the authentication database 22 then obtains the user identification code of the mobile phone 12 . Next, as shown in step 413 , the authentication database 22 transmits the account number and the corresponding password to the service provider database 21 .

Then, as shown in step 414, the service provider database 21 judges whether the account number and the corresponding password are correct? If the judgment result is correct, then as shown in step 415, the service provider database 21 opens the anti-theft service of the account; then as shown in step 416, the service provider database 21 notifies the authentication database 22 to store the account, The corresponding password and the user identification code of the mobile phone 12; then as shown in step 417, the webpage of the authentication database 22 informs the user 1 that the anti-theft service application has been completed.

On the contrary, if the judgment result in step 414 is no, then as shown in step 418, the webpage of the authentication database 418 informs that the input account number/password is wrong, and asks user 1 to re-enter; step.

Referring to Fig. 1, 6, when the second preferred implementation of the online authentication method of the present invention has completed the application registration process as shown in Fig. 5, then as shown in Fig. 6, the mode of accessing the Internet with WAP is released The lockout status of the account. As shown in step 420 , the user 1 logs into the WAP with the mobile phone 12 . Then, the webpage browsed by the user 1 is switched to the value-added service webpage of the authentication database 22 for the user to select the anti-theft service.

Next, as shown in step 421, the authentication database 22 checks whether the user identification code of the mobile phone 12 has applied for the anti-theft service? If the checking result is negative, as shown in step 422 , the webpage of the authentication database 22 informs the user 1 that he has not applied for the anti-theft service.

If the checking result is yes, several anti-theft service options then appear on the WAP web page of the mobile phone 12 . Then, as shown in step 423, the user 1 can select the anti-theft service option of "unlock". Next, as shown in step 424 , the authentication database 22 sends the account number corresponding to the user identification code to the service provider database 21 . Then, as shown in step 425 , the service provider database 21 unlocks the account to activate the account, and informs the user 1 that the account has been successfully unlocked through the webpage of the authentication database 22 .

Then, as shown in step 426 , the user 1 can use the Internet access device 11 to log in the service provider database 21 with the account number and the corresponding password. Next, as shown in step 427, the service provider database 21 checks whether the account is locked? If the checking result is yes, the user 1 cannot obtain the service provided by the service provider database 21 . On the contrary, if the checking result is negative, as shown in step 428 , the user 1 can obtain the service provided by the service provider database 21 online. However, as soon as the user 1 enters the state where the service can be obtained, as shown in step 429, the service provider database 21 restores the locked state of the account immediately, and informs the authentication database 22 of the account has been locked again, And the authentication database 22 notifies the user 1 that the account has been locked again through the WAP web page. The mechanism of recovering the lock can prevent hackers and the user 1 from robbing the service account.

As shown in Figures 1, 3, 4 and 6-9, in addition to releasing the locked state of the account through SMS, IVR and WAP, the present invention can also suspend the anti-theft service, Cancel the anti-theft service or force logout. Next, this manual only uses Figures 7, 8, and 9 to explain how to use WAP to suspend service, cancel service and force logout respectively. As for how to use SMS or IVR to suspend service, cancel service and For the details of mandatory logout, those familiar with the art can refer to the WAP operation modes of FIGS.

Referring to FIG. 7 , the flow of suspending the account anti-theft service through WAP access includes the following steps. As shown in step 441 , the user 1 logs into the WAP with the mobile phone 12 . Then, the webpage browsed by the user 1 is switched to the value-added service webpage of the authentication database 22 for the user to select the anti-theft service. Next, as shown in step 442, the authentication database 22 checks whether the user ID of the mobile phone 12 has applied for the anti-theft service? If the checking result is negative, as shown in step 443 , the webpage of the authentication database 22 informs the user 1 that he has not applied for the anti-theft service.

If the check result is yes, then as shown in step 444, the user 1 then selects the anti-theft service option of "suspend service" on the WAP web page. The option of "suspending service" is to temporarily close the anti-theft service, rather than cancel the anti-theft service, so that it can be used when the user 1 needs to log out and log in frequently. When the anti-theft service is suspended, the user 1 does not need to use the mobile phone 12 to unlock the account, but can directly log in to the service provider database 21 to obtain the required service.

Next, as shown in step 445 , the authentication database 22 sends the user identification code of the mobile phone 12 of the user 1 and the corresponding account number to the service provider database 21 . Then, as shown in step 446, the service provider database 21 checks whether the user identification code and the account number correspond correctly? If the check result is yes, then as shown in step 447, the service provider database 21 suspends providing the anti-theft service, and displays "service suspension" on the WAP web page of the authentication database 22 to inform the user 1. Therefore, the user 1 can directly log in the service provider database 21 with the Internet device 11 to obtain the required service without first unlocking the account with the mobile phone 12 . On the contrary, if the checking result of step 446 is negative, then as shown in step 448, the execution of the function of "suspend service" fails, and an error message is displayed on the WAP web page of the authentication database 22 .

Referring to FIG. 8 , the process of canceling the account anti-theft service through WAP access includes the following steps. As shown in step 451 , the user 1 logs into the WAP with the mobile phone 12 . Then, the webpage browsed by the user 1 is switched to the value-added service webpage of the authentication database 22 for the user to select the anti-theft service. Next, as shown in step 452, the authentication database 22 checks whether the user ID of the mobile phone 12 has applied for the anti-theft service? If the checking result is negative, then as shown in step 457, the web page of the authentication database 22 informs the user 1 that he has not applied for the anti-theft service.

If the check result is yes, then as shown in step 453, the user 1 then selects the anti-theft service option of "cancel service" on the WAP web page. The option of "cancel service" is to permanently cancel the anti-theft service. After the anti-theft service is cancelled, the user identification code has no corresponding relationship with the account number. Therefore, if the account anti-theft function is to be restored, the account anti-theft value-added service must be re-applied (that is, the process in FIG. 5 needs to be performed again).

Next, as shown in step 454, the authentication database 22 notifies the carrier database 23 that the user identification code of the mobile phone 12 has canceled the anti-theft service. Then, as shown in step 455 , the WAP webpage of the authentication database 22 displays a message of “service is closed” to notify the user 1 and notify the service provider database 21 . Then, as shown in step 456, the service provider database 21 cancels the anti-theft service of the account by releasing the locked state of the account and clearing the user identification code corresponding to the account, so that the user 1 does not need to first Perform the action of unlocking the account with the mobile phone 12, and then directly log in the service provider database 21 with the Internet device 11 to obtain the required services.

Referring to FIG. 9 , the process of forced logout by means of WAP includes the following steps. As shown in step 460 , the user 1 logs into the WAP with the mobile phone 12 . Then, the webpage browsed by the user 1 is switched to the value-added service webpage of the authentication database 22 for the user to select the anti-theft service. Next, as shown in step 461, the authentication database 22 checks whether the user identification code of the mobile phone 12 has applied for the anti-theft service? If the checking result is negative, as shown in step 462, the web page of the authentication database 22 informs the user 1 that he has not applied for the anti-theft service.

If the check result is yes, then as shown in step 463, the user 1 then selects the anti-theft service option of "forced logout" on the WAP web page. When the user 1 finds that he cannot log into the service provider database 21 and is not due to hardware factors such as server or personal computer network, it may be that the account number anti-theft mechanism of the hacker invaded the mobile phone 12. At this time, the user 1 can select this " forced to log out " option, with personal account number is forced to log out and temporarily freeze this account number, in order to prevent hacker from stealing the service that service provider database 21 provides to this account number (as in online game treasures).

Then, as shown in step 464, the WAP web page of the authentication database 22 asks the user 1 to confirm again whether to force logout? If not, the account is not forcibly logged out, and the process in FIG. 9 ends. If yes, then as shown in step 465 , the authentication database 22 searches out the account to be forced to log out according to the user identification code of the mobile phone 12 . Next, as shown in step 466 , the authentication database 22 sends the user identification code and the corresponding account number to the service provider database 21 . Then, as shown in step 467, the service provider database 21 checks whether the account number and the user identification code correspond correctly? If yes, as shown in step 468, the service provider database 21 forcibly logs out the account. On the contrary, if no, the account is not forced to be logged out, and the process in FIG. 9 ends.

Referring to FIG. 10 , when the user 1 loses the mobile phone 12 , the following processing flow can be taken. As shown in step 471, the user 1 directly contacts the company to which the service provider database 21 belongs to inform that he intends to cancel the anti-theft service. Then, the company confirms the identity and the account number of the anti-theft service to be canceled to the user 1 . Then, as shown in step 473, the service provider database 21 notifies the authentication database 22 to cancel the corresponding relationship between the account and the user identification code to cancel the anti-theft service of the account, so when the user 1 intends to log in to the account to obtain the service Before the service provided by the provider server 21, there is no need to use the WAP network to unlock the account. In addition, the user can also directly apply for a new SIM card with the same phone number to the telecom operator. Because the user identification code of this new SIM card is exactly the same as the user identification code of the SIM card in the lost mobile phone 12, so user 1 can enter WAP by this new SIM card and mobile phone 12 equally. Internet to use the account's original account theft prevention services.

In view of the above, the structural features of the present invention can indeed provide a practical online authentication method and system, wherein the user 1 sets the account to a locked state through the Internet or WAP access, and through text messages, IVR or WAP access method to release the locked state, so that the user 1 can obtain the service provided by the service provider database 21 through the Internet, thereby improving the user 1 to obtain the service provider through the Internet. Security of Services Provided.

Claims (10)

1. An online authentication method comprising the following steps: (a) Execute the application registration process of an account anti-theft service through interactive voice guidance and text messages, so that the account enters a locked state; (b) a user connects to a carrier database of a particular carrier using a mobile phone; (c) the carrier database transmits a user ID of the mobile phone to an authentication database in which the user ID is pre-recorded and a user ID owned by the user and an account corresponding to the user identification code, which enables the user to use the services provided by a service provider database; and (d) The authentication database transmits the account number corresponding to the user identification code of the mobile phone to the service provider database, so as to activate the account number, so that the user can use the account number and the corresponding password to log in to the service provider database to obtain the services provided by the service provider database, and activate the account by unlocking the lock status in step (a). 2. The online authentication method according to claim 1, wherein the telecom operator database and the service provider database are respectively connected to the authentication database through a virtual private line network. 3. The online authentication method according to claim 1, characterized in that: the service provider database is either a game database or a money flow database. 4. The online authentication method according to claim 1, characterized in that: the (a) step comprises the following sub-steps: (a-1) Through the Internet, the user uses the account number and the corresponding password to log in to the service provider database, and chooses between interactive voice guidance and SMS on the application service page of the service provider database account anti-theft options; (a-2) the service provider database transmits the account number to the authentication database; (a-3) The user selects the telecom operator on the application service webpage of the authentication database; (a-4) The user enters the phone number of the mobile phone on the application service webpage of the specific telecom operator; (a-5) the carrier database sends the mobile phone's user ID to the authentication database; and (a-6) Correspondingly storing the account number and the user identification code in the authentication database. 5. An online authentication method comprising the following steps: (a) Execute the application and registration process of an account anti-theft service through a wireless communication protocol to access the Internet, so that the account enters a locked state; (b) a user connects to a carrier database of a particular carrier using a mobile phone; (c) the carrier database transmits a user ID of the mobile phone to an authentication database in which the user ID is pre-recorded and a user ID owned by the user and an account corresponding to the user identification code, which enables the user to use the services provided by a service provider database; and (d) The authentication database transmits the account number corresponding to the user identification code of the mobile phone to the service provider database, so as to activate the account number, so that the user can use the account number and the corresponding password to log in to the service provider database to obtain the services provided by the service provider database, and activate the account by unlocking the lock status in step (a). 6. The online authentication method according to claim 5, characterized in that: the (a) step comprises the following sub-steps: (a-1) The user uses the mobile phone to connect to the database of the telecom operator through a wireless communication protocol, and then connects to the application service webpage of the authentication database; (a-2) The user enters the account number and corresponding password on the application service webpage of the authentication database; (a-3) the authentication database transmits the account number and corresponding password to the service provider database; and (a-4) After the service provider database determines that the account number and the corresponding password are correct, it notifies the authentication database to store the account number, the corresponding password, and the user identification code of the mobile phone in the authentication database. in the database. 7. An online authentication system, which is suitable for a user to set an account to a locked state, and unlock the locked state through a mobile phone, so that the user can use an Internet device to obtain A service, the account enables the user to have the authority to use the service, wherein the online authentication system includes a telecom operator database and a service provider database, the telecom operator database is used to accept the mobile phone Connecting, and sending out a user identification code of the mobile phone, it is characterized in that: The online authentication system also includes an authentication database, which can be used to store the account number and the corresponding user identification code after a pre-executed application registration process for the account anti-theft service is completed, and to In the process of canceling the state, it can be used to receive the user identification code transmitted from the database of the telecom operator, and send out the account corresponding to the user identification code, wherein the account is entered into the application through the registration process. Locked state, and the service provider database is used to receive the account number transmitted from the authentication database, so as to release the locked state of the account number, and then provide the service that the user can obtain by using the Internet access device; The service provider database also provides an application service web page, which is used to provide an account anti-theft option of interactive voice guidance and SMS. When the user performs the application registration process, he first uses the Internet access device to connect to the Internet and use the account number and the corresponding password to log in to the application service web page of the service provider database, and then select one of the account anti-theft options, and then connect to the authentication database and the telecommunications operator database in sequence, and in the telecommunications The phone number of the mobile phone is input in the application service webpage of the operator database, so that the authentication database can store the account number and the user identification code of the mobile phone correspondingly. 8. The online authentication system according to claim 7, wherein the telecom operator database and the service provider database are respectively connected to the authentication database through a virtual private line network. 9. The online authentication system according to claim 7, wherein the service provider database is a game database and a cash flow database. 10. The online authentication system according to claim 7, characterized in that: when the user executes the registration application process, he first uses the mobile phone to connect to the telecommunications provider's database by means of a wireless communication protocol. Then connect to the application service webpage of the authentication database to enter the account number and corresponding password, and after the service provider database judges that the account number and corresponding password are correct, the authentication database then stores the account number and mobile phone's user ID.

Images