CN115664823A - An identity authentication method, device, equipment and storage medium - Google Patents

Abstract

The application discloses an identity authentication method, an identity authentication device, identity authentication equipment and a storage medium, which relate to the technical field of network security and comprise the following steps: when a target server acquires a login request sent by a user, acquiring a target user name, a target fixed password and a target dynamic password input by the user, and verifying the target fixed password according to the target user name; if the verification is passed, the target user name and the target dynamic password are forwarded to an authentication forwarding server to determine a corresponding mobile phone terminal, and the target dynamic password and the corresponding token number are forwarded to the mobile phone terminal; calculating a current dynamic password by using the seed value determined from the mobile phone terminal; and if the current dynamic password is consistent with the target dynamic password, generating a response of passing the authentication and forwarding the response to the target server. According to the method and the system, the seed values of the tokens are dispersedly managed through the mobile phone terminal, the seed information of all the tokens does not need to be stored at the server side, the risk that the token information is stolen is avoided, and the safety of identity authentication is improved.

Description

An identity authentication method, device, equipment and storage medium

technical field

The present application relates to the technical field of network security, in particular to an identity authentication method, device, equipment and storage medium.

Background technique

Dynamic Password (Dynamic Password), as one of the most secure identity authentication technologies, has been applied by more and more industries. Due to the ease of use and nothing to do with the platform, it is widely used in application fields such as online banking, online games, telecom operators, e-commerce, and enterprises. More and more companies are engaged in R&D and production of dynamic passwords at home and abroad. Its fast and seamless interoperability with various business systems, its certification software system is stable and efficient, supports multiple certification modes, and its solutions can serve enterprises of different sizes.

At present, the mainstream scheme adopted in the security authentication of the identity of the server is a unified dynamic password authentication system, and the administrator uniformly binds tokens and sets access policies (such as allowed access date, time, IP (Internet Interconnection Protocol, Internet Protocol) etc.). Specifically, when the OTP token needs to be authenticated, send the OTP and the user name to be authenticated to the authentication system, then query the value of the seed (seed) in the OTP token corresponding to the user name in the database through the authentication system, and then according to OATH (time or event) algorithm calculates the corresponding password, and checks whether the password is correct. If it is correct, then query the corresponding authority to determine whether there is authority to log in (such as non-working days, nights, holidays, etc. login is prohibited), and finally returns whether the password authentication is correct , whether the login is restricted, whether you have the right to log in to the server, etc.

However, servers in practical applications are generally managed by multiple departments and individuals, and the centralized management method cannot be managed by a single server person in charge anytime and anywhere; in addition, the centralized management method also has the possibility that the seed value of the token is stolen centrally The risk of the token seed value being stolen means that the corresponding token has a security risk.

Contents of the invention

In view of this, the purpose of this application is to provide an identity authentication method, device, device and storage medium, which can prevent the risk of token information being stolen and improve the security of identity authentication. The specific plan is as follows:

In the first aspect, this application discloses an identity authentication method, including:

When the target server obtains the login request sent by the user, a prompt message that please input the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user;

Obtaining the target user name, target fixed password and target dynamic password input by the user for the prompt information through the target server, and verifying the target fixed password according to the target user name;

If the verification is passed, then the target user name and the target dynamic password are forwarded to the authentication forwarding server, so that the mobile terminal corresponding to the target user name is determined by the authentication forwarding server, and the target dynamic password and the corresponding The token number is forwarded to the mobile terminal;

Determine the seed value corresponding to the token number from the mobile terminal, and use the seed value to calculate the current dynamic password;

The mobile terminal compares whether the current dynamic password is consistent with the target dynamic password, and if they are consistent, generates an authentication response message and forwards it to the target server through the authentication forwarding server.

Optionally, determining the mobile terminal corresponding to the target user name through the authentication forwarding server includes:

The mobile phone number corresponding to the target user name is determined through the authentication forwarding server, and the corresponding mobile phone terminal is found according to the mobile phone number.

Optionally, before forwarding the target dynamic password and the corresponding token number to the mobile terminal, it also includes:

Determine the IP address of the server managed by the mobile terminal from the authentication forwarding server according to the mobile phone number, and obtain the target server IP address;

Judging whether the IP address of the authentication forwarding server belongs to the IP address of the target server, if it belongs, then triggers the step of forwarding the target dynamic password and the corresponding token number to the mobile terminal; An authentication failure prompt message is sent to the terminal interface.

Optionally, the calculating the current dynamic password by using the seed value includes:

The current dynamic password is obtained by using the seed value and performing password calculation based on the OATH algorithm.

Optionally, said generating a response message of passing the authentication and forwarding it to the target server through the authentication forwarding server includes:

Generate the response information that the authentication is passed, and generate a dialog box for access rights setting on the interface of the mobile terminal, so that the administrator can set the corresponding access rights in the dialog box to obtain the target access rights;

forwarding the response information and the target access right to the target server through the authentication forwarding server.

Optionally, the dialog box for generating access permission settings on the interface of the mobile terminal includes:

A dialog box for setting temporary login duration permission is generated on the interface of the mobile terminal.

Optionally, the verifying the target fixed password according to the target user name includes:

The target fixed password is verified through the pluggable authentication module in the target server and according to the target user name.

In a second aspect, the present application discloses an identity authentication device, including:

The prompt information pop-up module is used for when the target server obtains the login request sent by the user, and pops up the prompt information of please input the user name, fixed password and dynamic password on the terminal interface corresponding to the user;

An information acquisition module, configured to acquire, through the target server, the target user name, target fixed password, and target dynamic password input by the user for the prompt information;

A fixed password verification module, configured to verify the target fixed password according to the target user name;

The first information forwarding module is used to forward the target user name and the target dynamic password to the authentication forwarding server if the verification is passed;

A mobile terminal determination module, configured to determine the mobile terminal corresponding to the target user name through the authentication forwarding server;

The second information forwarding module is used to forward the target dynamic password and the corresponding token number to the mobile terminal;

a seed value determination module, configured to determine a seed value corresponding to the token number from the mobile terminal;

The current dynamic password calculation module is used to calculate the current dynamic password by using the seed value;

A comparison module, configured to compare whether the current dynamic password is consistent with the target dynamic password through the mobile terminal;

The response generating and forwarding module is configured to generate a response message of passing the authentication and forward it to the target server through the authentication forwarding server if the current dynamic password is consistent with the target dynamic password.

In a third aspect, the present application discloses an electronic device, including a processor and a memory; wherein, the aforementioned identity authentication method is implemented when the processor executes a computer program stored in the memory.

In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned identity authentication method is implemented.

It can be seen that in this application, when the target server obtains the login request sent by the user, a prompt message asking to enter the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user, and then obtains the user's login request through the target server. For the target user name, target fixed password and target dynamic password input for the prompt information, and verify the target fixed password according to the target user name, if the verification is passed, the target user name and the target dynamic password forward to the authentication forwarding server, so that the mobile terminal corresponding to the target user name is determined by the authentication forwarding server, and the target dynamic password and the corresponding token number are forwarded to the mobile terminal, and then from the Determine the seed value corresponding to the token number in the mobile terminal, and use the seed value to calculate the current dynamic password, and then compare the current dynamic password with the target dynamic password through the mobile terminal. If they match, a response message of passing the authentication is generated and forwarded to the target server through the authentication forwarding server. This application disperses and manages the seed value of the token through the mobile terminal, does not need to store all the seed information of the token on the server side, eliminates the risk of token information being stolen, and improves the security of identity authentication.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present application, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a flow chart of an identity authentication method disclosed in the present application;

FIG. 2 is a flow chart of a specific identity authentication method disclosed in the present application;

FIG. 3 is a flow chart of a specific identity authentication method disclosed in the present application;

FIG. 4 is a schematic structural diagram of an identity authentication device disclosed in the present application;

FIG. 5 is a structural diagram of an electronic device disclosed in the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

The embodiment of the present application discloses an identity authentication method, as shown in Figure 1, the method includes:

Step S11: When the target server obtains the login request sent by the user, a prompt message of please input the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user.

In this embodiment, when the target server to be authenticated obtains the login request sent by the user, a prompt message asking to enter the user name, fixed password (ie fixed password) and dynamic password pops up on the terminal interface corresponding to the user. Wherein, the target server includes but is not limited to a database server, FTP (File Transfer Protocol Server, file transfer protocol) server, etc.; the OTP is generated by an OTP token, and the specific number of digits is determined by the type of the OTP token, The algorithms used in the process of generating the OTP by the OTP token include but are not limited to symmetric, asymmetric, and digest algorithms, such as the national secret hash algorithm SM2, the national secret hash algorithm SM3, and the national secret hash algorithm SM4.

Step S12: Obtain the target user name, target fixed password and target dynamic password input by the user for the prompt information through the target server, and verify the target fixed password according to the target user name.

In this embodiment, after the prompt information of please enter the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user, the user can manually input his user name according to the above prompt information displayed on the current terminal interface , fixed password and dynamic password, and then obtain the corresponding target user name, target fixed password and target dynamic password through the above-mentioned target server to obtain the information input by the above-mentioned user, and then verify the above-mentioned target fixed password according to the above-mentioned target user name, that is Determine whether the target user name is consistent with the target fixed password.

Step S13: If the verification is successful, forward the target user name and the target dynamic password to the authentication forwarding server, so that the mobile terminal corresponding to the target user name can be determined through the authentication forwarding server, and the target dynamic password The password and the corresponding token number are forwarded to the mobile terminal.

In this embodiment, if the above-mentioned target user name is consistent with the above-mentioned target fixed password, it is preliminarily determined that the user is a legitimate user, but in order to further improve the security of login and prevent the user's fixed password from being stolen, further steps are needed Check the target dynamic password to determine the identity of the user. Specifically, if the verification is passed, the above-mentioned target user name and the above-mentioned target dynamic password are further forwarded to the authentication forwarding server. After the above-mentioned target user name and the above-mentioned target dynamic password are obtained by the authentication forwarding Name determines the corresponding mobile phone terminal from the locally stored information, and then determines the token number corresponding to the above-mentioned target user name, and then forwards the target dynamic password and the corresponding token number to the above-mentioned mobile phone terminal.

In a specific real-time manner, the determining the mobile phone terminal corresponding to the target user name through the authentication forwarding server may specifically include: determining the mobile phone terminal corresponding to the target user name through the authentication forwarding server mobile phone number, and find the corresponding mobile phone terminal according to the mobile phone number. That is to say, after obtaining the target user name and target dynamic password forwarded by the target server, the authentication forwarding server first finds out the mobile phone number corresponding to the above target user name, and then determines the mobile terminal where the above mobile phone number is located.

Step S14: Determine the seed value corresponding to the token number from the mobile terminal, and use the seed value to calculate the current dynamic password.

In this embodiment, after the mobile phone terminal obtains the target dynamic password and the corresponding token number sent by the authentication forwarding server, it first queries the local password of the mobile phone terminal that is related to the token number. The corresponding seed value, and then use the above seed value to generate the current dynamic password. It should be pointed out that, as an authentication terminal, the mobile terminal pre-stores the token seed value within its own management scope and the server within its own responsibility scope; in addition, the calculation method of the current dynamic password includes but is not limited to OATH algorithm, etc. .

Step S15: compare whether the current dynamic password is consistent with the target dynamic password through the mobile terminal, and if they are consistent, generate a response message of passing the authentication and forward it to the target server through the authentication forwarding server.

In this embodiment, after using the seed value to calculate the current OTP, the mobile terminal will further compare the above-mentioned current OTP and the above-mentioned target OTP, and judge whether the two are consistent, and if they are consistent, it indicates the identity of the above-mentioned user As a legitimate user, the target server can be logged in normally, and at this time, the mobile terminal can generate corresponding response information for passing the authentication, and then send the above response information to the above-mentioned authentication forwarding server, and then forward the above-mentioned authentication forwarding server to the above-mentioned authentication forwarding server. The target server, after obtaining the above response information, the target server can agree to the login request of the user, so that the user can perform corresponding operations on the target server.

It can be seen that in the embodiment of the present application, when the target server obtains the login request sent by the user, a prompt message asking to enter the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user, and then obtains the login request through the target server. The target user name, target fixed password and target dynamic password input by the user for the prompt information, and verify the target fixed password according to the target user name, if the verification is passed, the target user name and the target The dynamic password is forwarded to the authentication forwarding server, so that the mobile terminal corresponding to the target user name is determined by the authentication forwarding server, and the target dynamic password and the corresponding token number are forwarded to the mobile terminal, and then from Determine the seed value corresponding to the token number in the mobile terminal, and use the seed value to calculate the current dynamic password, and then compare whether the current dynamic password is consistent with the target dynamic password through the mobile terminal , if consistent, generate a response message of passing the authentication and forward it to the target server through the authentication forwarding server. In the embodiment of the present application, the seed value of the token is decentralized and managed through the mobile phone terminal, and there is no need to store all the seed information of the token on the server side, which eliminates the risk of token information being stolen and improves the security of identity authentication.

The embodiment of the present application discloses a specific identity authentication method, as shown in Figure 2, the method includes:

Step S21: When the target server obtains the login request sent by the user, a prompt message asking to enter the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user.

Step S22: Obtain the target user name, target fixed password and target dynamic password input by the user for the prompt information through the target server, and pass the pluggable authentication module in the target server and according to the target The username is authenticated against the target fixed password.

In the present embodiment, referring to Fig. 3, described target server can specifically be database server and FTP server, when database server and FTP server obtain the target user name (li), target fixed password and target dynamic password ( That is, after 318467), the pluggable authentication module (PAM, Pluggable Authentication Modules) in the database server and FTP server can be used to verify whether the target user name input by the user is consistent with the target fixed password. If the authentication fails, a prompt message of authentication failure can be directly generated on the above-mentioned terminal interface.

Step S23: If the verification is passed, the target user name and the target dynamic password are forwarded to the authentication forwarding server.

Step S24: Determine the mobile phone number corresponding to the target user name through the authentication forwarding server, and find the corresponding mobile phone terminal according to the mobile phone number.

In this embodiment, as shown in FIG. 3, after the authentication forwarding server obtains the target user name (li) and the target dynamic password (318467) forwarded by the database server and the FTP server, it can query the target user name ( li) The corresponding token number (N324) and mobile phone number (13344445555), and then you can find the corresponding authentication mobile terminal through the mobile phone number (13344445555).

Step S25: Determine the IP address of the server managed by the mobile terminal from the authentication forwarding server according to the mobile phone number, and obtain the IP address of the target server.

In this embodiment, after the corresponding mobile phone terminal is found according to the mobile phone number, the IP address of the server corresponding to the mobile phone number can be further inquired through the above-mentioned authentication forwarding server. The IP address of the server is corresponding to the mobile phone number The server settings that can be managed by the mobile terminal, that is, the mobile terminal itself is responsible for the servers within the range. Referring to Fig. 3, find the IP address (ie 192.168.2.3\192.168.4.32\192.176.3.5) of the server managed by the corresponding mobile terminal through the mobile phone number (13344445555).

Step S26: Judging whether the IP address of the authentication forwarding server belongs to the IP address of the target server, if it does, forward the target dynamic password and the corresponding token number to the mobile terminal, and if it does not, the authentication fails The prompt information is sent to the terminal interface.

In this embodiment, after the IP address of the server managed by the mobile terminal is determined from the authentication forwarding server according to the mobile phone number to obtain the IP address of the target server, the authentication forwarding server is used to determine whether the IP address of the authentication forwarding server is Belong to the above-mentioned target server IP address, if the IP address of the above-mentioned authentication forwarding server belongs to the above-mentioned target server IP address, then the above-mentioned target dynamic password and the corresponding token number are forwarded to the mobile terminal, for example, when the mobile phone number in Figure 3 (13344445555) corresponding to the IP address of the server (192.168.2.3\192.168.4.32\192.176.3.5) is the IP address of the database server or FTP server, forward the dynamic password (ie 318467) and the corresponding token number (N324) Go to the mobile terminal with the mobile phone number 13344445555. Further, if the IP address of the above-mentioned authentication forwarding server does not belong to the IP address of the target server, it means that the authentication fails, and corresponding authentication failure prompt information can be generated and sent to the above-mentioned terminal interface.

Step S27: Determine the seed value corresponding to the token number from the mobile terminal, and use the seed value to perform password calculation based on the OATH algorithm to obtain the current dynamic password.

In this embodiment, after the mobile terminal obtains the target dynamic password and the corresponding token number sent by the authentication forwarding server, it first inquires locally whether there is a seed value corresponding to the above token number, and if it exists, it can use OATH The algorithm performs password calculation on the above seed value, and then obtains the current dynamic password.

Step S28: compare whether the current dynamic password and the target dynamic password are consistent through the mobile phone terminal, if they are consistent, generate a response message of passing the authentication, and generate a dialog box for access rights settings on the interface of the mobile terminal, So that the administrator can set the corresponding access right in the dialog box to obtain the target access right.

In this embodiment, after the mobile terminal calculates the current dynamic password, it compares the above-mentioned current dynamic password with the above-mentioned target dynamic password, and judges whether the two are the same, if they are the same, it means that the above-mentioned user is a legitimate user, and Generate a response message of passing the authentication, and then generate a dialog box for setting access rights on the interface of the above-mentioned mobile phone terminal, so that the administrator using the mobile phone terminal can set the corresponding access rights in the above-mentioned dialog box.

Specifically, the generating a dialog box for setting access rights on the interface of the mobile terminal may include: generating a dialog box for setting temporary login duration permissions on the interface of the mobile terminal. For example, referring to shown in Figure 3, on the interface of the mobile terminal, generate the correct prompt information of the dynamic password and the access right setting dialog box of the authorized login duration, then set the corresponding duration by using the manager of the mobile terminal, such as 15 minutes, Then click the OK button.

Step S29: forwarding the response information and the target access right to the target server through the authentication forwarding server.

In this embodiment, after the administrator sets the access duration permission for 15 minutes in the dialog box in Figure 3, it can be further forwarded to the above-mentioned database server and the above-mentioned FTP server through the above-mentioned authentication forwarding server. Then the user can visit the database server and the FTP server within 15 minutes.

Wherein, for a more specific processing procedure of the above-mentioned step S23, reference may be made to the corresponding content disclosed in the foregoing embodiments, and details are not repeated here.

It can be seen that the embodiment of the present application adopts two-factor authentication, that is, it is necessary to verify the fixed password and the dynamic password. After all the authentications are successful, the identity of the user is determined to be a legitimate user, and the dynamic password has the characteristics of one-time padding. Therefore, it is possible to prevent multiple misappropriation of the password after it is recorded, thereby realizing the multi-authentication mechanism required by the security level protection, and preventing the single authentication method from being easily cracked; moreover, the mobile terminal uses the seed value of the token managed by itself for authentication. , and after the authentication is passed, certain permissions are re-restricted, so that managers can manage servers within their responsibilities in real time, and prohibit access to illegal access in a timely manner, so that precise permissions and rights can be minimized ; In addition, this scheme can manage the seed value of the token in a decentralized manner, and does not need to store all the token seed information on the server side, thereby eliminating the security risk of the purchased token information being stolen.

Correspondingly, the embodiment of the present application also discloses an identity authentication device, as shown in Figure 4, the device includes:

Prompt information pop-up module 11, for when the target server obtains the login request sent by the user, the prompt information that please input user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user;

An information acquisition module 12, configured to obtain, through the target server, the target user name, target fixed password and target dynamic password input by the user for the prompt information;

A fixed password verification module 13, configured to verify the target fixed password according to the target user name;

The first information forwarding module 14 is used to forward the target user name and the target dynamic password to the authentication forwarding server if the verification is passed;

The mobile terminal determination module 15 is used to determine the mobile terminal corresponding to the target user name through the authentication forwarding server;

The second information forwarding module 16 is used for forwarding the target dynamic password and the corresponding token number to the mobile terminal;

Seed value determination module 17, for determining the seed value corresponding to the token number from the mobile terminal;

Current dynamic password calculation module 18, for utilizing described seed value to calculate current dynamic password;

Comparison module 19, used to compare whether the current dynamic password is consistent with the target dynamic password through the mobile terminal;

The response generation and forwarding module 110 is configured to generate a response message of passing the authentication and forward it to the target server through the authentication forwarding server if the current dynamic password is consistent with the target dynamic password.

For the specific work flow of each of the above modules, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

It can be seen that in the embodiment of the present application, when the target server obtains the login request sent by the user, a prompt message asking to enter the user name, fixed password and dynamic password will pop up on the terminal interface corresponding to the user, and then the target server will Acquiring the target user name, target fixed password and target dynamic password input by the user for the prompt information, and verifying the target fixed password according to the target user name, if the verification is passed, the target user name and the target dynamic password are The target dynamic password is forwarded to the authentication forwarding server, so that the mobile terminal corresponding to the target user name is determined by the authentication forwarding server, and the target dynamic password and the corresponding token number are forwarded to the mobile terminal, Then determine the seed value corresponding to the token number from the mobile terminal, and use the seed value to calculate the current dynamic password, then compare the current dynamic password and the target dynamic password by the mobile terminal Whether they are consistent, if they are consistent, a response message of passing the authentication is generated and forwarded to the target server through the authentication forwarding server. In the embodiment of the present application, the seed value of the token is decentralized and managed through the mobile phone terminal, and there is no need to store all the seed information of the token on the server side, which eliminates the risk of token information being stolen and improves the security of identity authentication.

In some specific embodiments, the mobile phone terminal determining module 15 may specifically include:

A mobile phone number determination unit, configured to determine the mobile phone number corresponding to the target user name through the authentication forwarding server;

The mobile phone terminal determination unit is used to find the corresponding mobile phone terminal according to the mobile phone number.

In some specific embodiments, before the mobile phone terminal determination module 15, it may also include:

The server IP address determination unit is used to determine the IP address of the server managed by the mobile terminal from the authentication forwarding server according to the mobile phone number, and obtain the target server IP address;

a judging unit, configured to judge whether the IP address of the authentication forwarding server belongs to the IP address of the target server;

A triggering unit, configured to trigger the step of forwarding the target dynamic password and the corresponding token number to the mobile terminal if the IP address of the authentication forwarding server belongs to the target server IP address;

A prompt information sending unit, configured to send authentication failure prompt information to the terminal interface if the IP address of the authentication forwarding server does not belong to the IP address of the target server.

In some specific embodiments, the current dynamic password calculation module 18 may specifically include:

The current dynamic password calculation unit is used to use the seed value and perform password calculation based on the OATH algorithm to obtain the current dynamic password.

In some specific embodiments, the response generating and forwarding module 110 may specifically include:

A response information generation unit, configured to generate a response information for passing the authentication;

A dialog box generation unit is used to generate a dialog box for setting access rights on the interface of the mobile terminal, so that managers can set corresponding access rights in the dialog box and obtain target access rights;

An information forwarding unit, configured to forward the response information and the target access right to the target server through the authentication forwarding server.

In some specific embodiments, the dialog generating unit may specifically include:

The permission setting dialog generating unit is used to generate a temporary login duration permission setting dialog on the interface of the mobile terminal.

In some specific embodiments, the fixed password verification module 13 may specifically include:

A fixed password verification unit, configured to verify the target fixed password through the pluggable authentication module in the target server and according to the target user name.

Further, the embodiment of the present application also discloses an electronic device. FIG. 5 is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the figure should not be regarded as any limitation on the application scope of the present application.

FIG. 5 is a schematic structural diagram of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21 , at least one memory 22 , a power supply 23 , a communication interface 24 , an input/output interface 25 and a communication bus 26 . Wherein, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the identity authentication method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is applicable Any communication protocol in the technical solution of the present application is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the external, and its specific interface type can be selected according to specific application needs, here Not specifically limited.

In addition, the memory 22, as a resource storage carrier, can be a read-only memory, random access memory, magnetic disk or optical disk, etc., and the resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage. .

Wherein, the operating system 221 is used to manage and control various hardware devices and computer programs 222 on the electronic device 20 , which may be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the identity authentication method performed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

Further, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed identity authentication method is realized. Regarding the specific steps of the method, reference may be made to the corresponding content disclosed in the foregoing embodiments, and details are not repeated here.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above is a detailed introduction to an identity authentication method, device, equipment and storage medium provided by this application. In this paper, specific examples are used to illustrate the principle and implementation of this application. The description of the above embodiments is only for help. Understand the method of this application and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation and scope of application. In summary, the content of this specification does not It should be understood as a limitation on the present application.

Claims (10)

1. An identity authentication method, characterized in that, comprising: When the target server obtains the login request sent by the user, a prompt message that please input the user name, fixed password and dynamic password pops up on the terminal interface corresponding to the user; Obtaining the target user name, target fixed password and target dynamic password input by the user for the prompt information through the target server, and verifying the target fixed password according to the target user name; If the verification is passed, then the target user name and the target dynamic password are forwarded to the authentication forwarding server, so that the mobile terminal corresponding to the target user name is determined by the authentication forwarding server, and the target dynamic password and the corresponding The token number is forwarded to the mobile terminal; Determine the seed value corresponding to the token number from the mobile terminal, and use the seed value to calculate the current dynamic password; The mobile terminal compares whether the current dynamic password is consistent with the target dynamic password, and if they are consistent, generates an authentication response message and forwards it to the target server through the authentication forwarding server. 2. The identity authentication method according to claim 1, wherein the determining the mobile terminal corresponding to the target user name through the authentication forwarding server comprises: The mobile phone number corresponding to the target user name is determined through the authentication forwarding server, and the corresponding mobile phone terminal is found according to the mobile phone number. 3. The identity authentication method according to claim 2, wherein, before the described target dynamic password and the corresponding token number are forwarded to the mobile terminal, further comprising: Determine the IP address of the server managed by the mobile terminal from the authentication forwarding server according to the mobile phone number, and obtain the target server IP address; Judging whether the IP address of the authentication forwarding server belongs to the IP address of the target server, if it belongs, then triggers the step of forwarding the target dynamic password and the corresponding token number to the mobile terminal; An authentication failure prompt message is sent to the terminal interface. 4. The identity authentication method according to claim 1, wherein said utilizing said seed value to calculate the current dynamic password comprises: The current dynamic password is obtained by using the seed value and performing password calculation based on the OATH algorithm. 5. The identity authentication method according to claim 1, wherein said generating a response message of passing the authentication and forwarding it to the target server through the authentication forwarding server comprises: Generate the response information that the authentication is passed, and generate a dialog box for access rights setting on the interface of the mobile terminal, so that the administrator can set the corresponding access rights in the dialog box to obtain the target access rights; forwarding the response information and the target access right to the target server through the authentication forwarding server. 6. The identity authentication method according to claim 5, wherein the dialog box for generating access rights settings on the interface of the mobile terminal comprises: A dialog box for setting temporary login duration permission is generated on the interface of the mobile terminal. 7. The identity authentication method according to any one of claims 1 to 6, wherein the verifying the target fixed password according to the target user name includes: The target fixed password is verified through the pluggable authentication module in the target server and according to the target user name. 8. An identity authentication device, characterized in that it comprises: The prompt information pop-up module is used for when the target server obtains the login request sent by the user, and pops up the prompt information of please input the user name, fixed password and dynamic password on the terminal interface corresponding to the user; An information acquisition module, configured to acquire, through the target server, the target user name, target fixed password, and target dynamic password input by the user for the prompt information; A fixed password verification module, configured to verify the target fixed password according to the target user name; The first information forwarding module is used to forward the target user name and the target dynamic password to the authentication forwarding server if the verification is passed; A mobile terminal determination module, configured to determine the mobile terminal corresponding to the target user name through the authentication forwarding server; The second information forwarding module is used to forward the target dynamic password and the corresponding token number to the mobile terminal; a seed value determination module, configured to determine a seed value corresponding to the token number from the mobile terminal; The current dynamic password calculation module is used to calculate the current dynamic password by using the seed value; A comparison module, configured to compare whether the current dynamic password is consistent with the target dynamic password through the mobile terminal; The response generating and forwarding module is configured to generate a response message of passing the authentication and forward it to the target server through the authentication forwarding server if the current dynamic password is consistent with the target dynamic password. 9. An electronic device, characterized by comprising a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the identity authentication method according to any one of claims 1 to 7 is implemented. 10. A computer-readable storage medium, characterized by being used to store a computer program; wherein, when the computer program is executed by a processor, the identity authentication method according to any one of claims 1 to 7 is realized.

Images