WO2015180689A1 - Method and apparatus for acquiring verification information - Google Patents

Abstract

Disclosed are a method and an apparatus for acquiring verification information. The method for acquiring verification information comprises: a terminal negotiates with a network device on a key used for decrypting the verification information, the verification information being a message used for verifying an identity or right of the terminal or a user when a target application program executes a specific service; the network device encrypts the verification information by using the key, and sends the encrypted verification information to the terminal; the terminal decrypts the encrypted verification information by using the negotiated key, and acquires the verification information; and verify, by using the verification information, the identity or the right of the terminal or the user when the target application program executes the specific service. The present invention can effectively ensure the security when payment and other services are operated on an application program.

Description

Method and device for obtaining verification information Technical field

The present invention relates to the field of network security technologies, and in particular, to a method and an apparatus for acquiring authentication information.

Background technique

In the existing mobile service, users are often required to use authentication information to operate to ensure the security of the service. Users can obtain verification information by SMS or email. For example, when registering an account with a mobile phone or making a payment, the server needs to send a text message to the current mobile phone number for authentication, and the short message is sent in clear text. However, some operating systems (such as Android) platforms are relatively open at present, and any software can read the short message content after registering the short message permission, which causes great hidden dangers in security.

In many certifications, especially in the payment process, SMS verification is the last security measure. Generally speaking, a server (a service provider, such as Alipay) sends a text message containing a digit or a character verification code to a previously bound mobile phone number through a short message gateway. After receiving the short message, the user passes the verification code in the short message to the server through the mobile APP or the WEB page of the authentication or payment. The server judges whether the user is performing the verification or payment operation according to the submitted verification code.

The problem is that as a personal item, the text message is not as secure as the service provider and the user understands. Just open a phone and view each installed app, you will find that many seemingly completely unrelated applications will require permission to read text messages or even send text messages. It can be seen that the user does not care about the installed application at all. A malicious Trojan application can silently read the verification code described earlier. Android4.4 before the system (currently the majority of Android phones on the market), Trojans can even delete the SMS after stealing the verification code message without Root, stealing the verification code without the user's awareness. .

In addition to malicious Trojans that may steal verification code text messages, there is a serious problem that the phone may be lost. In the case of a lost mobile phone, the person who obtains the mobile phone can easily use the function of retrieving the password by using the short message to perform a lot of operations, including modifying the user login password, payment, transfer, and the like.

Summary of the invention

In view of the above problems, the present invention has been made in order to provide a method and apparatus for acquiring verification information that overcomes the above problems or at least partially solves the above problems.

According to an aspect of the present invention, a method for obtaining authentication information is provided, comprising: a terminal negotiating, with a network device, a key for encrypting and decrypting the verification information, wherein the verification information is used to verify a target application. The program executes a message of the identity or authority of the terminal or the user in the specific service process; the network device encrypts the verification information by using the key, and sends the encrypted verification information to the terminal; the terminal utilizes the negotiated secret The key decrypts the encrypted verification information to obtain a verification letter. And verifying the identity or authority of the terminal or the user by using the verification information during the execution of the specific service by the target application.

According to another aspect of the present invention, an apparatus for acquiring authentication information is provided, including: a key agreement unit, configured to negotiate a key for encrypting and decrypting verification information between a terminal and a network device, where The verification information is a message for verifying the identity or authority of the terminal or the user in the specific service process of the target application; the encryption verification information obtaining unit is configured to receive the verification that the network device encrypts the verification information by using the key a decryption unit, configured to decrypt the encrypted verification information by using the negotiated key to obtain the verification information, and the service execution unit is configured to use the verification information to verify the terminal or the target application to perform a specific service process The identity or permissions of the user.

According to still another aspect of the present invention, a computer program is provided, comprising computer readable code, a method for causing a terminal to perform acquisition of the verification information of the preceding item when the computer readable code is run on a terminal .

According to still another aspect of the present invention, a computer readable medium storing the computer program described in the preceding paragraph is provided.

It can be seen from the above embodiment that compared with the prior art, the beneficial effects of the present invention are: encrypting the verification information by key negotiation between the application and the network device, and the application directly reads the encrypted verification. Information, thereby utilizing the decrypted verification information to perform operations such as business, that is, only the application can decrypt the verification information in the form of ciphertext. For a malicious application such as a Trojan, even if the verification information can be obtained, the verification information is The ciphertext form is also not available, which effectively guarantees the security of business operations such as payment on the application.

In addition, the present invention has a good defense effect against GSM (Global System for Mobile Communications) signal eavesdropping, sim (Subscriber Identity Module) card copying and the like, because the cryptographic verification by the present invention The attack mode of the information mode, GSM signal eavesdropping, sim card copying, etc. can only obtain the ciphertext, there is no way to get the plaintext, and of course, it is impossible to continue the attack.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

FIG. 1 is a flow chart showing a method for acquiring verification information according to an embodiment of the present invention; FIG.

2 is a flow chart showing an example of an acquisition method of verification information according to an embodiment of the present invention;

FIG. 3 is a flowchart showing an example 2 of an acquisition method of verification information according to an embodiment of the present invention; FIG.

FIG. 4 is a flowchart showing an example 3 of an acquisition method of verification information according to an embodiment of the present invention; FIG.

FIG. 5 is a schematic structural diagram of an apparatus for acquiring verification information according to an embodiment of the present invention; FIG.

Figure 6 is a block diagram showing a terminal for performing an acquisition method of verification information according to the present invention;

Fig. 7 shows a storage unit for holding or carrying program code for implementing an acquisition method of verification information according to the present invention.

Specific embodiment

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided so that this disclosure will be more fully understood and the scope of the disclosure will be fully disclosed.

FIG. 1 is a flowchart of a method for obtaining authentication information according to an embodiment of the present invention. Includes the following steps:

S101: The terminal negotiates, with the network device, a key used to encrypt and decrypt the verification information, where the verification information is a message for verifying the identity or authority of the terminal or the user in the specific service process performed by the target application;

S102: The network device encrypts the verification information by using a key, and sends the encrypted verification information to the terminal.

S103: The terminal decrypts the encrypted verification information by using the negotiated key to obtain verification information.

S104: Verify the identity or authority of the terminal or the user by using the verification information during the execution of the specific service by the target application.

In the present invention, a terminal refers to a terminal having a communication function, for example, a smartphone or the like. A network device refers to a server, gateway, or proxy server that sends authentication information for a service of a target application. A target application refers to an application that needs to verify authentication information for service (business), including but not limited to communication software, payment software, or e-commerce software, such as the now popular Alipay software, WeChat, and the like. Executing a specific service on the target application means performing payment, login, download, etc. on the target application after the authentication information is verified by the terminal or the identity or authority of the user. The above steps S101 and S103 may be performed by the target application or by the security application, which will be described in detail in the following embodiments.

It can be understood that the verification information is initiated by the target application server for the target application. Information about user authentication on the program. The method for obtaining the verification information is not limited. The commonly used method is to obtain the verification information by using the short message method. However, the present invention does not limit this, and the manner of obtaining the verification information by means of mail or instant communication tools is feasible.

An implementation condition of the embodiment of the present invention is that the application program has the right to access the communication mode for obtaining the verification information. For example, if the terminal receives the verification information by using the short message, the application program has the right to access the verification short message, and thereafter, the application utilizes The user has the right to access the short message, and directly access the short message to obtain the encrypted verification information. Thereby, step S103 can be performed to decrypt the encrypted short message, thereby finally obtaining the decrypted verification information.

In the solution of the present invention, the key is determined by key agreement between the application and the network device, and the verification information is encrypted by using the negotiated key. Those skilled in the art understand that keys can be divided into symmetric keys and asymmetric keys. Symmetric key encryption, also known as private key encryption or session key encryption, means that the sender and receiver of the message use the same key to encrypt and decrypt the data. Its biggest advantage is that the encryption/decryption speed is fast, suitable for encrypting large amounts of data, but key management is difficult. An asymmetric key encryption system, also known as public key encryption. It requires different keys to perform encryption and decryption operations separately, one public release, the public key or public key, and the other privately stored by the user, a private key or private key. The sender of the message encrypts with a public key, while the recipient of the message decrypts it with a private key. The public key mechanism is flexible, but encryption and decryption are much slower than symmetric key encryption. In the present invention, the key may be a symmetric key or an asymmetric key. When the symmetric key mode is adopted, the network device and the application use the same key to encrypt and decrypt the verification information; when the asymmetric key is used, the network device encrypts the verification information by using the public key, and the application uses the private key. Decrypt the encrypted authentication information.

It can be seen that the present invention encrypts the verification information through key negotiation between the application and the network device, and the application directly reads the encrypted verification information, thereby performing the operation of the service by using the decrypted verification information, that is, only this The application can decrypt the authentication information in the cipher text form. For a malicious application such as a Trojan, even if the verification information can be obtained, since the verification information is in the form of ciphertext, it is not utilized, which effectively ensures payment on the application. The security of business operations.

In addition, the present invention has a good defense effect on attack methods such as GSM signal eavesdropping and sim card copying, because the attacker of the GSM signal eavesdropping, sim card copying and the like can only obtain the confidentiality by the cryptographic authentication information method of the present invention. Wen, there is no way to get clear text, of course, can not continue to attack.

The embodiments of the present invention are described in detail below with a few examples.

Example one

Referring to FIG. 2, a flowchart of a method for obtaining verification information provided in Example 1 includes:

S201: the target application of the terminal negotiates a key for verifying the information with the network device;

S202: The network device encrypts the verification information by using a key, and sends the encrypted verification information to the terminal.

S203: The target application decrypts the encrypted verification information by using the negotiated key to obtain verification information.

The target application refers to an application that needs to verify the verification information to perform a service; then, it can be understood that the network device refers to a server, a gateway, or a proxy server that transmits verification information for a service of a target application.

The following is an example of obtaining verification information by means of a mobile phone short message.

First, the APP (target APP) installed on the user's mobile phone and the network device negotiate a key based on some means. A network device refers to a functional entity corresponding to authentication information located on the network side, and can have various forms. Specifically, the APP may directly negotiate a key with the APP server, send a cipher text message, negotiate a key with the SMS gateway, and send a cipher text message, and may also use a proxy server of the SMS gateway to negotiate a key and send the message. Cipher text message. A person skilled in the art understands that the short message service is controlled by the operator. Then, if the APP server sends the authentication message of the APP service to the terminal, it is generally sent by the operator's short message service line. Therefore, in general, it is required. Key negotiation is performed by means of a short message gateway or a short message gateway proxy server, and of course, key negotiation with the APP server can be performed as described above.

Then, when the network device sends a short message to the user's mobile phone, the encrypted key is used for encryption.

Finally, the user receives the encrypted verification message on the mobile phone, and the APP automatically acquires the short message in the background and decrypts to obtain the real verification code.

For example, the APP in this example refers to Alipay software. Then, the Alipay software on the mobile phone first needs to negotiate a verification code key with the network device (an Alipay server, a short message gateway, or a short message gateway proxy server); when the user performs a service such as payment, A verification code is required. At this time, the network device encrypts the verification code and sends it to the user's mobile phone by using a pre-agreed key. Finally, the user receives a verification message in the form of a ciphertext through the short message on the mobile phone, and the mobile phone The Alipay software directly reads the ciphertext short message from the background, and uses the pre-agreed key to read, obtains the decrypted verification code, and finally verifies and completes the business.

It can be seen that because the mobile phone receives the encrypted short message, the target APP cannot read the verification information, which effectively solves the problem that the verification message is stolen by malicious software such as Trojan.

Example two

Referring to FIG. 3, a flowchart of a method for obtaining verification information provided by example 2 includes:

S301: The security application negotiates, with the network device, a key used for verifying the information, where the verification information is information that needs to be verified in the service of the target application;

S302: The network device encrypts the verification information by using a key, and sends the encrypted verification information to the terminal.

S303: The security application decrypts the encrypted verification information by using the negotiated key, and obtains the verification. Certificate information;

S304: The security application provides verification information to the target application, and/or the security application presents the verification information to the user.

The target application refers to an application that needs to verify the verification information to perform a service; then, it can be understood that the network device refers to a server, a gateway, or a proxy server that transmits verification information for a service of a target application.

The second example differs from the above example in that the verification information is uniformly managed for each target application by introducing a security application. Specifically, the security application performs key agreement with the network device, and the authentication information can be read and decrypted only by the security application, and the decrypted verification information is provided by the security application to the target application.

The following is an example of obtaining verification information by means of a mobile phone short message.

The difference from the example one is that a security app needs to be installed on the user's mobile phone.

First, the secure APP and the network device perform key negotiation. A network device refers to a functional entity corresponding to authentication information located on the network side, and can have various forms. Specifically, the security APP may directly negotiate a key with the target APP server, send a cipher text message, negotiate a key with the short message gateway, and send a cipher text message, and may also use a proxy server of the short message gateway to negotiate a key. And send cipher text messages. A person skilled in the art understands that the short message service is controlled by the operator. Then, if the target APP server sends a verification short message of the target APP service to the terminal, it is generally sent by using the short message service line of the operator, so generally, Key negotiation needs to be performed by means of a short message gateway or a short message gateway proxy server. Of course, key negotiation with the target APP server can also be performed as described above.

Then, when the network device sends a short message to the user's mobile phone, the encrypted key is used for encryption.

Next, the user receives an encrypted verification message on the mobile phone, and only this secure application can be decrypted and displayed to the user.

Finally, the target APP obtains the decrypted verification message through the interface provided by the security APP.

It can be seen that if other APPs need to read the corresponding short message, the short message is not obtained through the short message interface of the mobile operating system, but is obtained through the interface provided by the secure APP. The security APP is responsible for verifying the legitimacy of the APP attempting to invoke the interface (validating the signature of the APP, and determining that the short message belongs to the APP. For example, only the WeChat APP can read the verification code SMS sent by the WeChat server), only the target APP The verification information is provided to the target APP when it is legal.

The validity of the security APP verification target APP includes: determining whether the target APP is legal by the signature of the target APP, and/or determining whether the target APP has the right to read the verification information. Specifically, determining whether the target APP is legal includes: determining whether the target APP belongs to the secure APP (white APP) according to the signature of the target APP, or determining whether the target APP belongs to the malicious APP (black APP) according to the signature of the target APP, if the target APP is a security app or not a malicious app. Then determine that the target APP is legal. It can be understood that the white APP and the black APP list are pre-acquired and stored on the mobile phone, and the acquisition manner may be manual setting or network crawling, and the like. Specifically, determining whether the target APP has the right to read the verification information includes: determining whether the target APP is an application corresponding to the network device that provides the verification information, and if yes, determining that the target APP has the right to read the verification information. Specifically, it is determined whether the identifier carried in the verification information corresponds to the network device that provides the verification information. For example, judging by sending a text message number.

For example, the target APP in this example refers to WeChat software, then the secure APP on the mobile phone (for example, 360 secure address book) first needs to negotiate the verification code key with the network device (WeChat server, SMS gateway or SMS gateway proxy server). When the user performs a service such as payment, a verification code is required. At this time, the network device encrypts the verification code and sends it to the user's mobile phone by using a pre-agreed key; then, the user receives a message through the short message on the mobile phone. The cipher text form verification message, and the security APP on the mobile phone directly reads the cipher text message from the background, and uses the pre-agreed key to read, obtains the decrypted verification code, and presents the plaintext verification code to the user. Finally, if necessary, WeChat obtains the plaintext verification code from the interface provided by the security APP.

It can be seen that because the mobile phone receives the encrypted short message, the security APP cannot read the verification information, and the security APP provides the verification message to the APP on the basis of verifying the legality of the target APP, effectively solving the verification message being Trojan, etc. The problem of malware theft. Moreover, compared with the first example, the second embodiment can also display the verification information of the plaintext to the user, which can satisfy the situation that the verification code is sent through the PC browser, that is, the case that the operation is performed on the PC through the target APP. .

Example three

Referring to FIG. 4, a flowchart of a method for obtaining verification information provided by example 3 includes:

S401: The security application negotiates, with the network device, a key used for verifying the information, where the verification information is information that needs to be verified in the service of the target application;

S402: The network device encrypts the verification information by using a key, and sends the encrypted verification information to the terminal.

S403: The security application decrypts the encrypted verification information by using the negotiated key to obtain verification information.

S404: Obtain a password input by the user, and determine whether the password input by the user is correct according to a password agreed with the user in advance;

S405: The security application provides the verification information to the target application when the user inputs the password correctly, and/or the security application presents the verification information to the user.

The target application refers to an application that needs to verify the verification information to perform a service; then, it can be understood that the network device refers to a server, a gateway, or a proxy server that transmits verification information for a service of a target application.

This example three is similar to the above example two, by introducing a security application, for each target should Use the program to manage the verification information in a unified manner. Specifically, the security application performs key agreement with the network device, and the authentication information can be read and decrypted only by the security application, and the decrypted verification information is provided by the security application to the target application. The difference from the second example is that the user is required to enter a password agreed in advance with the security application before presenting the verification information to the user or before providing the verification information to the target application.

The following is an example of obtaining verification information by means of a mobile phone short message.

A security app needs to be installed on the user's mobile phone.

First, the secure APP and the network device perform key negotiation. A network device refers to a functional entity corresponding to authentication information located on the network side, and can have various forms. Specifically, the security APP may directly negotiate a key with the target APP server, send a cipher text message, negotiate a key with the short message gateway, and send a cipher text message, and may also use a proxy server of the short message gateway to negotiate a key. And send cipher text messages. A person skilled in the art understands that the short message service is controlled by the operator. Then, if the target APP server sends a verification short message of the target APP service to the terminal, it is generally sent by using the short message service line of the operator, so generally, Key negotiation needs to be performed by means of a short message gateway or a short message gateway proxy server. Of course, key negotiation with the target APP server can also be performed as described above.

Then, when the network device sends a short message to the user's mobile phone, the encrypted key is used for encryption.

Then, the user receives the encrypted verification message on the mobile phone, and the security APP decrypts.

Then, when the user needs to view the decrypted verification short message, or the target APP needs to read the verification short message, the user needs to input a password agreed in advance with the security APP.

Finally, the target APP presents the decrypted verification message to the user, or the target APP obtains the decrypted verification message through the interface provided by the security APP.

It can be seen that if other APPs need to read the corresponding short message, the short message is not obtained through the short message interface of the mobile operating system, but is obtained through the interface provided by the secure APP. The security APP is responsible for verifying the legitimacy of the APP attempting to invoke the interface (validating the signature of the APP, and determining that the short message belongs to the APP. For example, only the WeChat APP can read the verification code SMS sent by the WeChat server), only the target APP The verification information is provided to the target APP when it is legal.

The validity of the security APP verification target APP includes: determining whether the target APP is legal by the signature of the target APP, and/or determining whether the target APP has the right to read the verification information. Specifically, determining whether the target APP is legal includes: determining whether the target APP belongs to the secure APP (white APP) according to the signature of the target APP, or determining whether the target APP belongs to the malicious APP (black APP) according to the signature of the target APP, if the target If the APP belongs to a secure APP or does not belong to a malicious APP, it is determined that the target APP is legal. It can be understood that the white APP and the black APP list are pre-acquired and stored on the mobile phone, and the acquisition manner may be manual setting or network crawling, and the like. Specifically, determining whether the target APP has the right to read the verification information includes: determining whether the target APP is a network that provides verification information The application corresponding to the network device, if yes, determines that the target APP has the right to read the verification information. Specifically, it is determined whether the identifier carried in the verification information corresponds to the network device that provides the verification information. For example, judging by sending a text message number.

For example, the target APP in this example refers to the bank payment platform to which Amazon is linked. Then, the security APP on the mobile phone (for example, 360 secure address book) first needs to be associated with the network device (bank payment platform server, SMS gateway or SMS gateway proxy server). Negotiating the verification code key; when the user performs the payment and other services, the verification code is required. At this time, the network device encrypts the verification code and sends it to the user's mobile phone by using a pre-agreed key; then, the user passes the mobile phone The short message received by the short message is a verification message in the form of a cipher text, and the security APP on the mobile phone directly reads the cipher text message from the background, and uses the pre-agreed key to read and obtain the decrypted verification code; After the correct password, the plaintext verification code is displayed to the user; finally, if necessary, the bank payment platform obtains the plaintext verification code from the interface provided by the security APP.

It can be seen that because the mobile phone receives the encrypted short message, the security APP cannot read the verification information, and the security APP provides the verification message to the APP on the basis of verifying the legality of the target APP, effectively solving the verification message being Trojan, etc. The problem of malware theft. Moreover, similar to the second example, the third example can also display the verification information of the plaintext to the user, which can satisfy the situation that the verification code is sent through the PC browser, that is, it is suitable for the operation on the PC through the target APP. In addition, compared with the second example, the third embodiment displays the verification information or provides the target information to the user after the user inputs the correct password, that is, further ensures the security of the verification information, and the cipher text verification information and the user password. Double insurance ensures the security of the verification information even when the phone is lost.

Corresponding to the above method, the present invention also provides an apparatus for acquiring verification information. The device can be implemented by hardware, software or a combination of software and hardware. The device may refer to a functional module inside the terminal, or may refer to the terminal itself, as long as the terminal includes a function of implementing the device. Referring to Figure 5, the device includes:

The key negotiation unit 501 is configured to negotiate, between the terminal and the network device, a key for encrypting and decrypting the verification information, where the verification information is used to verify that the terminal or the user is in the process of executing the specific service in the target application. Message of identity or authority;

The cryptographic verification information obtaining unit 502 is configured to receive verification information that the network device encrypts the verification information by using the key;

The decrypting unit 503 is configured to decrypt the encrypted verification information by using the negotiated key to obtain verification information.

The service execution unit 504 is configured to use the verification information to verify the identity or authority of the terminal or the user during the execution of the specific service process by the target application.

Preferably, in a solution, the function of the key agreement unit 501 and the decryption unit 503 is performed by the target application, that is, the target application performs the negotiation with the network device for verification. The key of the certificate information and the decrypted authentication information are decrypted using the negotiated key.

Preferably, in another solution, the function of the key agreement unit 501 and the decryption unit 503 is performed by a security application, that is, the security application executes the negotiation of a key for verifying information with the network device and the Decrypting the encrypted verification information by using the negotiated key; the key negotiation unit 501 is specifically configured to: negotiate, by using the security application, a key for verifying information with the network device, where the verification information is The device of the target application needs to be verified; the device further includes: a verification information providing unit 505, configured to provide the verification information to the target application by using the security application.

The target application invokes an interface provided by the security application to obtain the verification information from the security application.

Optionally, the device further includes: a target legality verification unit 506, configured to verify validity of the target application by using the security application; in this case, the verification information providing unit 505 has only the target application. The verification information is provided to the target application only when it is legal.

The target validity verification unit 506 is specifically configured to: determine, by the signature of the target application, whether the target application is legal, and/or determine whether the target application has the verification information. Permissions.

Specifically, the target legality verification unit 506 is specifically configured to: determine, according to the signature of the target application, whether the target application belongs to a security application, or determine the target application according to the signature of the target application. Whether the program belongs to a malicious application, and if the target application belongs to a security application or is not a malicious security program, it is determined that the target application is legitimate.

Specifically, the target legality verification unit 506 is specifically configured to: determine whether the target application is an application corresponding to the network device that provides the verification information, and if yes, determine that the target application has read The authority to verify the information.

Specifically, the target validity verification unit 506 is specifically configured to: determine whether the identifier carried in the verification information corresponds to a network device that provides the verification information.

Preferably, in another solution, the device further includes: a password verification unit 507, configured to acquire a password input by the user, and determine whether the password input by the user is correct according to a password agreed in advance with the user; the verification information providing unit 505 inputs the user The verification information is provided to the target application when the password is correct.

Wherein, the pre-agreed password with the user refers to a password agreed between the security application and the user.

Preferably, in another solution, the application refers to a security application; the key negotiation unit 501 is specifically configured to: negotiate, by using the security application, a key for verifying information with a network device; The device further includes: a verification information display unit 508, configured to display the decrypted verification information to the user by using the security application.

Optionally, the device further includes: a password verification unit 507, configured to acquire a password input by the user, determine whether the password input by the user is correct according to a password agreed with the user in advance; the verification information display unit 508, the password input by the user The verification information is presented to the user when correct.

Wherein, the pre-agreed password with the user refers to a password agreed between the security application and the user.

The target application includes instant messaging software, payment software, or e-commerce software.

The network device refers to a server, a gateway, or a proxy server that sends authentication information.

The network device learns that the terminal supports cipher text verification information by using a negotiation parameter about the terminal verification information that is obtained in advance.

The key refers to a symmetric key, and the network device encrypts and decrypts the verification information by using the same key with the application; or the key refers to an asymmetric key, and the network The device encrypts the authentication information using a public key that decrypts the encrypted authentication information using the private key.

The terminal obtains the encrypted verification information from the network device by using a short message, a mail, or an instant messaging tool.

Preferably, the device further includes: a rights access unit 509, configured to support the application to directly access the communication mode to obtain the encrypted verification information by using a right that the user has access to the communication mode.

It should be noted:

The algorithms and displays provided herein are not inherently related to any particular computer, virtual device, or other device. Various general purpose devices can also be used with the teaching based on the teachings herein. The structure required to construct such a device is apparent from the above description. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, the various features of the invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the means for implementing authentication information acquisition in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, FIG. 6 shows a terminal, such as a smart terminal, that can implement an acquisition method of authentication information according to the present invention. The terminal conventionally includes a processor 610 and a computer program product or computer readable medium in the form of a memory 620. The memory 620 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Memory 620 has a memory space 630 for program code 631 for performing any of the method steps described above. For example, storage space 630 for program code may include various program code 631 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG. The storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 620 in the terminal of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 631', code that can be read by a processor, such as 610, which when executed by the terminal causes the terminal to perform various steps in the methods described above.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims (42)

A method for obtaining verification information, comprising: The terminal negotiates, with the network device, a key for encrypting and decrypting the verification information, where the verification information is a message for verifying the identity or authority of the terminal or the user in the specific service process performed by the target application; The network device encrypts the verification information by using the key, and sends the encrypted verification information to the terminal; The terminal decrypts the encrypted verification information by using the negotiated key to obtain verification information; The verification information is used to verify the identity or authority of the terminal or the user during the execution of the specific service by the target application. The method according to claim 1, wherein said key application for verifying information negotiated with said network device and said verification of encryption using said negotiated key pair is performed by said target application on said terminal The step of decrypting the information. The method of claim 1, wherein the security application on the terminal performs a negotiation of a key for verifying information with the network device and decrypting the encrypted verification information using the negotiated key step; The key used by the terminal to negotiate with the network device for verifying information includes: The security application negotiates a key for verifying information with the network device; After the terminal decrypts the encrypted verification information by using the negotiated key to obtain the verification information, the method further includes: The security application provides the verification information to the target application. The method of claim 3 wherein said target application invokes an interface provided by said secure application to retrieve said verification information from said secure application. The method of claim 3, wherein the method further comprises: The security application verifies the legitimacy of the target application, and the verification information is provided to the target application only when the target application is legitimate. The method of claim 5 wherein the security application verifies the legitimacy of the target application comprises: Determining whether the target application is legitimate by the signature of the target application, and/or determining whether the target application has the right to read the verification information. The method of claim 6, wherein the determining whether the target application is legitimate comprises: Determining, according to the signature of the target application, whether the target application belongs to a secure application Or determining, according to the signature of the target application, whether the target application belongs to a malicious application, and if the target application belongs to a security application or does not belong to a malicious security program, determining that the target application is legal. The method according to claim 6, wherein the determining whether the target application has the right to read the verification information comprises: Determining whether the target application is an application corresponding to the network device providing the verification information, and if so, determining that the target application has the right to read the verification information. The method according to claim 8, wherein the determining whether the target application is an application corresponding to the network device providing the verification information comprises: Determining whether the identifier carried in the verification information corresponds to a network device that provides the verification information. The method of claim 3, wherein before the security application provides the verification information to the target application, the method further comprises: Obtain the password input by the user, and determine whether the password input by the user is correct according to the password agreed with the user in advance; The security application provides the verification information to the target application when the password entered by the user is correct. The method of claim 10 wherein said pre-agreed password with the user is a password agreed between the secure application and the user. The method of claim 1, wherein the security application on the terminal performs a negotiation of a key for verifying information with the network device and decrypting the encrypted verification information using the negotiated key step; The key used by the terminal to negotiate with the network device for verifying information includes: The security application negotiates a key for verifying information with the network device; After the terminal decrypts the encrypted verification information by using the negotiated key to obtain the verification information, the method further includes: The security application presents the decrypted verification information to the user. The method of claim 12, wherein before the security application presents the decrypted verification information to the user, the method further comprises: Obtain the password input by the user, and determine whether the password input by the user is correct according to the password agreed with the user in advance; The security application presents the verification information to the user when the password entered by the user is correct. The method of claim 13 wherein said pre-agreed password with the user is a password agreed between the secure application and the user. The method according to claim 1, wherein before the network device encrypts the verification information by using the key, the method further includes: The network device learns that the terminal supports cipher text verification information by using a negotiation parameter about the terminal verification information that is obtained in advance. The method of claim 1 wherein The key refers to a symmetric key, and the network device encrypts and decrypts the verification information by using the same key with the terminal; or The key refers to an asymmetric key, the network device encrypts the authentication information using a public key, and the terminal decrypts the encrypted verification information using the private key. The method according to claim 1, wherein said terminal acquires said encrypted verification information from said network device by means of a short message, a mail or an instant communication means. The method according to claim 17, wherein after the terminal obtains the encrypted verification information from the network device, the method further includes: The target application or the security application directly accesses the communication method to obtain the encrypted verification information by using the permission that the user has access to the communication mode. The method of claims 1-18, wherein the target application comprises instant messaging software, payment software, or e-commerce software. The method according to any one of claims 1 to 18, wherein the network device refers to a server, a gateway or a proxy server that transmits the verification information. An apparatus for acquiring verification information, comprising: a key negotiation unit, configured to negotiate, between the terminal and the network device, a key for encrypting and decrypting the verification information, where the verification information is used to verify the terminal or the user in the process of executing the specific service in the target application Message of identity or authority; An encryption verification information obtaining unit, configured to receive verification information that the network device encrypts the verification information by using the key; a decryption unit, configured to decrypt the encrypted verification information by using the negotiated key to obtain verification information; And a service execution unit, configured to use the verification information to verify the identity or authority of the terminal or the user during the execution of the specific service process by the target application. The apparatus according to claim 21, wherein said key application negotiates a key for verifying information with the network device and said decrypted authentication information is decrypted by said negotiated key. The apparatus according to claim 21, wherein a key for authenticating information negotiated with the network device and said key pair encrypted using said negotiation is performed by a security application on said terminal Verify the information for decryption; The key negotiation unit is specifically configured to: negotiate, by using the security application, a key for verifying information with a network device; The device also includes: a verification information providing unit for providing the verification information to the target application by using the security application. The apparatus of claim 23, wherein the target application invokes an interface provided by the secure application to obtain the verification information from the secure application. The device of claim 23, wherein the device further comprises: a target legality verification unit, configured to verify validity of the target application by using the security application; The verification information providing unit provides the verification information to the target application only when the target application is legal. The device according to claim 25, wherein the target legality verification unit is specifically configured to: determine whether the target application is legal by a signature of the target application, and/or determine the target application Whether the program has permission to read the verification information. The device according to claim 26, wherein the target legality verification unit is specifically configured to: determine, according to a signature of the target application, whether the target application belongs to a security application, or according to the target The signature of the application determines whether the target application belongs to a malicious application, and if the target application belongs to a security application or does not belong to a malicious security program, determines that the target application is legitimate. The device according to claim 26, wherein the target validity verification unit is specifically configured to: determine whether the target application is an application corresponding to a network device that provides the verification information, and if so, Determining that the target application has permission to read the verification information. The device according to claim 28, wherein the target validity verification unit is specifically configured to: determine whether the identifier carried by the verification information corresponds to a network device that provides the verification information. The device of claim 23, further comprising: The password verification unit is configured to obtain a password input by the user, and determine whether the password input by the user is correct according to the password agreed with the user in advance; The verification information providing unit provides the verification information to the target application when the password input by the user is correct. The apparatus according to claim 30, wherein said pre-agreed password with the user is a password agreed between the secure application and the user. The apparatus according to claim 21, wherein the security application on the terminal performs a negotiation of a key for verifying information with the network device and decrypting the encrypted verification information by using the negotiated key; The key negotiation unit is specifically configured to: negotiate, by using the security application, a key for verifying information with a network device; The device further includes: a verification information display unit, configured to display the decrypted verification information to the user by using the security application. The device of claim 32, wherein the device further comprises: The password verification unit is configured to obtain a password input by the user, and determine whether the password input by the user is correct according to the password agreed with the user in advance; The verification information display unit displays the verification information to the user when the password input by the user is correct. The apparatus according to claim 33, wherein said pre-agreed password with the user is a password agreed between the secure application and the user. The device according to claim 21, wherein the network device learns that the terminal supports ciphertext verification information by using a negotiation parameter about the terminal verification information obtained in advance. The device of claim 21, wherein The key refers to a symmetric key, and the network device encrypts and decrypts the verification information by using the same key with the application; or The key refers to an asymmetric key, the network device encrypts the authentication information using a public key, and the application decrypts the encrypted authentication information using the private key. The apparatus according to claim 21, wherein said terminal acquires said encrypted verification information from said network device by means of a short message, a mail or a communication means of an instant communication means. The device according to claim 37, wherein the device further comprises: a rights access unit, configured to support the application to directly access the communication mode acquisition center by using a right that has access to the communication mode Describe the encrypted verification information. The apparatus according to claims 21-38, wherein said target application comprises instant messaging software, payment software or e-commerce software. The apparatus according to any one of claims 21 to 38, wherein the network device is a server, a gateway or a proxy server that transmits the verification information. A computer program comprising computer readable code that, when executed on a terminal, causes the terminal to perform the method of any of claims 1-20. A computer readable medium storing the computer program of claim 41.

Images