Disclosure of Invention
The invention provides a method and a system for authenticating and authorizing user information, which are used for realizing the safe login of a user information system.
In one aspect, the present invention provides an authentication and authorization method for user information, where the authentication and authorization method includes:
the mobile equipment detects a wireless communication signal sent by the authentication equipment;
when the mobile device detects the wireless communication signal, acquiring first identification information from the authentication device;
the mobile equipment sends an authorization request to a server according to the first identification information;
the server carries out identity authentication on the mobile equipment according to the authorization request;
when the identity verification passes, the server sends an authorization response message to the authentication equipment;
and the authentication device authenticates the mobile device according to the authorization response message.
Preferably, before the first identification information is acquired from the authentication device, the authentication authorization method further includes: and the server sends preset first identification information to the authentication equipment.
Preferably, the authorization request includes first identification information and first user information stored within the mobile device; the server comprises a plurality of preset user information; the server, according to the authorization request, specifically performing identity authentication on the mobile device as follows:
matching the first user information with a plurality of preset user information respectively;
when the first user information is successfully matched with any preset user information, the server verifies the first identification information;
and when the first identification information passes the verification, the server passes the identity verification of the mobile equipment.
Preferably, the authentication authorization method further includes, when the identity authentication is not passed, the server sending a denial message to the authentication device.
Preferably, when the wireless communication signal detected by the mobile device satisfies a preset condition, the acquiring first identification information from the authentication device specifically includes:
when the mobile equipment detects the wireless communication signal, the mobile equipment is connected with the authentication equipment according to the signal intensity of the wireless communication signal;
the mobile device obtains the distance between the mobile device and the authentication device or the moving direction of the mobile device relative to the authentication device through a wireless communication mode, and when the distance and the moving direction meet preset conditions, the mobile device acquires the first identification information from the authentication device.
Preferably, before the sending the authorization request to the server, the authentication and authorization method further includes: the mobile equipment is in wireless connection with user equipment;
wherein the user equipment is bound with the mobile equipment in advance;
the user equipment includes: identity document, bank card, entrance guard card.
Preferably, after acquiring the first identification information from the authentication device, the method further includes: the mobile equipment sends an acquisition request to the user equipment, and acquires second user information stored in the user equipment, so that the second user information and the first identification information are carried by the mobile equipment in the authorization request.
Preferably, the wireless communication signal comprises: wireless bluetooth communication signals, wireless near field communication signals; when the mobile device detects the wireless communication signal, the acquiring of the first identification information from the authentication device specifically includes:
and the mobile equipment acquires the first identification information from the authentication equipment in a wireless Bluetooth communication mode or a wireless near field communication mode.
Preferably, when the authentication is passed, the method further comprises:
and the server sends prompt information of successful authorization to the mobile equipment.
In another aspect, the present invention provides an authentication and authorization system for user information, the authentication and authorization system comprising: a mobile device, an authentication device, and a server;
the mobile device is used for detecting a wireless communication signal sent by the authentication device;
the mobile device is further configured to, upon detecting the wireless communication signal, obtain first identification information from the authentication device;
the mobile device is used for sending an authorization request to a server according to the first identification information;
the server is used for carrying out identity authentication on the mobile equipment according to the authorization request;
the server is also used for sending an authorization response message to the authentication equipment when the identity verification is passed;
the authentication device is further configured to authenticate the mobile device based on the authorization response message.
Preferably, the server is further configured to send preset first identification information to the authentication device.
Preferably, the authorization request includes first identification information and first user information stored within the mobile device; the server comprises a plurality of preset user information; the server is specifically configured to:
matching the first user information with a plurality of preset user information respectively;
when the first user information is successfully matched with any preset user information, the server verifies the first identification information;
and when the first identification information passes the verification, the server passes the identity verification of the mobile equipment.
Preferably, the server is further configured to send a denial message to the authentication device when the authentication fails.
Preferably, the mobile device is specifically adapted to,
when the mobile equipment detects the wireless communication signal, the mobile equipment is connected with the authentication equipment according to the signal intensity of the wireless communication signal;
the mobile device obtains the distance between the mobile device and the authentication device or the moving direction of the mobile device relative to the authentication device through a wireless communication mode, and when the distance and the moving direction meet preset conditions, the mobile device acquires the first identification information from the authentication device.
Preferably, the authentication and authorization system further comprises user equipment; the mobile device is further configured to wirelessly connect with the user equipment;
wherein the user equipment is bound with the mobile equipment in advance;
the user equipment includes: identity document, bank card, entrance guard card.
Preferably, after the first identification information is acquired from the authentication device, the mobile device is further configured to send an acquisition request to the user equipment, and acquire second user information stored in the user equipment, so that the second user information and the first identification information are carried by the mobile device in the authorization request.
Preferably, the wireless communication signal comprises: wireless bluetooth communication signals, wireless near field communication signals; the mobile device is specifically configured to acquire the first identification information from the authentication device in a wireless bluetooth communication manner or a wireless near field communication manner.
Preferably, the server is further configured to send a prompt message indicating that the authorization is successful to the mobile device when the authentication is passed.
Therefore, according to the authentication and authorization method and system for the user information provided by the invention, the first identifier is encrypted, the mobile device reads the second user information stored in the user device by adopting off-line communication, and the security and the convenience of the authentication and authorization of the user information are improved by the authentication and authorization of the first identifier.
Detailed Description
The technical solution of the present invention is further described in detail by the accompanying drawings and embodiments.
Example one
Fig. 1 is a flowchart of an authentication and authorization method for user information according to an embodiment of the present invention.
As shown in fig. 1, an authentication and authorization method for a user according to an embodiment of the present invention includes the following steps:
in step 101, the mobile device detects a wireless communication signal sent by the authentication device.
In particular, the mobile device may include a mobile phone, a tablet computer, and the like; the authentication device can comprise an information authorization control terminal such as a card reader; the wireless communication signal may be a wireless bluetooth communication signal, a wireless near field communication signal, or other wireless communication signal.
When the mobile device detects that the signal strength of the wireless communication signal meets a preset condition, the mobile device can sense the authentication device.
In a specific embodiment, after the mobile device enters the area served by the authentication device and detects the wireless bluetooth communication signal or the wireless near field communication signal sent by the authentication device, the authentication device is induced through a corresponding wireless bluetooth communication mode, a wireless near field communication mode or other wireless communication modes.
Step 102, when the authentication device is detected, obtaining first identification information from the authentication device.
Specifically, after the mobile device detects a wireless communication signal, wirelessly connecting with the authentication device according to the signal strength of the wireless communication signal; when the mobile equipment obtains the distance between the mobile equipment and the authentication equipment, the moving direction of the mobile equipment relative to the authentication equipment or other conditions in a wireless communication mode and meets a preset condition threshold, the mobile equipment obtains first identification information from the authentication equipment. The first identification information is unique identification information preset in the server and corresponding to the device, and the first identification information may be an authentication serial number or authentication password information such as two-dimensional code information.
A server monitors a plurality of authentication devices, presets a plurality of unique identification information, and respectively sends the identification information to the authentication devices.
The mobile device obtains the signal strength of the wireless communication signal, the position information of the mobile device and the authentication device, or the direction information between the mobile device and the authentication device through a specific positioning technology. For example, the mobile device may perform Positioning through a Global Positioning System (GPS) by using a General Packet Radio Service (GPRS) technology, or obtain location information of the mobile device and the authentication device by using another Positioning System, and obtain corresponding distance information according to the location information.
The mobile equipment can also judge the moving direction of the mobile equipment according to the distance between the mobile equipment and the authentication equipment, and when the mobile equipment moves along the direction close to the authentication equipment and meets the preset direction condition, the mobile equipment acquires first identification information from the authentication equipment; when the mobile device moves in the direction of the principle authentication device, then the mobile device does not acquire the first authentication information from the authentication device.
The threshold satisfying the preset condition may specifically be: the distance between the mobile device and the authentication device is smaller than a preset distance threshold; or the signal intensity of the mobile equipment and the authentication equipment is greater than a preset signal intensity threshold value; or the mobile device is in the same direction as the authentication device.
And 105, the mobile device sends an authorization request to a server according to the first identification information.
Specifically, the authorization request includes first identification information and first user information; the mobile equipment is provided with an application software customer service end; the first user information is specifically user information stored in the application software customer service end, wherein the first user information can be specifically information such as a user name for logging in the application software customer service end; after the mobile equipment acquires the first identification information from the authentication equipment, the mobile equipment sends the first identification information and the first user information to a server.
After the server receives the authorization request, the server performs authentication on the mobile device according to the authorization request, and the authentication process may specifically include step 106 and step 107.
And 106, respectively matching the first user information with the preset user information.
Specifically, the server includes a plurality of preset user information, that is, before the server receives an authorization request sent by the mobile device, the server authorizes a plurality of application service clients and stores the user information of the plurality of application service clients. Then, the server matches the first user information and the plurality of stored user information respectively according to the authorization request.
And 107, when the first user information is successfully matched with any stored user information, the server performs identity verification on the first identification information.
Specifically, first identification information carried in authorization request information received by a server is verified, whether the first identification information is preset first identification information of the server is determined, and when the first identification information is the preset first identification information of the server, the identity verification of the first identification information is passed, and the identity verification of the mobile device by the server is passed. The first identification information is verified to prevent the authorization request from being tampered when the mobile device sends the authorization request to the server in a wired mode. When the authentication is passed, step 109 is performed.
Step 109, when the identity verification passes, the server sends an authorization response message to the authentication device.
Specifically, when the server passes the authentication of the mobile device, the server sends an authorization response message to the authentication device, and informs the authentication device to execute authentication authorization.
And step 111, the authentication device authenticates and authorizes the mobile device according to the authorization response message.
Specifically, after receiving an authorization response message sent by the server, the authentication device executes authentication authorization according to the authorization response message.
Besides, the authentication and authorization method further comprises the following steps: and when the identity authentication is passed, the server sends a prompt message of successful authorization to the mobile equipment.
After step 105, the authentication and authorization method further includes:
step 108, the server rejects the authorization request when the first user information is unsuccessfully matched with any stored user information.
Specifically, when the first user information is unsuccessfully matched with any stored user information, the server refuses an authorization request sent by the mobile equipment; the server sends authorization failure information to the authentication equipment; the server can also send authorization failure information to the mobile device to prompt the user to verify that authorization fails.
After step 106, the authentication and authorization method further includes:
and step 110, when the identity authentication is not passed, the server refuses the authorization request.
Specifically, when the identity authentication fails, the server rejects the authorization request sent by the mobile device; the server sends authorization failure information to the authentication equipment; the server can also send authorization failure information to the mobile device to prompt the user to verify that authorization fails.
Optionally, after step 102, the authentication and authorization method may further include:
and 103, the mobile equipment is in wireless connection with the user equipment.
Specifically, after the mobile device receives the first identification information, a wireless connection with the user device is initiated.
The user equipment is a safety device bound with the mobile equipment in advance; the user equipment includes: identity document, bank card, entrance guard card.
And 104, the mobile equipment sends an acquisition request to the user equipment to acquire second user information stored in the user equipment.
Specifically, after the wireless connection is successful, the mobile device sends an acquisition request to the user equipment. The user device may include second user information, and the second user information may include authentication information such as a real name and biometric features of the user.
The authorization request information may include first user information, second user information, and the first identification information.
The authorization request information may include only the second user information and the first identification information.
In a specific embodiment, the authorization request information includes second user information and first identification information, an authorization request sent by the mobile device is received at the server, and authentication is performed according to the received authorization request: the server matches the second user information according to a plurality of pre-stored second user information; when the second user information is successfully matched with any user information prestored in the server, the first identification information is subjected to identity verification; after the verification is passed, the server sends an authorization response message to the authentication device; and the authentication device authenticates and authorizes the mobile device according to the received authorization response message.
In another specific embodiment, when the authorization request includes first user information, second user information and the first identification information, the server may sequentially verify the first user information and the second user information when performing authentication according to the authorization request, and perform authentication of the first identification information when both authentication passes; the second user information and the first identification information can also be used for verification to authenticate and authorize the mobile phone device.
In other embodiments, when the authorization request information includes the first user information, the second user information and the first identification information, the server may perform authentication only on the second user information and the first identification information; the server can also perform identity authentication on the first user information and the first identification information, and the user can set identity authentication conditions according to corresponding security requirements.
Therefore, according to the authentication and authorization method for the user information provided by the invention, the mobile device reads the second user information stored in the user device by adopting off-line communication, and the security and the convenience of the authentication and authorization of the user information are improved by the authentication and authorization of the first identifier.
Example two
The embodiment of the invention provides an authentication and authorization system of user information, which is used for realizing the method provided by the embodiment of the invention, and the authentication and authorization system comprises the following components: mobile device 201 authenticates device 202, and server 203.
The mobile device 201 is configured to detect the authentication device 302 through an application service client stored in the mobile device.
The mobile device 201 is further configured to obtain first identification information from the authentication device 202 when the authentication device 201 is detected.
The mobile device 201 is configured to send an authorization request to the server 303 according to the first identification information.
The server 203 is configured to authenticate the mobile device 201 according to the authorization request.
The server 203 is further configured to send an authorization response message to the authentication device 202 when the identity verification is passed.
The authentication device 202 is further configured to authenticate the mobile device 201 based on the authorization response message.
The server is further configured to send preset first identification information to the authentication device 202.
Wherein the authorization request includes first identification information and first user information stored in the mobile device 201; the server 203 comprises a plurality of preset user information; the server 203 is specifically configured to:
and respectively matching the first user information with the preset user information.
And when the first user information is successfully matched with any preset user information, the server 203 verifies the first identification information.
When the first identification information is verified, the server verifies the identity of the mobile device 201.
The server 203 is further configured to send a denial message to the authentication device 202 when the authentication fails.
The mobile device 201 senses the strength of the wireless communication signal sent by the authentication device 202 through an application service client stored in the mobile device; the wireless communication signal comprises a wireless Bluetooth communication signal, a wireless near field communication signal and other wireless communication signals. The mobile device 201 is specifically configured to, when the mobile device 301 detects that the signal strength of the wireless communication signal, the distance between the mobile device 201 and the authentication device 202, and the direction between the mobile device 201 and the authentication device or other conditions meet preset conditions, detect the authentication device 202 by the mobile device 201.
In a preferred embodiment, the authentication and authorization system further comprises a user device 304; the mobile device 201 is further configured to wirelessly connect with the user equipment 204.
Wherein the user equipment 204 is bound with the mobile equipment 201 in advance; the user equipment includes: identity document, bank card, entrance guard card.
The user equipment 204 may include second user information, and the mobile device 201 is further configured to send an acquisition request to the user equipment 204, and acquire the second user information stored in the user equipment 201, so that the mobile device 201 carries the second user information and the first identification information in the authorization request. Wherein the second user information may include real identity information such as a name, a biological characteristic and the like of the user.
The mobile device 201 is specifically configured to obtain the first identification information from the mobile device 202 in a wireless bluetooth communication mode, a wireless near field communication mode, or another wireless communication mode.
Optionally, the server 203 is further configured to send a prompt message indicating that the authorization is successful to the mobile device 201 when the authentication is passed. Therefore, according to the authentication and authorization system for the user information, provided by the invention, the server authorizes the first identification information, the mobile device reads the second user information stored in the user equipment by adopting off-line communication, and the server pre-stores the first identification information to perform authentication and authorization, so that the security and the convenience of the authentication and authorization of the user information are improved.
In order to better understand the technical solution of the present invention, the method and system provided by the above embodiments of the present invention are illustrated below by a specific example.
EXAMPLE III
In this example, the authentication device is an access card reader; the mobile equipment is a mobile phone; an Application (APP) software client installed in the mobile phone is an entrance guard APP client; the user equipment is an identity document. When a user carries a mobile phone provided with an entrance guard APP customer service end and prepares to enter a cell provided with an entrance guard, the mobile phone communicates with an entrance guard card reader in a wireless Bluetooth communication mode; when the information of an entrance guard APP customer service side installed in the mobile phone detects a wireless Bluetooth signal transmitted by a nearby entrance guard card reader, the mobile phone detects and acquires the signal intensity of the wireless Bluetooth signal; and comparing and judging the acquired wireless Bluetooth signal intensity with a preset signal intensity threshold value in the mobile phone, and when the signal intensity of the wireless Bluetooth signal detected by the mobile phone exceeds a preset condition threshold value, acquiring authentication password information from an entrance guard card reader by the mobile phone in a wireless Bluetooth communication mode, wherein the first identification information can be an authentication serial number or authentication password information such as two-dimensional code information.
Then, the mobile phone acquires the biological characteristic information of the user from the identity document in other off-line communication modes such as a wireless Bluetooth communication mode or a wireless near field communication mode; then, the mobile phone generates authorization request information according to the user name information stored in the access control APP customer service terminal, the biological feature information of the user acquired from the identity document and the authentication password information acquired from the access control card reader, and sends the authorization request information to the background server in a wired communication mode, wherein the wired communication mode can include GPRS communication of the mobile phone.
After receiving an authorization request sent by a mobile phone, a background server carries out identity authorization according to first user name information, user biological characteristic information and authentication password information carried in the authorization request, when the user information carried in the authorization request information is matched with a plurality of user information pre-stored by the background server, when the user information carried in the authorization request is successfully matched with any user information pre-stored by a platform server, authentication password verification is carried out, when the background server verifies that the authentication password information is authentication password information distributed by the background server, the mobile phone is authorized, and information that the authentication authorization passes is sent to an access card reader; and after receiving the authentication and authorization passing information sent by the background server, the access control card reader controls external equipment of the access control according to the authentication and authorization notification information so that the user holding the mobile phone enters the cell. When the background server fails to perform identity authorization on the mobile phone, the background server sends authentication authorization failure information to the access control card reader, the user can be reminded of authentication authorization failure in other modes such as voice and the like, and the access control card reader controls access control external equipment to prevent a user held by the mobile phone from entering the cell.
Those of skill would further appreciate that the various illustrative components and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied in hardware, a software module executed by a processor, or a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.