WO2018099407A1 - Account authentication login method and device - Google Patents

Abstract

Provided are an account authentication login method and device. The method comprises: acquiring a client identifier of a terminal; according to the client identifier of the terminal, acquiring authentication status information of the client identifier from a mobile network with which the client identifier is registered; according to the authentication status information of the client identifier, determining whether to permit a current authentication login. The solution increases the efficiency of authentication login and increases the security of authentication login as well.

Description

Account authentication login method and device Technical field

The present application relates to the field of communications, and in particular, to an account authentication login method and apparatus.

Background technique

In the Internet age, websites, mailboxes, forums, applications, and many other aspects require user accounts and passwords to log in. In order to facilitate the safe management and use of accounts, various secure login methods have been developed. For example, some use encrypted data to help users record account information, and some use unified public third-party interfaces to enable users to use. A user name and password are used to log in to multiple websites or applications, or to log in by various methods such as mobile phone number and SMS verification.

Account login technology currently has the following major categories:

1. Log in directly by username and password.

2. Bind the authentication association through a third-party login system, such as WeChat, QQ, goole account or Apple id.

3. Bind the mobile phone number and mobile phone to log in through the mobile phone number and the internal feature code of the mobile phone (which can be the MAC address of the mobile phone, or a random serial number sent to the mobile phone or other specific information).

4. Through the mobile phone number, the server sends the SMS verification code, and the user inputs the verification code to log in.

Based on the above various login methods existing in the related art, the user needs to manually input the user name or password, and the third-party authentication requires a third-party account to be used, and the login by the SMS verification code also requires the user to input the mobile phone number and the SMS verification code. Even if security can obtain basic guarantees, but the user operation is more responsible, resulting in poor usability of these methods, affecting the user experience, and it is difficult to directly use the phone number and the internal feature code of the terminal to log in. Guarantee if you lose your hand Opportunities cause large losses.

Summary of the invention

The embodiment of the invention provides an account authentication login method and device, which are used to solve the problem that the authentication login method is complicated in the related art.

According to an embodiment of the present invention, an account authentication login method is provided, including: acquiring a customer identification identifier of a terminal; and acquiring, by the customer identification identifier of the terminal, the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier; And determining whether the current authentication login is passed according to the authentication status information of the customer identification identifier.

Optionally, the customer identification identifier comprises: a global subscriber identity card USIM number or a customer identification module SIM number.

Optionally, the method further includes: after obtaining the customer identification identifier of the terminal and authenticating the mobile identification network of the terminal to the mobile network registered by the terminal, the authentication status information of the customer identification identifier is saved, where the authentication status information includes: The identification identifier is authenticated by the mobile network or the customer identification identifier does not pass the authentication of the mobile network; determining whether the current authentication login is passed according to the authentication status information of the customer identification identifier, including: registering with the customer identification identifier according to the customer identification identifier of the terminal After the mobile network obtains the authentication status information of the customer identification identifier, if the authentication status information of the customer identification identifier indicates that the customer identification identifier has passed the authentication of the mobile network, it is determined that the current authentication login is passed, and if the authentication status information of the customer identification identifier indicates the customer identification identifier If the authentication of the mobile network is not passed, it is determined that the current authentication login has not passed.

Optionally, the method further includes: saving the authentication status information of the customer identification identifier to the authentication status record server before acquiring the client identification identifier of the terminal and authenticating the mobile network registered by the terminal with the client identification identifier of the terminal. ; identify the customer according to the customer identification of the terminal Obtaining the authentication status information of the customer identification identifier by the registered mobile network, including: sending the customer identification identifier to the authentication status record server on the mobile network side, and receiving the authentication status information of the customer identification identifier sent by the authentication status record server.

Optionally, obtaining the customer identification identifier of the terminal includes: receiving the externally input customer identification identifier, or directly acquiring the pre-stored customer identification identifier.

Optionally, obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal, including: encrypting the terminal identification identifier of the terminal and transmitting the identifier to the mobile network; and receiving the encrypted transmission sent by the mobile network. The authentication status information of the customer identification identifier; decrypting the authentication status information of the encrypted customer identification identifier to obtain the authentication status information of the decrypted customer identification identifier.

According to another embodiment of the present invention, an account authentication and registration device is provided, including: a first obtaining module, configured to acquire a customer identification identifier of the terminal; and a second obtaining module configured to identify the customer according to the customer identification identifier of the terminal Identifying the authentication status information of the registered mobile network to obtain the customer identification identifier; and the authentication module, configured to determine whether the current authentication login is passed according to the authentication status information of the customer identification identifier.

Optionally, the customer identification identifier comprises: a global subscriber identity card USIM number or a customer identification module SIM number.

Optionally, the foregoing apparatus further includes: a first saving module, configured to save the authentication status information of the customer identification identifier after acquiring the customer identification identifier of the terminal and authenticating the mobile identification network registered by the terminal with the customer identification identifier of the terminal The authentication status information includes: the customer identification identifier authenticates the authentication through the mobile network or the client identification identifier does not pass the authentication of the mobile network; the authentication module is configured to: obtain the customer identification from the mobile network registered according to the customer identification identifier of the terminal to the customer identification identifier. After the identified authentication status information, if the authentication status information of the customer identification indicator indicates that the customer identification number has been After the authentication by the mobile network, it is determined that the current authentication login is passed. If the authentication status information of the customer identification identifier indicates that the customer identification identifier has not passed the authentication of the mobile network, it is determined that the current authentication login fails.

Optionally, the foregoing apparatus further includes: a second saving module, configured to: after obtaining the customer identification identifier of the terminal and after authenticating the mobile network registered by the terminal with the customer identification identifier of the terminal, verifying the authentication status information of the customer identification identifier The second acquisition module is configured to: send the customer identification identifier to the authentication status record server on the mobile network side, and receive the authentication status information of the customer identification identifier sent by the authentication status record server.

Optionally, the first obtaining module is configured to: receive the externally input customer identification identifier, or directly obtain the pre-stored customer identification identifier.

Optionally, the second obtaining module includes: an encryption unit, configured to encrypt the client identification identifier of the terminal and send the information to the mobile network; and the receiving unit is configured to receive the authentication status information of the encrypted customer identification identifier sent by the mobile network; The decryption unit is configured to decrypt the authentication status information of the encrypted customer identification identifier, and obtain the authentication status information of the decrypted customer identification identifier.

According to still another embodiment of the present invention, an electronic device is provided. The electronic device includes at least one processor and a memory coupled to the at least one processor, the memory for storing instructions executable by the at least one processor, the instructions being executed by the at least one processor And causing the at least one processor to execute the account authentication login method in the above embodiment.

In accordance with still another embodiment of the present invention, a non-transitory storage medium storing computer executable instructions configured to perform the account authentication login method described above is provided.

According to still another embodiment of the present invention, a computer program product is provided, the computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program When the instructions are executed by the computer, causing the computer to perform the above Account authentication login method.

In the solution provided by the embodiment, the login of the third-party platform is performed by using the authentication result of the customer identification number by the mobile network, and the security of the authentication login is improved, and the security of the authentication login is also improved.

DRAWINGS

1 is a flowchart of an account authentication login method provided in a first embodiment of the present invention;

2 is a flowchart of an account authentication login method provided in a second embodiment of the present invention;

3 is a signaling flowchart of an account authentication login method provided in a third embodiment of the present invention;

4 is a structural block diagram of an account authentication and registration device provided in a fourth embodiment of the present invention.

detailed description

Before the USIM (Universal Subscriber Identity Module) card is used in the mobile network, the mobile phone needs to perform AKA (Authentication and Key Agreement) authentication and key agreement with the USIM card. After the authentication is passed, the USIM card can use the current network resources to perform data services or voice services. The inventor considers that since the above authentication process already exists, this process is reused in the authentication login process of the third party application or other port, thereby omitting the user's process of inputting the authentication password and the verification, and the authentication process is more secure.

The LTE network uses the USIM card, which has higher security requirements than the 2/3G SIM card. The 128 cryptographic algorithm used by the USIM is MILLENAGE. The algorithm is mature, difficult to crack, and through two-way authentication and chain. Layer layer encryption, only legitimate users can use the carrier's LTE network The network is sufficient to ensure the safety of the user. The method of the present invention is not limited to the USIM card, and is also applicable to the SIM (Subscriber Identification Module).

Since the authentication information (also called authentication information or authentication status information) of each USIM is unique and cannot be copied, the USIM authentication process (also called the authentication process) is performed between the USIM and the base station, and the user and the third party. The login platform does not participate in the process, and the process cannot be known. This ensures the security of the authentication information and at the same time guarantees the uniqueness of the authentication information.

As we all know, the mobile network is developing rapidly, LTE is widely used, and the security of the USIM card has been greatly improved. If the mobile phone number can be directly used as the user account, the mobile network authentication information is guaranteed, and the account is completed by the operator. The security legality verification eliminates the user's input of the authentication password or the SMS verification code for authentication, which not only facilitates the user's use, but also improves the security.

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings. The described embodiments are only a part of the embodiments of the invention, and not all of the embodiments.

First embodiment

This embodiment provides an account authentication login method, and FIG. 1 is a flowchart of the method. As shown in FIG. 1, the method includes steps 101 to 103.

At step 101: acquire a customer identification identifier of the terminal.

In this embodiment, the client identification identifier may specifically be a client identification number.

Optionally, in this embodiment, when the terminal determines to use the customer identification number as the user account for the authentication login, the terminal identifies the customer identification identifier. The customer identification identifier involved in this embodiment may refer to a USIM number or a SIM number.

Obtaining the customer identification identifier of the terminal may include: receiving the customer identification identifier of the external input (the user inputs through the authentication login page), or directly obtaining the customer identification identifier, specifically, the terminal may be obtained from the terminal The customer identification identifier is obtained in the middle or external storage space, such as a SIM card.

In step 102, the authentication status information of the customer identification identifier is obtained from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal.

The method provided in this embodiment saves the authentication status information of the customer identification identifier after the client identification identifier of the terminal is authenticated to the mobile network registered by the terminal, and the authentication status information may include: the authentication of the customer identification identifier through the mobile network or the identification of the client. The authentication status information of the customer identification identifier obtained in the step 102 is the authentication status information stored after the customer identification identifier is authenticated on the mobile network.

Optionally, in this embodiment, a dedicated server may be used to store the authentication status information of the customer identification identifier, so that the authentication status information obtained in this embodiment may be performed by the server. Based on this, in the embodiment, after the client identification identifier of the terminal is authenticated to the mobile network registered by the terminal, the authentication status information of the customer identification identifier is saved to the authentication status record server, and the client identifier and the client identifier are recorded. Corresponding relationship of the authentication status information corresponding to the customer identification identifier; when obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier, transmitting the customer identification identifier to the authentication status record server on the mobile network side, and receiving the authentication status The authentication status information of the customer identification identifier sent by the server is recorded.

In this embodiment, it is only necessary to add a user data server in the user storage authentication state at the base station end, that is, an authentication status record server, and the role of the server is to provide authentication information of the current client identification identifier encrypted by the relevant website or interface. It is possible to directly identify the secure login website or other interface through the customer identification, and the newly added server can be directly provided by the operator, so that the transmission of the authentication data (which may include the authentication information of the customer identification identifier) can be reduced. The node also reduces the risk of the authentication data being cracked.

Meanwhile, in this embodiment, in order to ensure the authentication status information of the user's customer identification identifier In the case of obtaining the authentication status information from the mobile network side, the authentication status information may be obtained by using the encryption method. The user may obtain the authentication status information of the customer identification identifier according to the customer identification identifier of the terminal. The client identification identifier of the terminal is encrypted and sent to the mobile network; the authentication status information of the encrypted customer identification identifier sent by the mobile network is received; the authentication status information of the encrypted customer identification identifier is decrypted, and the decrypted customer identification identifier is obtained. Authentication status information.

At step 103, it is determined whether the current authentication login is passed according to the authentication status information of the customer identification identifier.

After obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal, if the authentication status information of the customer identification identifier indicates that the customer identification identifier has passed the authentication of the mobile network, determining the current authentication login If the authentication status information of the customer identification identifier indicates that the customer identification identifier does not pass the authentication of the mobile network, it is determined that the current authentication login fails.

The solution provided in this embodiment can improve the efficiency of authentication login.

Second embodiment

This embodiment describes the entire process of performing authentication login for the account authentication login method.

The process includes steps 201 through 209.

In step 201, the terminal initiates a login application.

In step 202: the user confirms the selection to use the mobile phone number to directly authenticate the login through the terminal, if the user does not select the mobile phone number to log in directly, use other methods to log in, go to step 207;

In step 203, after the user selects to use the mobile phone number for authentication and login, the login interface obtains the mobile phone number or the user manually inputs the mobile phone number, and obtains the current network status information of the mobile phone, such as which network the mobile phone is registered to, which system, and the like;

At step 204: determining whether the current mobile phone is using the mobile phone number to register the carrier network, and Whether the mobile phone number is registered to the LTE, if the mobile phone number is not registered to the LTE, then the process goes to step 208, prompting the user to ask the user to register the current card with the LTE network;

In step 205: if the mobile phone number is registered to the LTE, the login interface is encrypted and connected to the authentication status record server, and the current USIM mobile phone number and other related information on the card (such as the service information in the SIM card, etc., need to be explained). Yes, the authentication status information of the mobile phone number only needs to have a SIM card number or a USIM card number. The related information is only auxiliary information, and the auxiliary information may be obtained without using the auxiliary information.

The authentication status record server decrypts the current mobile phone number and other related information on the USIM card, queries the authentication status record server to record information, encrypts the query result, and feeds back to the third-party interface.

The third-party interface obtains the encrypted authentication status information, and after decrypting the authentication status information, if the obtained decrypted information is “USIM card has not been authenticated”, the process proceeds to step 209 to log out.

In step 206, the third-party interface obtains the encrypted authentication information, and after decrypting the authentication status information, if the information is “the current mobile phone number is authenticated (or authenticated)”, the mobile phone number is directly used to log in successfully.

Third embodiment

The signaling flow chart of this embodiment is shown in FIG. 3, which illustrates the process of signaling interaction between each end in the account authentication login method provided by the present invention. As shown in FIG. 3, the process includes steps 301 to 312.

Step 301: The terminal accesses the eNodeB (evolved base station);

Step 302: The MME (Mobility Management Entity) performs authentication on the terminal.

Step 303: The MME sends an initialization content setting request to the terminal.

Step 304: The eNodeB sends a security mode command to the terminal.

Step 305: The terminal sends a command for completing the security mode setting to the eNodeB.

Step 306: The eNodeB sends a security mode failure command to the terminal.

Step 307: The eNodeB sends an initial content establishment response to the MME.

Step 308: The MME updates the authentication result to the AS (Application Server).

Step 309: The third-party interface applies for using the mobile phone number as the login account name;

Step 310: The third-party interface applies for the authentication status information of the mobile phone number to the AS in the encrypted signal by using the mobile phone number and the current status information of the mobile phone.

Step 311: The third-party interface receives the authentication status information sent by the AS.

Step 312: The third party interface permits the user to log in.

Fourth embodiment

This embodiment provides an account authentication login device, and FIG. 4 is a structural block diagram of the device. As shown in FIG. 4, the device 40 includes the following components:

The first obtaining module 41 is configured to acquire a customer identification identifier of the terminal.

The second obtaining module 42 is configured to obtain the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal.

The authentication module 43 is configured to determine whether the current authentication login is passed according to the authentication status information of the customer identification identifier.

The customer identification identifier may include: a global subscriber identity card USIM number or a customer identification module SIM number.

Optionally, the apparatus 40 provided in this embodiment may further include: a first saving module, configured to save the client after acquiring the client identification identifier of the terminal and authenticating the registered mobile network with the client identification identifier of the terminal Identifying the authentication status information of the identifier, the authentication status information includes: the customer identification identifier is authenticated by the mobile network or the client identification identifier is not authenticated by the mobile network; The certificate module is configured to: after obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal, if the authentication status information of the customer identification identifier indicates that the customer identification identifier has passed the authentication of the mobile network, Then, it is determined that the current authentication login is passed. If the authentication status information of the customer identification identifier indicates that the customer identification identifier does not pass the authentication of the mobile network, it is determined that the current authentication login fails.

Optionally, the apparatus 40 provided in this embodiment may further include: a second saving module, configured to: after acquiring the customer identification identifier of the terminal and authenticating the mobile network registered by the terminal with the customer identification identifier of the terminal, The authentication status information of the identification identifier is saved to the authentication status record server. The second acquisition module is configured to: send the customer identification identifier to the authentication status record server on the mobile network side, and receive the authentication status information of the customer identification identifier sent by the authentication status record server.

The first obtaining module 41 is configured to: receive the externally input customer identification identifier, or directly obtain the pre-stored customer identification identifier.

The second obtaining module 42 may specifically include: an encryption unit configured to encrypt the client identification identifier of the terminal and send the information to the mobile network; and the receiving unit is configured to receive the authentication status information of the encrypted customer identification identifier sent by the mobile network. The decryption unit is configured to decrypt the authentication status information of the encrypted customer identification identifier, and obtain the authentication status information of the decrypted customer identification identifier.

An embodiment of the present invention further provides an electronic device. The electronic device includes at least one processor and a memory coupled to the at least one processor, the memory for storing instructions executable by the at least one processor, the instructions being executed by the at least one processor And causing the at least one processor to execute the account authentication login method in the above embodiment.

The embodiment of the invention further provides a non-transitory storage medium storing computer executable instructions, and the computer executable instructions are configured to execute the account authentication login method described above.

An embodiment of the present invention further provides a computer program product, where the computer program product includes A computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to perform the account authentication login method described above.

While the embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will recognize that various modifications, additions and substitutions are possible. Therefore, the scope of the present invention should not be limited to the embodiments described above.

Claims (12)

An account authentication login method, including: Obtaining a customer identification identifier of the terminal; Acquiring, according to the customer identification identifier of the terminal, the authentication status information of the customer identification identifier to the mobile network registered by the customer identification identifier; Determining whether the current authentication login is passed according to the authentication status information of the customer identification identifier. The method of claim 1 wherein said customer identification identification comprises: Global Subscriber Identification Card USIM number or Customer Identification Module SIM number. The method of claim 1 further comprising: After obtaining the customer identification identifier of the terminal and authenticating the mobile network registered by the terminal with the customer identification identifier of the terminal, the authentication status information of the customer identification identifier is saved, where the authentication status information includes: The client identification identifies that the authentication through the mobile network or the client identification identifies that the authentication has not passed through the mobile network; Determining whether the current authentication login is passed according to the authentication status information of the customer identification identifier, including: After obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal, if the authentication status information of the customer identification identifier indicates that the customer identification identifier has passed The authentication of the mobile network determines that the current authentication login is passed. If the authentication status information of the customer identification identifier indicates that the customer identification identifier does not pass the authentication of the mobile network, it is determined that the current authentication login fails. The method of claim 1 further comprising: After obtaining the customer identification identifier of the terminal and authenticating the mobile network registered by the terminal with the customer identification identifier of the terminal, the authentication status information of the customer identification identifier is saved to the authentication status record server; The mobile network registered with the customer identification identifier according to the customer identification identifier of the terminal Obtaining the authentication status information of the customer identification identifier, including: Sending a customer identification identifier to the authentication status record server on the mobile network side, and receiving authentication status information of the customer identification identifier sent by the authentication status record server. The method of claim 1, wherein the obtaining the customer identification identifier of the terminal comprises: Receiving the customer identification identifier input externally, or directly acquiring the pre-stored customer identification identifier. The method according to any one of claims 1 to 5, wherein the obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal comprises: Encrypting the client identification identifier of the terminal to the mobile network; Receiving authentication status information of the encrypted customer identification identifier sent by the mobile network; Decrypting the encrypted authentication status information of the customer identification identifier to obtain the decrypted authentication status information of the customer identification identifier. An account authentication login device includes: a first obtaining module, configured to acquire a customer identification identifier of the terminal; The second obtaining module is configured to acquire, according to the customer identification identifier of the terminal, the authentication status information of the customer identification identifier to the mobile network registered by the customer identification identifier; The authentication module is configured to determine, according to the authentication status information of the customer identification identifier, whether the current authentication login is passed. The apparatus of claim 7, wherein the customer identification identifier comprises: Global Subscriber Identification Card USIM number or Customer Identification Module SIM number. The apparatus of claim 7 further comprising: a first saving module, configured to obtain the customer identification identifier of the terminal and to end the After the client identification identifier of the terminal is authenticated to the mobile network it registers, the authentication status information of the customer identification identifier is saved, and the authentication status information includes: the authentication of the customer identification identifier by the mobile network or the identification of the client Identifying authentication that does not pass the mobile network; the authentication module is set to: After obtaining the authentication status information of the customer identification identifier from the mobile network registered by the customer identification identifier according to the customer identification identifier of the terminal, if the authentication status information of the customer identification identifier indicates that the customer identification identifier has passed The authentication of the mobile network determines that the current authentication login is passed. If the authentication status information of the customer identification identifier indicates that the customer identification identifier does not pass the authentication of the mobile network, it is determined that the current authentication login fails. The apparatus of claim 7 further comprising: a second saving module, configured to save the authentication status information of the customer identification identifier to the authentication before acquiring the customer identification identifier of the terminal and authenticating the mobile network registered by the terminal with the customer identification identifier of the terminal Status record on the server; The second obtaining module is further configured to: Sending a customer identification identifier to the authentication status record server on the mobile network side, and receiving authentication status information of the customer identification identifier sent by the authentication status record server. The apparatus of claim 7, wherein the first acquisition module is configured to: Receiving the customer identification identifier input externally, or directly acquiring the pre-stored customer identification identifier. The device according to any one of claims 7 to 11, wherein the second acquisition module comprises: An encryption unit, configured to encrypt the client identification identifier of the terminal and send the identifier to the mobile network; a receiving unit, configured to receive authentication status information of the encrypted customer identification identifier sent by the mobile network; The decryption unit is configured to decrypt the authentication status information of the encrypted customer identification identifier, and obtain the decrypted authentication status information of the customer identification identifier.

Images