WO2022206349A1 - 一种信息验证的方法、相关装置、设备以及存储介质 - Google Patents

一种信息验证的方法、相关装置、设备以及存储介质 Download PDF

Info

Publication number
WO2022206349A1
WO2022206349A1 PCT/CN2022/080538 CN2022080538W WO2022206349A1 WO 2022206349 A1 WO2022206349 A1 WO 2022206349A1 CN 2022080538 W CN2022080538 W CN 2022080538W WO 2022206349 A1 WO2022206349 A1 WO 2022206349A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
key
ciphertext
verified
application
Prior art date
Application number
PCT/CN2022/080538
Other languages
English (en)
French (fr)
Inventor
王犇
王旭
曾祥楷
李俊浩
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to EP22778533.4A priority Critical patent/EP4216081A4/en
Publication of WO2022206349A1 publication Critical patent/WO2022206349A1/zh
Priority to US17/977,407 priority patent/US20230071847A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos

Definitions

  • the present application relates to the field of cloud security technology, and in particular, to information verification.
  • OAuth Open Authorization
  • the Open Authorization (OAuth) protocol provides a secure, open and simple standard for the authorization of user resources. Different from the previous authorization methods, OAuth authorization does not allow third parties to access the user's account information (for example, user name and password), that is, the third party can apply for authorization of the user's resources without using the user's account information. , therefore, the OAuth protocol is more secure.
  • a single-item hash calculation is performed on the password through the front-end program, for example, using Secure Hash Algorithm (SHA-1) or Secure Hash Algorithm 256 (Secure Hash Algorithm, SHA-256) ) to obtain the digest information of the password, and finally the back-end identity authorization service verifies the password according to the digest information of the password.
  • SHA-1 Secure Hash Algorithm
  • SHA-256 Secure Hash Algorithm 256
  • the front-end program needs to go through the server of the third-party application to send the password digest information to the identity of the back-end.
  • the server of the third-party application can indirectly obtain the user's account information and store the summary information of the password, which makes it difficult to guarantee the security of the information.
  • the embodiments of the present application provide an information verification method, a related device, a device, and a storage medium, which can log in to a server of a third-party application without exposing user privacy information to the third-party application, thereby improving the security of identity authentication. safety.
  • the present application provides a method for information verification, including:
  • key agreement data In response to the key agreement request sent by the terminal device, obtain key agreement data, wherein the key agreement request carries the identifier of the target user, and the key agreement data includes the public key and the first random number;
  • cipher text information wherein the information to be verified includes user information corresponding to the target user;
  • the second information digest is a stored information digest
  • An information verification result is sent to the terminal device, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • Another aspect of the present application provides a method for information verification, comprising:
  • the information to be verified for the target application is encrypted to obtain the ciphertext information to be verified, wherein the information to be verified includes the information of the target user.
  • Corresponding user information
  • the information verification result sent by the verification server is received, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • an information verification device comprising:
  • an obtaining module configured to obtain key agreement data in response to a key agreement request sent by the terminal device, wherein the key agreement request carries the identifier of the target user, and the key agreement data includes a public key and a first random number;
  • the sending module is used to send the key agreement data to the terminal device, so that the terminal device uses the second random number and the public key included in the key agreement data and the first random number to encrypt the information to be verified for the target application processing to obtain ciphertext information to be verified, wherein the information to be verified includes user information corresponding to the target user;
  • the receiving module is used to receive the ciphertext information to be verified sent by the terminal device;
  • a decryption module configured to decrypt the ciphertext information to be verified sent by the terminal device to obtain a first information digest
  • a verification module configured to perform matching processing on the first information digest and the second information digest to obtain an information verification result, wherein the second information digest is a stored information digest;
  • the sending module is further configured to send the information verification result to the terminal device, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • an information verification device comprising:
  • the sending module is configured to send a key agreement request to the verification server, so that the verification server obtains key agreement data in response to the key agreement request, wherein the key agreement request carries the identifier of the target user, and the key agreement data includes the public key and the first random number;
  • the receiving module is used to receive the key negotiation data sent by the verification server;
  • the encryption module is used for encrypting the information to be verified for the target application by using the second random number, the public key included in the key agreement data, and the first random number to obtain the ciphertext information to be verified, wherein the to-be-verified information is obtained.
  • the information includes user information corresponding to the target user;
  • the sending module is further configured to send the ciphertext information to be verified to the verification server, so that the verification server performs decryption processing on the ciphertext information to be verified, obtains the first information digest, and performs matching processing on the first information digest and the second information digest, get the information verification result;
  • the receiving module is further configured to receive the information verification result sent by the verification server, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • a server including: a memory, a processor, and a bus system;
  • the memory is used to store the program
  • the processor is used to execute the program in the memory, and the processor is used to execute the method provided by the above aspects according to the instructions in the program code;
  • the bus system is used to connect the memory and the processor so that the memory and the processor can communicate.
  • a terminal device including: a memory, a processor, and a bus system;
  • the memory is used to store the program
  • the processor is used to execute the program in the memory, and the processor is used to execute the method provided by the above aspects according to the instructions in the program code;
  • the bus system is used to connect the memory and the processor so that the memory and the processor can communicate.
  • Another aspect of the present application provides a computer-readable storage medium, in which instructions are stored, which, when executed on a computer, cause the computer to perform the methods of the above aspects.
  • Another aspect of the present application provides a computer program product or computer program, the computer program product or computer program comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the methods provided by the above aspects.
  • the embodiments of the present application have the following advantages:
  • a method for information verification is provided.
  • the verification server obtains key agreement data in response to a key agreement request sent by a terminal device.
  • the key agreement request carries the identifier of the target user, and the key agreement data includes: The public key and the first random number, and then the verification server sends the key agreement data to the terminal device, so that the terminal device uses the second random number and the public key and the first random number included in the key agreement data to
  • the to-be-verified information of the target application is encrypted to obtain the to-be-verified ciphertext information.
  • the verification server receives the to-be-verified ciphertext information sent by the terminal device, and then decrypts the to-be-verified ciphertext information sent by the terminal device to obtain the first ciphertext information to be verified. a summary of information. Therefore, the verification server can perform matching processing on the first information digest and the second information digest, obtain the information verification result, and send the information verification result to the terminal device, so that the terminal device can log in when the information verification result indicates that the verification is successful. to the application server of the target application.
  • the terminal device uses the random number and the public key issued by the verification server to encrypt the information to be verified to obtain the ciphertext information to be verified.
  • the application server Even if the application server obtains the ciphertext information to be verified, it cannot decipher the to-be-verified information. Only the verification server can obtain the to-be-verified information. Therefore, users can log in to the third-party application without exposing the user's private information to third-party applications.
  • the server of the third-party application improves the security of identity authentication.
  • Fig. 1 is an environmental schematic diagram of the information verification system in the embodiment of the application.
  • FIG. 2 is a schematic diagram of an application architecture of the information verification system in the embodiment of the application.
  • FIG. 3 is a schematic diagram of an embodiment of an information verification method in an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an overall flow of key negotiation in an embodiment of the application.
  • FIG. 7 is a schematic diagram of decrypting ciphertext information to be verified in an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an overall flow of information verification and token issuance in the embodiment of the application.
  • FIG. 10 is a schematic diagram of another embodiment of the information verification method in the embodiment of the present application.
  • FIG. 11 is a schematic diagram of generating ciphertext information to be verified in an embodiment of the application.
  • Fig. 12 is an overall schematic flow chart of the information verification method in the embodiment of the application.
  • FIG. 13 is a schematic diagram of an information verification device in an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a server in an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a terminal device in an embodiment of the present application.
  • the embodiments of the present application provide an information verification method, a related device, a device, and a storage medium, which can log in to a server of a third-party application without exposing user privacy information to the third-party application, thereby improving the security of identity authentication. safety.
  • the Open Authorization (OAuth) protocol is an open standard that allows users to authorize third-party applications to access information stored on another service provider without providing usernames and passwords to third-party mobile applications or sharing their data. All content. Many websites provide third-party login functions. For example, when an application (application, APP) or web page accesses some third-party applications, users are often required to log in to another cooperative platform (for example, social applications, etc.) for authorized login. .
  • third-party applications and identity authorization services can use the OAuth 2.0 protocol to connect.
  • OAuth 2.0 defines five authorization methods, namely authorization code mode (authorization code), simplified mode (implicit) , password mode (resource owner password credentials), client mode (client credentials) and extension mode (extension).
  • authorization code mode authorization code
  • simplified mode e.g., password mode
  • password mode e.g., password mode
  • client mode e.g., password mode
  • extension mode e.g., since the third-party application requires the user to enter the user name and password when using the
  • the present application provides an information verification method based on end-to-end encryption technology, which can be used to solve the problem of authorization and docking in password mode, and can also be used to solve the problem of information verification in other scenarios.
  • the information verification method provided in this application can be applied to the information verification system shown in FIG. 1 .
  • the information verification system includes a terminal device, a server, an encryption machine and a database.
  • a client is deployed on the terminal device, and the client specifically includes a client of a third-party application and an end-to-end client.
  • the server includes an application server of a third-party application and an authentication server.
  • the server involved in this application may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or may provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, Cloud servers for basic cloud computing services such as cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.
  • the terminal device may be a smart phone, a tablet computer, a notebook computer, a palmtop computer, a personal computer, a smart TV, a smart watch, etc., but is not limited thereto.
  • the terminal device and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in this application.
  • the number of servers and terminal devices is also not limited.
  • the terminal device When a user needs to log in to a third-party application, he can initiate a login request to the application server through the terminal device, input the information to be verified through the terminal device, and the terminal device uses the key negotiation data to encrypt the information to be verified, thereby generating the ciphertext to be verified. information.
  • the terminal device may send the ciphertext information to be verified to the application server of the third-party application, and the application server of the third-party application forwards the ciphertext information to be verified to the verification server.
  • the terminal device directly sends the ciphertext information to be verified to the verification server.
  • the verification server decrypts the ciphertext information to be verified by calling the encryption machine to obtain the first information digest of the information to be verified, and then calls the database to compare the first information digest and the stored information digest (for example, the second information digest) The comparison is performed to obtain the information verification result. Finally, the information verification result is sent to the terminal device to complete the identity verification process.
  • the execution process of the verification server can also be implemented by a cloud server, and the cloud server can implement authentication in terms of cloud security.
  • Cloud security refers to the general term for security software, hardware, users, institutions, and security cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through the abnormal monitoring of software behavior in the network by a large number of mesh clients, the latest information on Trojans and malicious programs in the Internet is obtained and sent. To the server for automatic analysis and processing, and then distribute the virus and Trojan solutions to each client.
  • Cloud computing security which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, and information transmission security , network attack protection, compliance audit, etc.
  • Cloudization of security infrastructure mainly to study how to use cloud computing to build and integrate security infrastructure resources, and optimize security protection mechanisms, including building ultra-large-scale security events and information through cloud computing technology.
  • the collection and processing platform realizes the collection and correlation analysis of massive information, and improves the ability to control security events and risk control of the entire network
  • Cloud security services mainly research various security services provided to users based on cloud computing platforms, such as Antivirus service, etc.
  • Cloud security is an important part of cloud technology.
  • Cloud technology refers to a kind of hosting that unifies hardware, software, network and other series of resources in a wide area network or a local area network to realize data computing, storage, processing and sharing. technology.
  • Cloud technology is based on the general term of network technology, information technology, integration technology, management platform technology, application technology, etc. applied in the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient.
  • Cloud computing technology will become an important support. Background services of technical network systems require a lot of computing and storage resources, such as video websites, picture websites and more portal websites. With the high development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the back-end system for logical processing. Data of different levels will be processed separately, and all kinds of industry data need to be strong. The system backing support can only be achieved through cloud computing.
  • FIG. 2 is a schematic diagram of an application architecture of the information verification system in the embodiment of the application.
  • third-party applications and End-to-end client client
  • the end-to-end client can be automatically launched, and the user fills in the information to be verified through the end-to-end client.
  • the definition of each application part in the information verification system will be introduced separately below.
  • Third-party applications applications such as web pages or clients, such as e-commerce platforms or game platforms.
  • Application server for third-party applications used to provide third-party application services, for example, a website server with login logic.
  • End-to-end client a program for third-party applications to call.
  • the end-to-end client can be a Java script (JavaScript, JS) program or a small Application (Applet).
  • the front end of a third-party application is an application, then for the Android system, the end-to-end client can be a Java Archive (JAR) package, and for the mobile operating system (iPhone operation system) developed by Apple , iOS), the end-to-end client can be a so dynamic library.
  • Identity authorization service pre-position used to provide the communication function of docking with third-party applications, responsible for the docking of the overall access layer, which is equivalent to a "gateway" function.
  • End-to-end encryption service It is used to realize the function of end-to-end encryption key negotiation and the ability to interface with the encryption machine.
  • the end-to-end encryption service is deployed on the verification server.
  • Authentication service used to provide identity authentication service, for example, to provide verification of correctness of user name and password, wherein the authentication service is deployed on the authentication server.
  • Authorization service a service used to provide token (token) full life cycle management, such as token issuance, token verification, and token invalidation verification, among which the authorization service is deployed on the verification server.
  • Encryption machine It refers to an encryption machine that meets the requirements of the State Cryptography Administration, and is used to provide basic capabilities such as encryption and decryption and key security storage capabilities, and can realize the management of the full life cycle of keys.
  • Database a server for data storage.
  • An embodiment of the information verification method in the embodiment of the present application includes:
  • the verification server obtains key agreement data in response to a key agreement request sent by a terminal device, wherein the key agreement request carries an identifier of a target user, and the key agreement data includes a public key and a first random number.
  • the public key and the first random number are generated by an encryption machine.
  • the end-to-end client when the target user starts the third-party application on the terminal device, the end-to-end client can be automatically launched, and thus the terminal device sends a key agreement request to the authentication server through the end-to-end client.
  • the key agreement request carries the identifier of the target user, and based on this, the authentication server can establish a communication session with the terminal device.
  • the verification server calls the encryption machine to generate the key agreement data required for this key negotiation, that is, the encryption machine generates the key agreement data and feeds it back to the verification server.
  • the key agreement data includes a public key (pubkey) and a first random number (random), and the first random number (random) may be a random number composed of American Standard Code for Information Interchange (ASCII). .
  • FIG. 4 is a schematic flowchart of the key negotiation process in the embodiment of the present application. As shown in the figure, specifically:
  • step A1 the user opens the third-party application, and initiates an authentication request to the application server of the third-party application through the third-party application (ie, client or web page, etc.).
  • the third-party application ie, client or web page, etc.
  • step A2 the application server of the third-party application, in response to the authentication request, sends a scheduling request to the third-party application, so that the third-party application responds to the scheduling request and invokes the end-to-end client.
  • step A3 the end-to-end client deployed on the terminal device initiates a key negotiation request to the application server of the third-party application, optionally, the end-to-end client deployed on the terminal device may also directly request the verification server Initiate a key negotiation request (in this optional manner, you can directly jump to step A5).
  • step A4 the application server of the third-party application transparently transmits the key negotiation request to the verification server, wherein the transparent transmission refers to only being responsible for transmitting the transmitted content from the source address to the destination address in the communication, but not for the service make any changes to the data content.
  • step A5 the verification server responds to the key agreement request and obtains key agreement data by invoking the encryption machine, wherein the key agreement data includes a public key (pubkey) and a first random number (random).
  • the key agreement data includes a public key (pubkey) and a first random number (random).
  • step A6 the verification server sends key negotiation data such as a public key (pubkey) and a first random number (random) to the application server of the third-party application.
  • key negotiation data such as a public key (pubkey) and a first random number (random)
  • step A7 the application server of the third-party application transparently transmits the key agreement data to the terminal device, wherein the key agreement data is received by the end-to-end client deployed on the terminal device.
  • step A8 the key agreement data is stored locally in the terminal device.
  • the verification server sends key agreement data to the terminal device, so that the terminal device uses the second random number, the public key included in the key agreement data, and the first random number to encrypt the information to be verified for the target application , to obtain the ciphertext information to be verified, wherein the information to be verified includes user information corresponding to the target user.
  • the second random number is generated by the terminal device.
  • the verification server sends key agreement data to the terminal device
  • the end-to-end client deployed on the terminal device uses the second random number (challenge) and the public key (pubkey) included in the key agreement data and
  • the first random number random
  • the second random number (challenge) may be a random number composed of ASCII.
  • the information to be verified includes the user information of the target user, such as username, User account number, user password, user mobile phone number, user email address, and user ID number, etc., are not limited here.
  • the ciphertext information to be verified belongs to a "digital envelope", which is a method of distributing a symmetric key through the result of asymmetric encryption, and a digital envelope is a technology for realizing information confidentiality verification.
  • a symmetric cryptographic algorithm is used to encrypt the message (the message is similar to the content on the letter paper), and the asymmetric cryptographic algorithm is used to encrypt the symmetric key (similar to the envelope), and the envelope wraps the letter paper to ensure the security of the message.
  • the verification server receives the ciphertext information to be verified sent by the terminal device;
  • the terminal device sends the ciphertext information to be verified to the verification server, wherein the ciphertext information to be verified is the encrypted information to be verified. Therefore, for the application server of the third-party application, it cannot be directly obtained. to the information to be verified.
  • the authentication server may also receive a session ID sent by the terminal device.
  • the session ID is a session ID.
  • the verification server performs decryption processing on the ciphertext information to be verified sent by the terminal device to obtain a first information digest
  • the verification server may, for example, obtain a corresponding public key (pubkey) according to a session ID (session ID), and use the public key (pubkey) to decrypt the ciphertext information to be verified, so as to obtain the first key corresponding to the information to be verified.
  • Information summary The reason why the first information digest is obtained here is that it is not safe to directly decipher the information to be verified. Therefore, for the verification server, the information to be verified will not be directly obtained, but to be verified by calling the encryption machine.
  • the first information digest is obtained, and the second information digest corresponding to the target user is obtained from the database according to the session ID (session ID).
  • the target user will fill in the corresponding information when registering, for example, user name, user account, user password, user mobile phone number, user email address, and user ID number, etc., which are not limited here.
  • the verification server can call the encryption machine to generate the second information digest corresponding to the registration information.
  • the verification server performs matching processing on the first information digest and the second information digest to obtain an information verification result, wherein the second information digest is a stored information digest;
  • the verification server compares the first information digest with the second information digest, thereby obtaining a comparison result, and the comparison result is the information verification result.
  • FIG. 5 is a schematic flowchart of information verification in the embodiment of the application, as shown in the figure, specifically:
  • step B1 the target user opens the third-party application, invokes the end-to-end client through the third-party application (ie, client or web page, etc.), and the user inputs the information to be verified through the end-to-end client.
  • the third-party application ie, client or web page, etc.
  • step B2 the end-to-end client obtains the information to be verified in plaintext.
  • step B3 the end-to-end client uses the second random number (challenge), the public key (pubkey) and the first random number (random) to encrypt the information to be verified, thereby obtaining the ciphertext information to be verified.
  • step B4 the end-to-end client sends the ciphertext information to be verified to the application server of the third-party application through the Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS).
  • HTTPS Hyper Text Transfer Protocol over Secure Socket Layer
  • the application server transparently transmits the ciphertext information to be verified to the verification server through the Secure Sockets Layer (SSL).
  • SSL Secure Sockets Layer
  • step B5 the verification server invokes the encryption machine to perform decryption processing on the ciphertext information to be verified to obtain the first information digest.
  • step B6 the authentication server calls the database to obtain the second information digest.
  • step B7 the first information digest and the second information digest are compared to obtain an information verification result.
  • step B8 the application server of the third-party application transparently transmits the information verification result to the terminal device, and the end-to-end client deployed in the terminal device receives the information verification result.
  • step B9 the information verification result is displayed through the end-to-end client deployed on the terminal device.
  • the verification server sends an information verification result to the terminal device, where the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • the verification server sends the information verification result to the terminal device, and the terminal device can display the information verification result.
  • the information verification result is used to indicate that the verification is successful, it means that the target user can log in to the application server of the third-party application through the terminal device.
  • the information verification result is used to indicate that the verification fails, it means that the target user cannot log in to the application server of the third-party application through the terminal device.
  • a method for information verification is provided.
  • the terminal device before transmitting the information to be verified, the terminal device encrypts the information to be verified by using a random number and a public key issued by a verification server, thereby obtaining the ciphertext to be verified. Therefore, the ciphertext information to be verified is used throughout the transmission process. Even if the server of the third-party application obtains the ciphertext information to be verified, it cannot decipher the information to be verified. Only the verification server can obtain the information to be verified. Therefore, you can Under the condition that the user's private information is not exposed to the third-party application, log in to the server of the third-party application, thereby improving the security of identity authentication.
  • the verification server obtains key agreement data, which may specifically include:
  • the verification server sends a ciphertext generation request to the encryption machine, so that the encryption machine generates ciphertext data in response to the ciphertext generation request, wherein the ciphertext data includes a public key and a first random number;
  • the verification server generates key agreement data according to the public key and the first random number included in the ciphertext data.
  • a method for performing key negotiation between an end-to-end client and an authentication server is introduced.
  • the verification server can obtain the ciphertext data by calling the encryption machine, that is, firstly send a ciphertext generation request to the encryption machine, and the encryption machine generates ciphertext data according to the ciphertext generation request, wherein the ciphertext data includes the public key (pubkey) and The first random number (random), the public key (pubkey) and the first random number (random) are part of the key agreement data, and based on this, the verification server obtains the key agreement data.
  • FIG. 6 is a schematic diagram of an overall flow of key negotiation in this embodiment of the present application. As shown in the figure, specifically:
  • step C1 the target user opens the page or client of the third-party application.
  • step C2 the page or client of the third-party application sends an HTTPS request to the application server of the third-party application.
  • step C3 the application server calls the API of the verification server, and the premise of the call is that the three-party application developer applies to the verification server in advance for the application key index (AppKey) and the first application key (AppSecret) for docking, and the verification server Authentication is performed through the application key index (AppKey) and the application key (AppSecret).
  • AppKey application key index
  • AppSecret first application key
  • the verification server includes two parts: the identity authorization service pre-position and the end-to-end encryption service.
  • the identity authorization service pre-position calls the interface of the end-to-end encryption service after authenticating the calling request of the third-party application, and uses This requests key negotiation.
  • step C5 the end-to-end encryption service invokes the encryption machine to generate key negotiation data for this key negotiation.
  • step C6 the encryption machine generates a public key (pubkey) and a first random number (random).
  • the encryption machine may also generate a public key index value (pubkeyIndex), wherein the public key index value (pubkeyIndex) and the public key (pubkeyIndex) ) has a unique corresponding relationship, and the public key (pubkey), the first random number (random) and the public key index value (pubkeyIndex) can be used together as ciphertext data.
  • step C7 the encryption machine feeds back the ciphertext data to the end-to-end encryption service.
  • step C8 the end-to-end encryption service generates a session ID (session ID), and constructs a relationship between the session ID (session ID), the public key index value (pubkeyIndex), the public key (pubkey) and the first random number (random).
  • the mapping relationship, and the session ID (session ID), the public key (pubkey), and the first random number (random) can be used as key negotiation data.
  • step C9 the end-to-end encryption service returns the key agreement data to the identity authorization service front end.
  • step C10 the identity authorization service frontend returns the key agreement data to the application server of the third-party application.
  • step C11 the application server of the third-party application returns the key negotiation data to the page or client of the third-party application.
  • step C12 the end-to-end client is called by the page or client of the third-party application to set the key negotiation data. It should be noted that the end-to-end client locally generates a second random number (challenge), which is combined with The public key (pubkey) and the first random number (random) included in the key agreement data can encrypt the information.
  • step C13 the end-to-end client stores the key negotiation data in a temporary storage manner for use in subsequent interactions.
  • a method for performing key negotiation between an end-to-end client and a verification server is provided.
  • the key negotiation data is obtained based on the key negotiation process, so that the key negotiation can be used.
  • the data encrypts the user's sensitive information so that it will not be exposed to third-party applications, and at the same time realizes the secure transmission and storage of the user's sensitive information through end-to-end encryption technology.
  • the whole process is imperceptible to the user and has a better experience.
  • the ciphertext data further includes a public key index value, and the public key index value and the public key have a unique correspondence. relation;
  • the verification server generates key negotiation data according to the public key and the first random number included in the ciphertext data, which may specifically include:
  • the authentication server generates a session identifier according to the identifier of the target user included in the key agreement request;
  • the verification server generates key negotiation data according to the session identifier, the public key and the first random number;
  • the verification server establishes a mapping relationship between the session identifier, the public key, the first random number and the public key index value;
  • the verification server decrypts the ciphertext information to be verified sent by the terminal device to obtain the first information digest, which may specifically include:
  • the verification server Based on the mapping relationship, the verification server performs decryption processing on the ciphertext information to be verified sent by the terminal device according to the session identifier, so as to obtain the first information digest.
  • the encryption machine can not only generate a public key (pubkey) and a first random number (random), but also generate a public key index value (pubkeyIndex) that has a unique corresponding relationship with the public key (pubkey).
  • the public key (pubkey), the first random number (random) and the public key index value (pubkeyIndex) are taken together as ciphertext data.
  • the authentication server may also generate a session ID (session ID) corresponding to the target user, and use the session ID, public key (pubkey) and first Random numbers are used together as key agreement data.
  • the verification server may construct a mapping relationship between a session ID (session ID), a public key (pubkey), a first random number (random), and a public key index value (pubkeyIndex), so as to facilitate rapid Find relationships between these data. That is, based on the mapping relationship, the verification server can find the corresponding public key (pubkey), the first random number (random), and the public key index value (pubkeyIndex) according to the session ID (session ID).
  • the ciphertext information to be verified sent by the device is decrypted to obtain the first information digest.
  • the authentication server may store the session ID (session ID), the public key (pubkey), the first random number (random), and the public key index value (pubkeyIndex) in the database, or in the encryption machine, and Or in the memory blockchain.
  • Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • Blockchain essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block.
  • the blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.
  • the underlying platform of the blockchain can include processing modules such as user management, basic services, smart contracts, and operation monitoring.
  • the user management module is responsible for the identity information management of all blockchain participants, including maintenance of public and private key generation (account management), key management, and maintenance of the corresponding relationship between the user's real identity and blockchain address (authority management), etc.
  • account management maintenance of public and private key generation
  • key management key management
  • authorization management maintenance of the corresponding relationship between the user's real identity and blockchain address
  • the basic service module is deployed on all blockchain node devices to verify the validity of business requests, After completing the consensus on valid requests, record them in the storage.
  • the basic service For a new business request, the basic service first adapts the interface for analysis and authentication processing (interface adaptation), and then encrypts the business information through the consensus algorithm (consensus management), After encryption, it is completely and consistently transmitted to the shared ledger (network communication), and records are stored; the smart contract module is responsible for the registration and issuance of contracts, as well as contract triggering and contract execution.
  • contract logic through a programming language and publish to On the blockchain (contract registration), according to the logic of the contract terms, call the key or other events to trigger execution, complete the contract logic, and also provide the function of contract upgrade and cancellation;
  • the operation monitoring module is mainly responsible for the deployment in the product release process , configuration modification, contract settings, cloud adaptation, and visual output of real-time status in product operation, such as: alarms, monitoring network conditions, monitoring node equipment health status, etc.
  • the platform product service layer provides the basic capabilities and implementation framework of typical applications. Based on these basic capabilities, developers can superimpose business characteristics to complete the blockchain implementation of business logic.
  • the application service layer provides application services based on blockchain solutions for business participants to use.
  • a method for realizing password verification on the verification server side is provided.
  • the user's identity verification can be realized without displaying the information to be verified in plain text, that is, the verification server only obtains the information to be verified.
  • the first information digest of the information to be verified is sufficient, thereby further improving the security of verification.
  • the verification server performs the verification process on the ciphertext information to be verified sent by the terminal device according to the session identifier based on the mapping relationship.
  • Decryption processing to obtain the first information digest which may specifically include:
  • the authentication server obtains the public key index value from the database according to the session identifier
  • the verification server sends the public key index value to the encryption machine, so that the encryption machine determines the public key according to the public key index value;
  • the verification server calls the encryption machine to decrypt the ciphertext information to be verified, and obtains a first information digest, wherein the first information digest is obtained after the encryption machine uses the private key corresponding to the public key to decrypt the ciphertext information to be verified.
  • a method for obtaining the first information digest at the verification server side is introduced. It can be known from the foregoing embodiments that the ciphertext information to be verified belongs to a "digital envelope", and the process of decrypting the ciphertext information to be verified will be described below.
  • FIG. 7 is a schematic diagram of decrypting the ciphertext information to be verified in an embodiment of the application.
  • the key ciphertext (saeskey) is It is obtained by encrypting the symmetric key (random+challenge) with the public key (pubkey).
  • the ciphertext information to be verified is generated by the terminal device according to the key ciphertext and the transmission ciphertext.
  • this embodiment of the present application provides a method of obtaining the first information digest on the verification server side The way.
  • the foregoing step 104 includes:
  • the verification server searches the database for the public key index value (pubkeyIndex) corresponding to the session identifier based on the mapping relationship, and then converts the public key index value (pubkeyIndex) is sent to the encryption machine, and the encryption machine finds the corresponding public key (pubkey) according to the public key index value (pubkeyIndex), and further obtains the private key corresponding to the public key (pubkey). Then, the encryption machine decrypts the key ciphertext (saeskey) using the private key, thereby obtaining a symmetric key (random+challenge). Then, the transmission ciphertext (spassword) is decrypted by using the symmetric key (random+challenge) to obtain the first information digest (SHA256 (password)).
  • a method for obtaining the first information digest on the verification server side is provided.
  • the verification server invokes an encryption machine to decrypt the ciphertext information to be verified, that is, the public key It is stored in an encryption machine with high security, thereby improving the security of information decryption.
  • the verification server performs matching processing on the first information digest and the second information digest to obtain an information verification result.
  • the verification server obtains the key index value and the ciphertext information to be matched from the database
  • the verification server sends the key index value and the ciphertext information to be matched to the encryption machine, so that the encryption machine determines the information encryption key according to the key index value;
  • the verification server invokes the encryption machine to decrypt the to-be-matched ciphertext information to obtain a second information digest, wherein the second information digest is obtained after the encryption machine uses the information encryption key to decrypt the to-be-matched ciphertext information.
  • a method for obtaining the second information digest at the verification server side is introduced. Before the verification server compares the first information abstract with the second information abstract, it also needs to obtain the second information abstract.
  • the second information abstract can be stored in the database, and directly used when needed. You can compare.
  • the second information digest can also be obtained by decrypting, and the method for obtaining the second information digest by decrypting will be introduced below.
  • the verification server searches the database for the key index value (passwordKeyIndex) corresponding to the session ID (session ID) and the ciphertext information to be matched (encPassword), then the verification server sends the key index value (passwordKeyIndex) and To match the ciphertext information (encPassword), the encryption machine first determines the information encryption key (passwordKey) according to the key index value (passwordKeyIndex). Next, the verification server calls the encryption machine to decrypt the ciphertext information to be matched, thereby obtaining the second information digest, which is represented as SHA256 (password_logon), wherein password_logon is the user information filled in by the user during registration, For example, user account, user password, mobile phone number and other information. It can be understood that the ciphertext information to be matched (encPassword) is obtained in the following way:
  • encPassword AES(passwordKey,SHA256(password_logon));
  • encPassword AES(passwordKeyIndex,SHA256(password_logon));
  • the encryption machine After the encryption machine obtains the key index value (passwordKeyIndex), the information encryption key (passwordKey) is read inside the encryption machine, and then encryption processing or decryption processing is performed.
  • a method for obtaining the second information digest on the verification server side is provided.
  • the verification server invokes an encryption machine to decrypt the information to be matched in the ciphertext, that is, the information is encrypted and encrypted.
  • the key is stored in an encryption machine with high security, thereby improving the security of information decryption.
  • the verification server performs matching processing on the first information digest and the second information digest to obtain an information verification result.
  • the verification server If the information verification result indicates that the verification is successful, the verification server generates a token, wherein the token is configured with a preset usage period;
  • the authentication server sends the token to the terminal device
  • the verification server When receiving the application login request sent by the terminal device, the verification server obtains the usage time of the token in response to the application login request, wherein the application login request carries the token;
  • the verification server sends an application login success message to the terminal device.
  • an authentication server issues tokens for end-to-end clients. If the information verification result indicates that the verification is successful, the verification server may also generate a token (token) and issue the token (token) to the end-to-end client deployed by the terminal device.
  • the token can be used directly, and the verification server needs to verify whether the token has expired, assuming that the preset usage period of the token is 2021 From February 1st, 2021 to April 1st, 2021, then using the token during this period, you can log in to the application server of the third-party application.
  • FIG. 8 is a schematic flowchart of token verification in this embodiment of the application. As shown in the figure, specifically:
  • step D1 the verification server obtains the information verification result.
  • step D2 if the information verification result is that the verification is successful, the verification server generates a token.
  • step D3 the verification server transparently transmits the token to the application server of the third-party application, and the application server receives the token from the end-to-end client deployed on the terminal device.
  • step D4 the end-to-end client stores the token locally in the terminal device.
  • step D5 the target user opens the third-party application again, and directly uses the token for verification.
  • step D6 the end-to-end client determines whether the token has expired, and if not, sends the token to the application server of the third-party application.
  • step D7 the application server verifies whether the token is valid, and if the verification is valid, the token is sent to the verification server.
  • step D8 the verification server verifies whether the token is valid, and feeds back the verification result to the application server.
  • step D9 the application server determines whether the login of the target user is successful this time according to the returned verification result.
  • step D10 the result of this login is displayed through the end-to-end client deployed on the terminal device.
  • a verification server is provided to issue a token to the end-to-end client.
  • the token can be used to log in later, thereby reducing the risk of user information being exposed.
  • the user does not need to jump to the identity authorization server for verification, and the connection process between the third-party application and the identity authorization service does not require front-end connection logic, which reduces the connection process.
  • the verification server responds to the key agreement request sent by the terminal device, before acquiring the key agreement data, Can also include:
  • the verification server receives the authentication request sent by the application server, wherein the authentication request carries the application key index and the application key;
  • the verification server performs verification processing on the application key index and the application key, and obtains the verification result
  • the verification server executes the step of acquiring the key agreement data in response to the key agreement request sent by the terminal device.
  • a manner in which the authentication server authenticates the third-party application is introduced.
  • the page or client of the third-party application sends an HTTPS request to the application server of the third-party application, and the application server calls the application programming interface (Application Programming Interface, API) of the authentication server, where , the premise of the call is that the three-party application developer applies to the verification server in advance for the application key index (AppKey) and the application key (AppSecret) for docking, and the verification server will pass the application key index (AppKey) and application key (AppKey) AppSecret) for authentication.
  • AppKey application key index
  • AppKey application key
  • an authentication request is sent to the verification server through the application server of the third-party application, wherein the authentication request carries the application key index (AppKey) and the application key ( AppSecret), optionally, the application identifier (AppID) of the target application may also be carried.
  • the application identifier (AppID) is the unique identifier of the target application
  • the application key index (AppKey) is equivalent to the account assigned by the authentication server to the application server
  • the application key (AppSecret) is equivalent to the password assigned by the authentication server to the application server.
  • the verification server verifies whether the application key index (AppKey) and the application key (AppSecret) have records in the database. If there are records, it indicates that the verification result is successful, so the verification server can perform subsequent operations.
  • a method for the verification server to authenticate the third-party application is provided.
  • the verification server also needs to authenticate the third-party application before performing the identity verification on the user, thereby increasing the number of users. Security of data interaction.
  • the verification server responds to the key agreement request sent by the terminal device, before acquiring the key agreement data, Can also include:
  • the verification server receives the authentication request sent by the application server, wherein the authentication request carries the application key index, timestamp, signature random number and first signature information, and the first signature information is based on hash Obtained after the function encryption algorithm signs the first application key, timestamp and signature random number;
  • the verification server obtains the second application key according to the application key index in response to the authentication request;
  • the verification server signs the second application key, the timestamp and the signature random number based on the hash function encryption algorithm to obtain the second signature information;
  • the verification server executes the step of acquiring key agreement data in response to the key agreement request sent by the terminal device.
  • the authentication server authenticates the third-party application.
  • the page or client of the third-party application sends an HTTPS request to the application server of the third-party application, and the application server calls the API of the verification server.
  • the premise of the call is that the third-party application developer Apply to the verification server in advance for the application key index (AppKey) and the first application key (AppSecret) for docking, and the verification server will authenticate through the application key index (AppKey) and the first application key (AppSecret) .
  • an authentication request is sent to the verification server through the application server of the third-party application, wherein the authentication request carries the application key index (AppKey), timestamp, signature The random number and the first signature information, wherein the first signature information is obtained after the application server signs the first application key (AppSecret), the timestamp and the signature random number by using a hash function encryption algorithm.
  • the hash function encryption algorithm includes but is not limited to using Secure Hash Algorithm 1 (Secure Hash Algorithm, SHA1), and using Secure Hash Algorithm 256 (Secure Hash Algorithm, SHA256).
  • the application key index (AppKey) is equivalent to the account assigned by the authentication server to the application server
  • the first application key (AppSecret) is equivalent to the password assigned by the authentication server to the application server.
  • the verification server searches for the second application key (AppSecret) corresponding to the application key index (AppKey) based on the application key index (AppKey), and then uses the same hash function encryption algorithm to detect the second application key (AppSecret). (AppSecret), timestamp, and signature random number to sign to obtain the second signature information. Finally, the local second signature information is compared with the received first signature information. If the comparison result is consistent, that is, the first signature information and the second signature information are successfully matched, so that the verification server can perform subsequent operations. .
  • the verification server also needs to authenticate the third-party application before performing the identity verification on the user. Increase the security of data interaction.
  • FIG. 9 is a schematic diagram of an overall flow of information verification and token issuance in the embodiment of the present application, as shown in the figure, specifically:
  • step E1 the target user performs a login operation and inputs information to be authenticated, such as user name and password.
  • step E2 the third-party application calls the end-to-end client, the end-to-end client generates a second random number (challenge), and uses the first random number (random) and the second random number (challenge) together as a symmetric encryption algorithm
  • the symmetric key used.
  • the symmetric key random+challenge
  • the symmetric key is encrypted with the public key (pubkey) to obtain the key ciphertext (saeskey) of the symmetric key.
  • the end-to-end client deployed on the terminal device also needs to perform digest calculation on the information to be verified based on the hash function encryption algorithm to obtain the first information digest (SHA256 (password)).
  • the end-to-end client then encrypts the symmetric key and the first information digest based on the symmetric encryption algorithm to obtain a transmission ciphertext (spassword).
  • spassword AES(challenge+random, SHA256(password).
  • step E3 the end-to-end client generates ciphertext information to be verified, wherein the ciphertext information to be verified consists of a transmission ciphertext (spassword) and a key ciphertext (saeskey).
  • the ciphertext information to be verified consists of a transmission ciphertext (spassword) and a key ciphertext (saeskey).
  • step E4 the end-to-end client returns the ciphertext information to be verified to the third-party application.
  • step E5 the third-party application carries the ciphertext information to be verified in the login request, and sends it to the application server of the third-party application.
  • step E6 the application server of the third-party application calls the API in front of the identity authorization service in the authentication server.
  • step E7 the identity authorization service pre-calls the API of the authentication service for verification.
  • step E8 the authentication service first verifies whether the target user exists and whether the transaction is a user in the normal state of the system.
  • the request is sent by the end-to-end encrypted service.
  • step E9 the end-to-end encryption service obtains the public key index value (pubkeyIndex) stored in the database through the session ID (sessionID), and also obtains the key index value (passwordKeyIndex) and the ciphertext information to be matched. (encPassword).
  • step E10 the end-to-end encryption service calls the encryption machine to perform decryption.
  • step E11 the encryption machine performs decryption.
  • step E12 the end-to-end encryption service obtains the decrypted symmetric key (random+challenge), and then obtains the first information digest (SHA256 (password)), and simultaneously obtains the second information digest (SHA256) according to the data in the database decryption (password_logon)).
  • SHA256 password
  • SHA256 second information digest
  • step E13 the end-to-end encryption service compares whether the first message digest (SHA256 (password)) and the second message digest (SHA256 (password_logon)) are consistent, thereby obtaining the message verification result.
  • SHA256 password
  • SHA256 password_logon
  • step E14 the end-to-end encryption service returns the information verification result to the authentication service.
  • step E15 the authentication service invokes the authorization service according to the information verification result, thereby obtaining a token for user access authorization.
  • step E16 the token generated by the authorization service is returned to the authentication service.
  • step E17 the authentication service returns the information verification result to the identity authorization service front end.
  • step E18 the identity authorization service frontend returns the information verification result to the application server of the third-party application.
  • step E19 the application server of the third-party application returns the verification result to the third-party application.
  • step E20 the target user obtains the information verification result.
  • step E21 the subsequent target user logs in to the third-party application (that is, the target user), and can use the token for authentication unless the token expires and cannot be used.
  • Another embodiment of the information verification method in the embodiment of the present application includes:
  • the terminal device sends a key agreement request to the verification server, so that the verification server obtains key agreement data in response to the key agreement request, wherein the key agreement request carries the identifier of the target user, and the key agreement data includes the public key and first random number.
  • the public key and the first random number are generated by an encryption machine
  • the end-to-end client when the target user starts the third-party application on the terminal device, the end-to-end client can be automatically launched, and thus the terminal device sends a key agreement request to the authentication server through the end-to-end client.
  • the key agreement request carries the identifier of the target user, and based on this, the authentication server can establish a communication session with the terminal device.
  • the verification server calls the encryption machine to generate the key agreement data required for this key negotiation, that is, the encryption machine generates the key agreement data and feeds it back to the verification server.
  • the key agreement data includes a public key (pubkey) and a first random number (random), and the first random number (random) may be a random number composed of ASCII.
  • the terminal device receives the key negotiation data sent by the verification server;
  • the verification server sends key negotiation data to the terminal device, and the end-to-end client deployed on the terminal device receives the key negotiation data.
  • the terminal device uses the second random number, the public key included in the key agreement data, and the first random number to encrypt the information to be verified for the target application to obtain ciphertext information to be verified, where the information to be verified is Include the user information corresponding to the target user.
  • the second random number is generated by the terminal device
  • the terminal device generates the second random number (challenge) based on the end-to-end client, so the terminal device uses the second random number (challenge) and the public key (pubkey) included in the key agreement data and the first random number (challenge) number (random), performing encryption processing on the information to be verified inputted by the target user, thereby obtaining the ciphertext information to be verified, wherein the second random number (challenge) may be a random number composed of ASCII.
  • the information to be verified includes the user information of the target user, such as username, User account number, user password, user mobile phone number, user email address, and user ID number, etc., are not limited here.
  • the ciphertext information to be verified belongs to a "digital envelope", which is a method of distributing a symmetric key through the result of asymmetric encryption, and a digital envelope is a technology for realizing information confidentiality verification.
  • a symmetric cryptographic algorithm is used to encrypt the message (the message is similar to the content on the letter paper), and the asymmetric cryptographic algorithm is used to encrypt the symmetric key (similar to the envelope), and the envelope wraps the letter paper to ensure the security of the message.
  • the terminal device sends the ciphertext information to be verified to the verification server, so that the verification server decrypts the ciphertext information to be verified to obtain the first information digest, and performs matching processing on the first information digest and the second information digest to obtain the information Validation results;
  • the terminal device sends the ciphertext information to be verified and the session identifier (the session identifier is optional) to the verification server, wherein the ciphertext information to be verified is the encrypted information to be verified. Therefore, for third-party applications As far as the application server is concerned, it is impossible to directly obtain the information to be verified.
  • the session ID (session ID) is the identification of a session. Each time the authentication server is accessed, a session (session) will be generated on the authentication server side, and the authentication of the target user can be performed under the same session.
  • the verification server may, for example, obtain a corresponding public key (pubkey) according to a session ID, use the public key (pubkey) to decrypt the ciphertext information to be verified, and obtain a first information digest corresponding to the information to be verified.
  • the reason why the first information digest is obtained here is that it is not safe to directly decipher the information to be verified. Therefore, for the verification server, the information to be verified will not be directly obtained, but to be verified by calling the encryption machine.
  • the first information digest is obtained, and the second information digest corresponding to the target user is obtained from the database according to the session ID (session ID).
  • the target user will fill in the corresponding information when registering, for example, user name, user account, user password, user mobile phone number, user email address, and user ID number, etc., which are not limited here.
  • the verification server can call the encryption machine to generate the second information digest corresponding to the registration information.
  • the terminal device receives the information verification result sent by the verification server, where the information verification result is used to indicate the result of logging in to the application server by the terminal device, and the application server is the server of the target application.
  • the verification server compares the first information digest with the second information digest, thereby obtaining a comparison result, and the comparison result is the information verification result.
  • the verification server sends the information verification result to the terminal device, and the terminal device can display the information verification result. Specifically, if the information verification result is used to indicate that the verification is successful, it means that the target user can log in to the application server of the third-party application through the terminal device. If the information verification result is used to indicate that the verification fails, it means that the target user cannot log in to the application server of the third-party application through the terminal device.
  • a method for information verification is provided.
  • the terminal device before transmitting the information to be verified, the terminal device encrypts the information to be verified by using a random number and a public key issued by the verification server, thereby obtaining the ciphertext to be verified. Therefore, the ciphertext information to be verified is used throughout the transmission process. Even if the server of the third-party application obtains the ciphertext information to be verified, it cannot decipher the information to be verified. Only the verification server can obtain the information to be verified. Therefore, you can Under the condition that the user's private information is not exposed to the third-party application, log in to the server of the third-party application, thereby improving the security of identity authentication.
  • the terminal device adopts the second random number, the public key included in the key agreement data, and the first random number. Random number, encrypts the information to be verified for the target application, and obtains the ciphertext information to be verified, which may specifically include:
  • the terminal device generates a second random number
  • the terminal device uses the first random number and the second random number as the symmetric key used by the symmetric encryption algorithm;
  • the terminal device uses the public key included in the key agreement data to encrypt the symmetric key to obtain the key ciphertext of the symmetric key;
  • the terminal device performs digest calculation on the information to be verified of the target application based on the hash function encryption algorithm to obtain the first information digest;
  • the terminal device encrypts the symmetric key and the first information digest based on the symmetric encryption algorithm to obtain the transmission ciphertext;
  • the terminal device generates the ciphertext information to be verified according to the key ciphertext and the transmission ciphertext.
  • the end-to-end client uses key negotiation data to encrypt the information to be authenticated. It can be known from the foregoing embodiments that the ciphertext information to be verified belongs to a "digital envelope", and the method for generating the ciphertext information to be verified will be described below.
  • FIG. 11 is a schematic diagram of generating ciphertext information to be verified in an embodiment of the application.
  • the end-to-end client deployed on the terminal device generates a second random number (challenge) ), and the key agreement data sent by the verification server includes the public key (pubkey) and the first random number (random). Therefore, the first random number (random) and the second random number (challenge) are used together as a symmetric encryption algorithm.
  • the symmetric key used.
  • symmetric encryption algorithms include but are not limited to Advanced Encryption Standard (AES), Data Encryption Standard (DES) and Triple Data Encryption Algorithm (TDEA), etc. This application AES is used as the symmetric encryption algorithm, however, this should not be construed as a limitation of this application.
  • AES Advanced Encryption Standard
  • DES Data Encryption Standard
  • TDEA Triple Data Encryption Algorithm
  • the symmetric key (random+challenge) is encrypted with the public key (pubkey) to obtain the key ciphertext (saeskey) of the symmetric key.
  • the end-to-end client deployed on the terminal device also needs to perform digest calculation on the information to be verified based on the hash function encryption algorithm to obtain the first information digest.
  • the hash function encryption algorithm includes but is not limited to SHA1 and SHA256. This application uses SHA256 as the hash function encryption algorithm, but this should not be construed as a limitation on this application. Therefore, it is assumed that the information to be verified is "password", and the information to be verified is in the form of plaintext.
  • the information to be verified needs to be encrypted, so a hash function encryption algorithm is used to encrypt the information to be verified.
  • a hash function encryption algorithm is used to encrypt the information to be verified.
  • the algorithm is SHA256, then the obtained first information digest can be expressed as SHA256 (password).
  • the end-to-end client uses key negotiation data to encrypt the information to be verified.
  • the end-to-end client uses the second random number generated locally, And the key negotiation data sent by the verification server, encrypt the information to be verified, and transmit the encrypted ciphertext information to be verified, thereby improving the security of information transmission.
  • FIG. 12 is an overall schematic flow chart of the information verification method in the embodiment of the present application, as shown in the figure, specifically:
  • step S1 if the terminal device opens the target application, the verification server receives the authentication request sent by the application server, wherein the authentication request carries the application key index and the application key.
  • step S2 in response to the authentication request, the verification server performs verification processing on the application key index and the application key to obtain a verification result.
  • step S3 if the verification result is that the verification is successful, the verification server obtains key agreement data in response to the key agreement request sent by the terminal device, wherein the key agreement request carries the identifier of the target user, and the key agreement data includes public key agreement data.
  • the key and the first random number, the public key and the first random number are generated by the encryption machine.
  • step S4 the verification server sends key agreement data to the terminal device, so that the terminal device uses the second random number and the public key and the first random number included in the key agreement data to verify the information to be verified for the target application Encryption processing is performed to obtain ciphertext information to be verified, wherein the information to be verified includes user information corresponding to the target user, and the second random number is generated by the terminal device.
  • step S5 the verification server receives the ciphertext information to be verified and the session identifier sent by the terminal device.
  • step S6 the verification server performs decryption processing on the ciphertext information to be verified sent by the terminal device according to the session identifier, so as to obtain a first information digest.
  • step S7 the verification server obtains the key index value and the ciphertext information to be matched from the database according to the session identifier.
  • step S8 the verification server sends the key index value and the ciphertext information to be matched to the encryption machine, so that the encryption machine determines the information encryption key according to the key index value.
  • step S9 the verification server calls the encryption machine to decrypt the ciphertext information to be matched, and obtains a second information digest, wherein the second information digest is obtained after the encryption machine uses the information encryption key to decrypt the ciphertext information to be matched.
  • step S10 the verification server performs matching processing on the first information digest and the second information digest to obtain an information verification result, wherein the second information digest is a stored information digest.
  • step S11 the verification server sends an information verification result to the terminal device, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • step S12 if the information verification result indicates that the verification is successful, the verification server generates a token, wherein the token is configured with a preset usage period.
  • step S13 the verification server sends the token to the terminal device.
  • step S14 when receiving the application login request sent by the terminal device, the verification server obtains the usage time of the token in response to the application login request, wherein the application login request carries the token.
  • step S15 if the usage time of the token is within the preset usage period, the verification server sends an application login success message to the terminal device.
  • FIG. 13 is a schematic diagram of an embodiment of the information verification device in the embodiment of the application.
  • the information verification device 30 includes:
  • the obtaining module 301 is configured to obtain key negotiation data in response to a key negotiation request sent by the terminal device, wherein the key negotiation request carries an identifier of a target user, and the key negotiation data includes a public key and a first random number;
  • the sending module 302 is configured to send the key agreement data to the terminal device, so that the terminal device uses the second random number, the public key included in the key agreement data, and the first random number to perform verification on the information to be verified for the target application. Encryption processing to obtain ciphertext information to be verified, wherein the information to be verified includes user information corresponding to the target user;
  • a receiving module 303 configured to receive the ciphertext information to be verified sent by the terminal device
  • a decryption module 304 configured to decrypt the ciphertext information to be verified sent by the terminal device to obtain a first information digest
  • a verification module 305 configured to perform matching processing on the first information digest and the second information digest to obtain an information verification result, wherein the second information digest is a stored information digest;
  • the sending module 302 is further configured to send the information verification result to the terminal device, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • an information verification device is provided.
  • the terminal device encrypts the information to be verified by using a random number and a public key issued by a verification server before transmitting the information to be verified, so as to obtain the ciphertext information to be verified. , so the ciphertext information to be verified is used throughout the transmission process. Even if the server of the third-party application obtains the ciphertext information to be verified, it cannot decipher the information to be verified. Only the verification server can obtain the information to be verified. Under the condition that the user's private information is not exposed to the third-party application, log in to the server of the third-party application, thereby improving the security of identity authentication.
  • the receiving module 303 is further configured to, before the obtaining module obtains the key agreement data in response to the key agreement request sent by the terminal device, if the terminal device opens the target application, then receive the authentication request sent by the application server, wherein the authentication request Carry the application key index and application key;
  • the verification module 305 is further configured to perform verification processing on the application key index and the application key in response to the authentication request to obtain a verification result;
  • the obtaining module 301 is further configured to execute the step of obtaining key negotiation data in response to the key negotiation request sent by the terminal device if the verification result is that the verification is successful.
  • an information verification device is provided.
  • the verification server also needs to authenticate a third-party application before performing identity verification on a user, thereby increasing the security of data interaction.
  • the information verification apparatus 30 further includes a signature module 306;
  • the receiving module 303 is further configured to, before the obtaining module 301 obtains the key agreement data in response to the key agreement request sent by the terminal device, if the target application is opened by the terminal device, then receive the authentication request sent by the application server, wherein the authentication request The request carries the application key index, timestamp, signature random number and first signature information, where the first signature information is obtained by signing the first application key, timestamp and signature random number based on a hash function encryption algorithm;
  • the obtaining module 301 is further configured to obtain the second application key according to the application key index in response to the authentication request;
  • a signature module 306 configured to sign the second application key, the timestamp and the signature random number based on the hash function encryption algorithm to obtain the second signature information
  • the obtaining module 301 is further configured to execute the step of obtaining key agreement data in response to a key agreement request sent by the terminal device if the first signature information and the second signature information match successfully.
  • an information verification device is provided.
  • the verification server also needs to authenticate a third-party application before performing identity verification on a user, thereby increasing the security of data interaction.
  • the decryption module 304 is further configured to: decrypt the key ciphertext by using the private key corresponding to the public key, to obtain the first random number and the second random number as the symmetric key. ; Decrypt the transmission ciphertext through the symmetric key to obtain the first information digest.
  • the obtaining module 301 is specifically configured to send a ciphertext generation request to the encryption machine, so that the encryption machine generates ciphertext data in response to the ciphertext generation request, wherein the ciphertext data includes a public key and a first random number;
  • the key agreement data is generated according to the public key and the first random number included in the ciphertext data.
  • an information verification device is provided.
  • key agreement data is obtained based on the key agreement process. Therefore, the key agreement data can be used to encrypt the user's sensitive information, so that the user's sensitive information cannot be encrypted.
  • the ciphertext data further includes a public key index value, and the public key index value is the same as the public key index value.
  • the key has a unique correspondence
  • the information verification device 30 further includes a establishing module 307;
  • the acquiring module 301 is specifically configured to generate a session identifier according to the identifier of the target user included in the key agreement request;
  • the establishment module 307 is used to establish the mapping relationship between the session identifier, the public key, the first random number and the public key index value;
  • the decryption module 304 is specifically configured to perform decryption processing on the ciphertext information to be verified sent by the terminal device based on the mapping relationship and the session identifier to obtain the first information digest.
  • an information verification device is provided.
  • the user's identity verification can be realized without displaying the information to be verified in plain text, that is, the verification server only obtains the first information digest of the information to be verified. That is to say, thus, the security of the verification is further improved.
  • the decryption module 304 is specifically configured to obtain the public key index value from the database according to the session identifier based on the mapping relationship;
  • the encryption machine is called to decrypt the ciphertext information to be verified to obtain a first information digest, wherein the first information digest is obtained after the encryption machine uses the private key corresponding to the public key to decrypt the ciphertext information to be verified.
  • an information verification device is provided.
  • the verification server invokes an encryption machine to realize the decryption of the ciphertext information to be verified, that is, the public key is stored in the encryption machine with high security. , thereby improving the security of information decryption.
  • the obtaining module 301 is further configured to, before the verification module 305 performs matching processing on the first information digest and the second information digest, and obtains the information verification result, obtains the key index value and the ciphertext information to be matched from the database according to the session identifier;
  • the sending module 302 is further configured to send the key index value and the ciphertext information to be matched to the encryption machine, so that the encryption machine determines the information encryption key according to the key index value;
  • the decryption module 304 is further configured to call the encryption machine to perform decryption processing on the ciphertext information to be matched to obtain a second information digest, where the second information digest is obtained after the encryption machine uses the information encryption key to decrypt the ciphertext information to be matched. .
  • an information verification device is provided.
  • the verification server invokes the encryption machine to realize the decryption of the ciphertext information to be matched. In the machine, thereby improving the security of information decryption.
  • the information verification apparatus 30 further includes a generating module 308;
  • the generating module 308 is configured to perform a matching process on the first information digest and the second information digest in the verification module 305, and after obtaining the information verification result, if the information verification result indicates that the verification is successful, then generate a token, wherein the token is configured with a predetermined set life cycle;
  • the sending module 302 is further configured to send the token to the terminal device
  • the acquiring module 301 is further configured to acquire the usage time of the token in response to the application login request when receiving the application login request sent by the terminal device, wherein the application login request carries the token;
  • the sending module 302 is further configured to send an application login success message to the terminal device if the usage time of the token is within the preset usage period.
  • an information verification device is provided.
  • a token can be used to log in subsequently, thereby reducing the risk of user information being exposed.
  • the user does not need to jump to the identity authorization server for verification, and the connection process between the third-party application and the identity authorization service does not require front-end connection logic, which reduces the connection process.
  • FIG. 14 is a schematic diagram of another embodiment of the information verification device in the embodiment of the application.
  • the information verification device 40 includes:
  • the sending module 401 is configured to send a key agreement request to the verification server, so that the verification server obtains key agreement data in response to the key agreement request, wherein the key agreement request carries the identifier of the target user, and the key agreement data includes the public key agreement data. the key and the first random number;
  • a receiving module 402 configured to receive key negotiation data sent by the verification server
  • the encryption module 403 is configured to perform encryption processing on the information to be verified for the target application by using the second random number, the public key included in the key agreement data, and the first random number to obtain the ciphertext information to be verified, wherein the to-be-verified ciphertext information is obtained.
  • the verification information includes user information corresponding to the target user;
  • the sending module 401 is further configured to send the ciphertext information to be verified to the verification server, so that the verification server decrypts the ciphertext information to be verified, obtains a first information digest, and performs matching processing on the first information digest and the second information digest , get the information verification result;
  • the receiving module 402 is further configured to receive the information verification result sent by the verification server, wherein the information verification result is used to indicate the result of the terminal device logging in to the application server, and the application server is the server of the target application.
  • an information verification device is provided.
  • the terminal device encrypts the information to be verified by using a random number and a public key issued by a verification server before transmitting the information to be verified, so as to obtain the ciphertext information to be verified. , so the ciphertext information to be verified is used throughout the transmission process. Even if the server of the third-party application obtains the ciphertext information to be verified, it cannot decipher the information to be verified. Only the verification server can obtain the information to be verified. Under the condition that the user's private information is not exposed to the third-party application, log in to the server of the third-party application, thereby improving the security of identity authentication.
  • digest calculation is performed on the information to be verified of the target application to obtain the first information digest
  • an information verification device is provided.
  • the end-to-end client uses the second random number generated locally and the key agreement data sent by the verification server to encrypt the information to be verified, and The encrypted ciphertext information to be verified is transmitted, thereby improving the security of information transmission.
  • FIG. 15 is a schematic structural diagram of a server provided by the embodiment of the present application.
  • the server 500 may be relatively large due to different configurations or performances. difference, may include one or more central processing units (CPU) 522 (eg, one or more processors) and memory 532, one or more storage media 530 (such as one or more mass storage devices). Among them, the memory 532 and the storage medium 530 may be short-term storage or persistent storage.
  • the program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server.
  • the central processing unit 522 may be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the server 500 .
  • Server 500 may also include one or more power supplies 526, one or more wired or wireless network interfaces 550, one or more input and output interfaces 558, and/or, one or more operating systems 541, such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM and many more.
  • the steps performed by the server in the above embodiment may be based on the server structure shown in FIG. 15 .
  • the embodiment of the present application also provides another information verification apparatus, and the information verification apparatus is deployed on the terminal device, as shown in FIG. 16 .
  • the terminal device can be any terminal device including a mobile phone, a tablet computer, a Personal Digital Assistant (PDA), a Point of Sales (POS), a vehicle-mounted computer, etc.
  • the terminal device is a mobile phone as an example:
  • FIG. 16 is a block diagram showing a partial structure of a mobile phone related to a terminal device provided by an embodiment of the present application.
  • the mobile phone includes: a radio frequency (RF) circuit 610, a memory 620, an input unit 630, a display unit 640, a sensor 650, an audio circuit 660, a wireless fidelity (WiFi) module 670, a processor 680, and a power supply 690 and other components.
  • RF radio frequency
  • the RF circuit 610 can be used for receiving and sending signals during sending and receiving information or during a call.
  • the processor 680 After receiving the downlink information of the base station, it is processed by the processor 680; in addition, the designed uplink data is sent to the base station.
  • the memory 620 can be used to store software programs and modules, and the processor 680 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 620 .
  • the input unit 630 may be used for receiving inputted numerical or character information, and generating key signal input related to user setting and function control of the mobile phone.
  • the input unit 630 may include a touch panel 631 and other input devices 632 .
  • the touch panel 631 is also called a touch screen.
  • the display unit 640 may be used to display information input by the user or information provided to the user and various menus of the mobile phone.
  • the display unit 640 may include a display panel 641.
  • the display panel 641 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), and the like.
  • the cell phone may also include at least one sensor 650, such as light sensors, motion sensors, and other sensors.
  • the audio circuit 660, the speaker 661, and the microphone 662 can provide an audio interface between the user and the mobile phone.
  • WiFi is a short-distance wireless transmission technology.
  • the mobile phone can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 670. It provides users with wireless broadband Internet access.
  • the processor 680 is the control center of the mobile phone, using various interfaces and lines to connect various parts of the entire mobile phone, by running or executing the software programs and/or modules stored in the memory 620, and calling the data stored in the memory 620. Various functions of the phone and processing data.
  • the steps performed by the terminal device in the above embodiment may be based on the structure of the terminal device shown in FIG. 16 .
  • Embodiments of the present application also provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when it runs on a computer, causes the computer to execute the methods described in the foregoing embodiments.
  • the embodiments of the present application also provide a computer program product including a program, which, when run on a computer, causes the computer to execute the methods described in the foregoing embodiments.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种基于云安全技术实现的信息验证方法，本申请包括：获取密钥协商数据；向终端设备发送密钥协商数据，终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息；接收终端设备发送的待验证密文信息；对终端设备发送的待验证密文信息进行解密处理，得到第一信息摘要；对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；向终端设备发送信息验证结果。本申请还提供了相关装置、设备以及存储介质。本申请可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。

Description

一种信息验证的方法、相关装置、设备以及存储介质
本申请要求于2021年04月02日提交中国专利局、申请号为202110360917.2、申请名称为“一种信息验证的方法、相关装置、设备以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及云安全技术领域，尤其涉及信息验证。
背景技术
开放授权(Open Authorization，OAuth)协议为用户资源的授权提供了一个安全、开放且简易的标准。与以往的授权方式不同的是，OAuth的授权不会使第三方触及到用户的账号信息(例如，用户名与密码)，即第三方无需使用用户的账号信息就可以申请获得该用户资源的授权，因此，OAuth协议是较为安全的。
目前，在OAuth协议下，通过前端程序对密码进行单项散列计算，例如，采用安全散列算法1(Secure Hash Algorithm，SHA-1)或者采用安全散列算法256(Secure Hash Algorithm，SHA-256)，得到密码的摘要信息，最后由后端的身份授权服务根据密码的摘要信息对密码进行验证。
然而，前端程序需要通过第三方应用的服务器才能将密码的摘要信息发送至后端的身份。在这个过程中，第三方应用的服务器可以间接地获取到用户的账号信息，并存储密码的摘要信息，导致信息的安全难以得到保障。
发明内容
本申请实施例提供了一种信息验证的方法、相关装置、设备以及存储介质，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。
有鉴于此，本申请一方面提供一种信息验证的方法，包括：
响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数；
向终端设备发送密钥协商数据，以使终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息；
接收终端设备发送的待验证密文信息；
对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要；
对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，第二信息摘要为已存储的信息摘要；
向终端设备发送信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本申请另一方面提供一种信息验证的方法，包括：
向验证服务器发送密钥协商请求，以使验证服务器响应于密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机 数；
接收验证服务器发送的密钥协商数据；
采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息；
向验证服务器发送待验证密文信息，以使验证服务器对待验证密文信息进行解密处理，得到第一信息摘要，并对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；
接收验证服务器发送的信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本申请另一方面提供一种信息验证装置，包括：
获取模块，用于响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数；
发送模块，用于向终端设备发送密钥协商数据，以使终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息；
接收模块，用于接收终端设备发送的待验证密文信息；
解密模块，用于对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要；
验证模块，用于对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，第二信息摘要为已存储的信息摘要；
发送模块，还用于向终端设备发送信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本申请另一方面提供一种信息验证装置，包括：
发送模块，用于向验证服务器发送密钥协商请求，以使验证服务器响应于密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数；
接收模块，用于接收验证服务器发送的密钥协商数据；
加密模块，用于采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息；
发送模块，还用于向验证服务器发送待验证密文信息，以使验证服务器对待验证密文信息进行解密处理，得到第一信息摘要，并对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；
接收模块，还用于接收验证服务器发送的信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本申请另一方面提供一种服务器，包括：存储器、处理器以及总线***；
其中，存储器用于存储程序；
处理器用于执行存储器中的程序，处理器用于根据程序代码中的指令执行上述各方面所提供的方法；
总线***用于连接存储器以及处理器，以使存储器以及处理器进行通信。
本申请另一方面提供一种终端设备，包括：存储器、处理器以及总线***；
其中，存储器用于存储程序；
处理器用于执行存储器中的程序，处理器用于根据程序代码中的指令执行上述各方面所提供的方法；
总线***用于连接存储器以及处理器，以使存储器以及处理器进行通信。
本申请的另一方面提供了一种计算机可读存储介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面的方法。
本申请的另一个方面，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述各方面所提供的方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
本申请实施例中，提供了一种信息验证的方法，验证服务器响应于终端设备发送的密钥协商请求，获取密钥协商数据，该密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数，然后，由验证服务器向终端设备发送密钥协商数据，以使终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，于是，验证服务器接收终端设备发送的待验证密文信息，再对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要。由此，验证服务器可以对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，并向终端设备发送信息验证结果，以使终端设备在信息验证结果指示验证成功的情况下，登录至目标应用的应用服务器。通过上述方式，终端设备在传输待验证信息之前，使用随机数和验证服务器颁发的公钥对待验证信息进行加密得到待验证密文信息，于是在传输过程中全程使用待验证密文信息，第三方应用的服务器即使获取到待验证密文信息，也无法破解出待验证信息，只有验证服务器才能获取到待验证信息，因此，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，提升身份认证的安全性。
附图说明
图1为本申请实施例中信息验证***的一个环境示意图；
图2为本申请实施例中信息验证***的一个应用架构示意图；
图3为本申请实施例中信息验证方法的一个实施例示意图；
图4为本申请实施例中密钥协商的一个流程示意图；
图5为本申请实施例中信息验证的一个流程示意图；
图6为本申请实施例中密钥协商的一个整体流程示意图；
图7为本申请实施例中对待验证密文信息进行解密的一个示意图；
图8为本申请实施例中令牌验证的一个流程示意图；
图9为本申请实施例中信息验证以及令牌颁发的一个整体流程示意图；
图10为本申请实施例中信息验证方法的另一个实施例示意图；
图11为本申请实施例中生成待验证密文信息的一个示意图；
图12为本申请实施例中信息验证方法的一个整体流程示意图；
图13为本申请实施例中信息验证装置的一个示意图；
图14为本申请实施例中信息验证装置的另一个示意图；
图15为本申请实施例中服务器的一个结构示意图；
图16为本申请实施例中终端设备的一个结构示意图。
具体实施方式
本申请实施例提供了一种信息验证的方法、相关装置、设备以及存储介质，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例例如能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“对应于”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、***、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
开放授权(Open Authorization，OAuth)协议是一个开放标准，允许用户授权第三方应用访问存储在另外的服务提供者上的信息，而不需要将用户名和密码提供给第三方移动应用或分享他们数据的所有内容。很多网站都提供了第三方登录的功能，例如，在应用程序(application，APP)或者网页接入一些第三方应用时，时常需要用户登录另一个合作平台(例如，社交类应用等)进行授权登录。目前，在身份认证场景下，第三方应用与身份授权服务可利用OAuth2.0协议进行对接，其中，OAuth 2.0定义了五种授权方式，分别为授权码模式(authorization code)，简化模式(implicit)，密码模式(resource owner password credentials)，客户端模式(client credentials)以及扩展模式(extension)。对于密码模式而言，由于第三方应用在使用身份认证服务进行身份验证时，需要用户输入用户名和密码等，因此，第三方应用可以获取用户的用户名和密码，从而造成潜在的用户密码泄露的风险。
基于此，本申请提供了一种基于端到端加密技术实现的信息验证方法，可用于解决密码模式下授权对接问题，此外，还可用于解决其他场景下信息验证的问题。本申请提供的信息验证方法可应用于如图1所示的信息验证***，如图所示，信息验证***包括终端设备、服务器、加密机以及数据库。其中，终端设备上部署了客户端，该客户端具体包括第三方应用的客户端以及端到端客户端。服务器包括第三方应用的应用服务器以及验证服务器。本申请涉及的服务器可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式***，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服 务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。终端设备可以是智能手机、平板电脑、笔记本电脑、掌上电脑、个人电脑、智能电视、智能手表等，但并不局限于此。终端设备以及服务器可以通过有线或无线通信方式进行直接或间接地连接，本申请在此不做限制。服务器和终端设备的数量也不做限制。
当用户需要登录第三方应用时，可通过终端设备向应用服务器发起登录请求，并通过终端设备输入待验证信息，由终端设备使用密钥协商数据对待验证信息进行加密，以此生成待验证密文信息。在一种实现方式中，终端设备可以向第三方应用的应用服务器发送待验证密文信息，由第三方应用的应用服务器将待验证密文信息转发给验证服务器。在另一种实现方式中，终端设备直接向验证服务器发送待验证密文信息。于是，验证服务器通过调用加密机对待验证密文信息进行解密处理，得到待验证信息的第一信息摘要，然后通过调用数据库对第一信息摘要与已存储的信息摘要(例如，第二信息摘要)进行比对，由此得到信息验证结果。最后，将该信息验证结果发送至终端设备即可完成身份验证的流程。
需要说明的是，验证服务器的执行流程也可以由云服务器来实现，通过云服务器实现云安全方面的身份验证。云安全(cloud security)是指基于云计算商业模式应用的安全软件、硬件、用户、机构、安全云平台的总称。云安全融合了并行处理、网格计算、未知病毒行为判断等新兴技术和概念，通过网状的大量客户端对网络中软件行为的异常监测，获取互联网中木马、恶意程序的最新信息，并发送到服务端进行自动分析和处理，再把病毒和木马的解决方案分发到每一个客户端。
云安全主要研究方向包括：1、云计算安全，主要研究如何保障云自身及云上各种应用的安全，包括云计算机***安全、用户数据的安全存储与隔离、用户接入认证、信息传输安全、网络攻击防护、合规审计等；2、安全基础设施的云化，主要研究如何采用云计算新建与整合安全基础设施资源，优化安全防护机制，包括通过云计算技术构建超大规模安全事件、信息采集与处理平台，实现对海量信息的采集与关联分析，提升全网安全事件把控能力及风险控制能力；3、云安全服务，主要研究各种基于云计算平台为用户提供的安全服务，如防病毒服务等。
云安全属于云技术下的一个重要部分，云技术(cloud technology)是指在广域网或局域网内将硬件、软件、网络等系列资源统一起来，实现数据的计算、储存、处理和共享的一种托管技术。云技术基于云计算商业模式应用的网络技术、信息技术、整合技术、管理平台技术、应用技术等的总称，可以组成资源池，按需所用，灵活便利。云计算技术将变成重要支撑。技术网络***的后台服务需要大量的计算、存储资源，如视频网站、图片类网站和更多的门户网站。伴随着互联网行业的高度发展和应用，将来每个物品都有可能存在自己的识别标志，都需要传输到后台***进行逻辑处理，不同程度级别的数据将会分开处理，各类行业数据皆需要强大的***后盾支撑，只能通过云计算来实现。
结合图1所示的信息验证***，为了便于理解，请参阅图2，图2为本申请实施例中信息验证***的一个应用架构示意图，如图所示，终端设备上部署有第三方应用以及端到端客户端(client)，当用户启动第三方应用时，可自动拉起端到端客户端，用户通过端到端客 户端填写待验证信息。下面将分别介绍信息验证***中各个应用部分的定义。
1、第三方应用：网页或者客户端等应用，例如，电商平台或者游戏平台等。
2、第三方应用的应用服务器：用于提供第三方应用服务，例如，为一个具备登录逻辑的网站服务器。
3、端到端客户端：供第三方应用进行调用的程序，例如，第三方应用的前端是网页(web)模式，那么端到端客户端可以是一个爪哇脚本(JavaScript，JS)程序或者小应用程序(Applet)。又例如，第三方应用的前端是一个应用程序，那么对于安卓***而言，端到端客户端可以是一个爪哇归档(Java Archive，JAR)包，对于苹果公司开发的移动操作***(iPhone operation system，iOS)而言，端到端客户端可以是一个so动态库。
4、身份授权服务前置：用于提供与第三方应用对接通信功能，负责整体接入层对接，相当于一个“网关”的功能。
5、端到端加密服务：用于实现端到端加密密钥协商功能以及具有与加密机对接能力，其中，端到端加密服务部署于验证服务器上。
6、认证服务：用于提供身份认证服务，例如，提供对于用户名和密码正确性的验证，其中，认证服务部署于验证服务器上。
7、授权服务：用于提供令牌(token)全生命周期管理的服务，例如，token的颁发，token的验证以及token的失效验证等，其中，授权服务部署于验证服务器上。
8、加密机：是指符合国家密码局要求的加密机，用于提供加解密等基本能力和密钥安全存储能力，能够实现密钥的全生命周期的管理。
9、数据库，用于数据存储的服务器。
结合上述介绍，下面将从验证服务器的角度，对本申请中信息验证的方法进行介绍，请参阅图3，本申请实施例中信息验证方法的一个实施例包括：
101、验证服务器响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数。
在一种可能的实现方式中，公钥以及第一随机数为加密机生成的。
本实施例中，当目标用户启动终端设备上的第三方应用时，可自动拉起端到端客户端，由此，终端设备通过端到端客户端向验证服务器发送密钥协商请求。该密钥协商请求中携带目标用户的标识，基于此，验证服务器可建立与终端设备通信的会话。验证服务器根据密钥协商请求，调用加密机以生成本次密钥协商所需的密钥协商数据，即由加密机生成密钥协商数据，并反馈给验证服务器。其中，密钥协商数据包括公钥(pubkey)以及第一随机数(random)，第一随机数(random)可以是由美国信息交换标准代码(American Standard Code for Information Interchange，ASCII)组成的随机数。
为了便于理解，下面将结合图4介绍密码协商流程，请参阅图4，图4为本申请实施例中密钥协商的一个流程示意图，如图所示，具体地：
在步骤A1中，用户打开第三方应用，通过第三方应用(即客户端或网页等)向第三方应用的应用服务器发起认证请求。
在步骤A2中，第三方应用的应用服务器响应于该认证请求，向第三方应用发送调度请 求，使得第三方应用响应调度请求，并且调起端到端客户端。
在步骤A3中，部署于终端设备上的端到端客户端向第三方应用的应用服务器发起密钥协商请求，可选地，部署于终端设备上的端到端客户端也可以直接向验证服务器发起密钥协商请求(在此可选的方式下，可直接跳转至步骤A5)。
在步骤A4中，由第三方应用的应用服务器将密钥协商请求透传到验证服务器，其中，透传指的是在通讯中只负责将传输的内容由源地址传输到目的地址，而不对业务数据内容做任何改变。
在步骤A5中，验证服务器响应于密钥协商请求，并通过调用加密机获取密钥协商数据，其中，密钥协商数据包括公钥(pubkey)以及第一随机数(random)等。
在步骤A6中，验证服务器向第三方应用的应用服务器发送公钥(pubkey)以及第一随机数(random)等密钥协商数据。
在步骤A7中，由第三方应用的应用服务器将密钥协商数据透传到终端设备，其中，由部署于在终端设备上的端到端客户端接收密钥协商数据。
在步骤A8中，密钥协商数据存储于终端设备本地。
102、验证服务器向终端设备发送密钥协商数据，以使终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息。
在一种可能的实现方式中，第二随机数为终端设备生成的。
本实施例中，验证服务器向终端设备发送密钥协商数据，由部署在终端设备上的端到端客户端采用第二随机数(challenge)以及密钥协商数据所包括的公钥(pubkey)以及第一随机数(random)，对目标用户输入的待验证信息进行加密处理，由此得到待验证密文信息，其中，第二随机数(challenge)可以是由ASCII组成的随机数。可以理解的是，当目标用户想要登录第三方应用时，应输入登录该目标应用所需的用户信息，即待验证信息，其中，待验证信息包括目标用户的用户信息，例如，用户名、用户账号、用户密码、用户手机号、用户邮箱以及用户身份证号码等，此处不做限定。
具体地，待验证密文信息属于“数字信封”，“数字信封”是将对称密钥通过非对称加密的结果分发对称密钥的方法，数字信封是实现信息保密性验证的技术。采用对称密码算法对消息进行加密(消息类似于信纸上的内容)，采用非对称密码算法对对称密钥加密(类似于信封)，信封将信纸包装起来，从而保证了消息的安全性。
103、验证服务器接收终端设备发送的待验证密文信息；
本实施例中，终端设备向验证服务器发送待验证密文信息，其中，待验证密文信息即为已经加密后的待验证信息，因此，对于第三方应用的应用服务器而言，是无法直接获取到待验证信息的。
在一种可能的实现方式中，验证服务器还可以接收终端设备发送的会话标识，会话标识(session ID)是一个会话的标识，每次访问验证服务器，会在验证服务器端生成一个会话(session)，在相同会话下可进行目标用户的身份验证。
104、验证服务器对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘 要；
本实施例中，验证服务器可以例如根据会话标识(session ID)，获取对应的公钥(pubkey)，使用公钥(pubkey)对待验证密文信息进行解密处理，得到待验证信息所对应的第一信息摘要。这里之所以得到的是第一信息摘要，是考虑到直接破解出待验证信息并不安全，因此，对于验证服务器而言，并不会直接获取到待验证信息，而是通过调用加密机对待验证密文信息进行解密处理之后得到第一信息摘要，并根据会话标识(session ID)从数据库中获取目标用户对应的第二信息摘要。
可以理解的是，目标用户在注册时会填写相应的信息，例如，用户名、用户账号、用户密码、用户手机号、用户邮箱以及用户身份证号码等，此处不做限定。基于此，验证服务器可调用加密机生成注册信息所对应的第二信息摘要。
105、验证服务器对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，第二信息摘要为已存储的信息摘要；
本实施例中，验证服务器将第一信息摘要和第二信息摘要进行对比，由此得到比对结果，该比对结果即为信息验证结果。
为了便于理解，下面将结合图5介绍信息验证流程，请参阅图5，图5为本申请实施例中信息验证的一个流程示意图，如图所示，具体地：
在步骤B1中，目标用户打开第三方应用，通过第三方应用(即客户端或网页等)调起端到端客户端，用户通过端到端客户端输入待验证信息。
在步骤B2中，端到端客户端得到明文的待验证信息。
在步骤B3中，端到端客户端使用第二随机数(challenge)、公钥(pubkey)以及第一随机数(random)，对待验证信息进行加密处理，由此得到待验证密文信息。
在步骤B4中，端到端客户端通过超文本传输安全协议(Hyper Text Transfer Protocol over Secure Socket Layer，HTTPS)将待验证密文信息发送至第三方应用的应用服务器。应用服务器通过安全套接字协议(Secure Sockets Layer，SSL)将待验证密文信息透传到验证服务器。
在步骤B5中，验证服务器调用加密机对待验证密文信息进行解密处理，得到第一信息摘要。
在步骤B6中，验证服务器调用数据库以得到第二信息摘要。
在步骤B7中，将第一信息摘要和第二信息摘要进行比对，得到信息验证结果。
在步骤B8中，由第三方应用的应用服务器将信息验证结果透传到终端设备，由部署于终端设备的端到端客户端接收该信息验证结果。
在步骤B9中，通过部署于终端设备的端到端客户端展示信息验证结果。
106、验证服务器向终端设备发送信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本实施例中，验证服务器向终端设备发送信息验证结果，终端设备可以展示该信息验证结果。具体地，如果信息验证结果用于指示验证成功，则表示目标用户可通过终端设备登录到第三方应用的应用服务器。如果信息验证结果用于指示验证失败，则表示目标用户 无法通过终端设备登录到第三方应用的应用服务器。
本申请实施例中，提供了一种信息验证的方法，通过上述方式，终端设备在传输待验证信息之前，使用随机数和验证服务器颁发的公钥对待验证信息进行加密，从而得到待验证密文信息，于是在传输过程中全程使用待验证密文信息，第三方应用的服务器即使获取到待验证密文信息，也无法破解出待验证信息，只有验证服务器才能获取到待验证信息，因此，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，验证服务器获取密钥协商数据，具体可以包括：
验证服务器向加密机发送密文生成请求，以使加密机响应于密文生成请求，生成密文数据，其中，密文数据包括公钥以及第一随机数；
验证服务器接收加密机发送的密文数据；
验证服务器根据密文数据所包括的公钥以及第一随机数，生成密钥协商数据。
本实施例中，介绍了一种端到端客户端与验证服务器进行密钥协商的方式。验证服务器可通过调用加密机以获取密文数据，即先向加密机发送密文生成请求，加密机根据该密文生成请求生成密文数据，其中，该密文数据包括公钥(pubkey)以及第一随机数(random)，且公钥(pubkey)以及第一随机数(random)属于密钥协商数据的一部分，基于此，验证服务器得到密钥协商数据。
为了便于理解，请参阅图6，图6为本申请实施例中密钥协商的一个整体流程示意图，如图所示，具体地：
在步骤C1中，目标用户打开第三方应用的页面或者客户端。
在步骤C2中，第三方应用的页面或者客户端向第三方应用的应用服务器发送HTTPS请求。
在步骤C3中，应用服务器调用验证服务器的API，调用的前提是三方应用开发方提前向验证服务器申请用于进行对接的应用密钥索引(AppKey)和第一应用密钥(AppSecret)，验证服务器会通过应用密钥索引(AppKey)和应用密钥(AppSecret)进行鉴权。
在步骤C4中，验证服务器包括身份授权服务前置和端到端加密服务两个部分，身份授权服务前置在鉴权第三方应用的调用请求之后，调用端到端加密服务的接口，并以此请求密钥协商。
在步骤C5中，端到端加密服务调用加密机，以生成本次密钥协商的密钥协商数据。
在步骤C6中，加密机生成公钥(pubkey)以及第一随机数(random)此外，加密机还可以生成公钥索引值(pubkeyIndex)，其中，公钥索引值(pubkeyIndex)与公钥(pubkey)具有唯一对应关系，公钥(pubkey)、第一随机数(random)和公钥索引值(pubkeyIndex)可共同作为密文数据。
在步骤C7中，加密机将密文数据反馈给端到端加密服务。
在步骤C8中，端到端加密服务生成会话标识(session ID)，并构建会话标识(session ID)、公钥索引值(pubkeyIndex)、公钥(pubkey)以及第一随机数(random)之间的映射关系， 并可以将会话标识(session ID)、公钥(pubkey)以及第一随机数(random)作为密钥协商数据。
在步骤C9中，端到端加密服务将密钥协商数据返回至身份授权服务前置。
在步骤C10中，身份授权服务前置将密钥协商数据返回至第三方应用的应用服务器。
在步骤C11中，第三方应用的应用服务器将密钥协商数据返回至第三方应用的页面或者客户端。
在步骤C12中，由第三方应用的页面或者客户端调用端到端客户端，以设置密钥协商数据，需要说明的是，端到端客户端在本地生成第二随机数(challenge)，结合密钥协商数据所包括的公钥(pubkey)和第一随机数(random)即可对信息进行加密。
在步骤C13中，端到端客户端采用临时存储的方式存储密钥协商数据，用于后续的交互中使用。
其次，本申请实施例中，提供了一种端到端客户端与验证服务器进行密钥协商的方式，通过上述方式，基于密钥协商过程得到密钥协商数据，由此，可使用密钥协商数据对用户的敏感信息进行加密，使其不会暴露给第三方应用，同时通过端到端加密技术实现用户敏感信息的安全传输和存储。此外，整个过程对于用户而言是无感知的，具有较好的体验。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，密文数据还包括公钥索引值，公钥索引值与公钥具有唯一对应关系；
验证服务器根据密文数据所包括的公钥以及第一随机数，生成密钥协商数据，具体可以包括：
验证服务器根据密钥协商请求所包括的目标用户的标识，生成会话标识；
验证服务器根据会话标识、公钥以及第一随机数，生成密钥协商数据；
还可以包括：
验证服务器建立会话标识、公钥、第一随机数以及公钥索引值之间的映射关系；
相应的，前述步骤104：验证服务器对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要，具体可以包括：
验证服务器基于映射关系，根据会话标识对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要。
本实施例中，介绍了一种在验证服务器侧实现密码验证的方式。加密机基于密文生成请求，不仅可以生成公钥(pubkey)以及第一随机数(random)，还可以生成与该公钥(pubkey)具有唯一对应关系的公钥索引值(pubkeyIndex)，由此，将成公钥(pubkey)、第一随机数(random)和公钥索引值(pubkeyIndex)共同作为密文数据。验证服务器根据密钥协商请求所包括的目标用户的标识，还可以生成与该目标用户具有对应关系的会话标识(session ID)，并将会话标识(session ID)、公钥(pubkey)以及第一随机数(random)共同作为密钥协商数据。
具体地，为了便于后续的验证，验证服务器可构建会话标识(session ID)、公钥(pubkey)、第一随机数(random)以及公钥索引值(pubkeyIndex)之间的映射关系，以便于快速查找这些数据之间的关联关系。即，验证服务器基于映射关系，根据会话标识(session ID)可 查找到对应的公钥(pubkey)、第一随机数(random)以及公钥索引值(pubkeyIndex)，由此，验证服务器能够对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要。
可以理解的是，验证服务器可将会话标识(session ID)、公钥(pubkey)、第一随机数(random)以及公钥索引值(pubkeyIndex)存储在数据库中，或者存储于加密机中，又或者存储器区块链中。
其中，区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。区块链(Blockchain)，本质上是一个去中心化的数据库，是一串使用密码学方法相关联产生的数据块，每一个数据块中包含了一批次网络交易的信息，用于验证其信息的有效性(防伪)和生成下一个区块。区块链可以包括区块链底层平台、平台产品服务层以及应用服务层。
区块链底层平台可以包括用户管理、基础服务、智能合约以及运营监控等处理模块。其中，用户管理模块负责所有区块链参与者的身份信息管理，包括维护公私钥生成(账户管理)、密钥管理以及用户真实身份和区块链地址对应关系维护(权限管理)等，并且在授权的情况下，监管和审计某些真实身份的交易情况，提供风险控制的规则配置(风控审计)；基础服务模块部署在所有区块链节点设备上，用来验证业务请求的有效性，并对有效请求完成共识后记录到存储上，对于一个新的业务请求，基础服务先对接口适配解析和鉴权处理(接口适配)，然后通过共识算法将业务信息加密(共识管理)，在加密之后完整一致的传输至共享账本上(网络通信)，并进行记录存储；智能合约模块负责合约的注册发行以及合约触发和合约执行，开发人员可以通过某种编程语言定义合约逻辑，发布到区块链上(合约注册)，根据合约条款的逻辑，调用密钥或者其它的事件触发执行，完成合约逻辑，同时还提供对合约升级注销的功能；运营监控模块主要负责产品发布过程中的部署、配置的修改、合约设置、云适配以及产品运行中的实时状态的可视化输出，例如：告警、监控网络情况、监控节点设备健康状态等。
平台产品服务层提供典型应用的基本能力和实现框架，开发人员可以基于这些基本能力，叠加业务的特性，完成业务逻辑的区块链实现。应用服务层提供基于区块链方案的应用服务给业务参与方进行使用。
再次，本申请实施例中，提供了一种在验证服务器侧实现密码验证的方式，通过上述方式，能够在不以明文显示待验证信息的前提下，实现用户的身份验证，即验证服务器仅获取待验证信息的第一信息摘要即可，由此，进一步提升了验证的安全性性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，验证服务器基于映射关系，根据会话标识对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要，具体可以包括：
验证服务器基于映射关系，根据会话标识从数据库中获取公钥索引值；
验证服务器向加密机发送公钥索引值，以使加密机根据公钥索引值确定公钥；
验证服务器调用加密机对待验证密文信息进行解密处理，得到第一信息摘要，其中，第一信息摘要为加密机采用公钥所对应的私钥对待验证密文信息进行解密处理后得到的。
本实施例中，介绍了一种在验证服务器侧获取第一信息摘要的方式。由前述实施例可知，待验证密文信息属于“数字信封”，下面将介绍对待验证密文信息进行解密的过程。
具体地，请参阅图7，图7为本申请实施例中对待验证密文信息进行解密的一个示意图，如图所示，待验证密文信息包括两个部分，一部分为对称密钥的密钥密文(saeskey)，另一部分为传输密文(spassword)，即待验证密文信息为spassword+saeskey，其中，spassword＝AES(challenge+random,SHA256(password)。密钥密文(saeskey)是由用公钥(pubkey)对对称密钥(random+challenge)进行加密处理后得到的。
在图7对应的场景下，待验证密文信息是终端设备根据密钥密文以及传输密文生成的，相应的，本申请实施例中，提供了一种在验证服务器侧获取第一信息摘要的方式。
在一种可能的实现方式中，前述步骤104包括：
通过所述公钥对应的私钥对所述密钥密文进行解密处理，得到作为对称密钥的所述第一随机数和所述第二随机数；
通过所述对称密钥对所述传输密文进行解密处理，得到所述第一信息摘要。
也就是说，基于密钥密文以及传输密文生成待验证密文信息，首先验证服务器基于映射关系，从数据库中查找会话标识所对应的公钥索引值(pubkeyIndex)，然后将公钥索引值(pubkeyIndex)发送给加密机，加密机根据公钥索引值(pubkeyIndex)找到对应的公钥(pubkey)，并进一步获取该公钥(pubkey)所对应的私钥。于是，加密机使用该私钥对密钥密文(saeskey)进行解密，由此得到对称密钥(random+challenge)。然后，采用对称密钥(random+challenge)对传输密文(spassword)进行解密，即可得到第一信息摘要(SHA256(password))。
进一步地，本申请实施例中，提供了一种在验证服务器侧获取第一信息摘要的方式，通过上述方式，验证服务器调用加密机以实现对待验证密文信息的解密，也就是说，公钥存储于具有较高安全性的加密机中，进而提升信息解密的安全性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，验证服务器对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果之前，还可以包括：
验证服务器从数据库中获取密钥索引值以及待匹配密文信息；
验证服务器向加密机发送密钥索引值以及待匹配密文信息，以使加密机根据密钥索引值确定信息加密密钥；
验证服务器调用加密机对待匹配密文信息进行解密处理，得到第二信息摘要，其中，第二信息摘要为加密机采用信息加密密钥对待匹配密文信息进行解密处理后得到的。
本实施例中，介绍了一种在验证服务器侧获取第二信息摘要的方式。在验证服务器对第一信息摘要和第二信息摘要进行比对之前，还需要获取第二信息摘要，在一种实现方式中，可将第二信息摘要存放在数据库中，在需要使用的时候直接比对即可。在另一种实现方式中，还可以通过解密的方式解出第二信息摘要，下面将对解密得到第二信息摘要的方式进行介绍。
具体地，验证服务器从数据库中查找会话标识(session ID)所对应的密钥索引值 (passwordKeyIndex)以及待匹配密文信息(encPassword)，于是验证服务器向加密机发送密钥索引值(passwordKeyIndex)以及待匹配密文信息(encPassword)，加密机首先根据密钥索引值(passwordKeyIndex)确定信息加密密钥(passwordKey)。接下来，验证服务器调用加密机对待匹配密文信息进行解密处理，从而得到第二信息摘要，第二信息摘要表示为SHA256(password_logon)，其中，password_logon即为用户在注册使所填写的用户信息，例如，用户账号，用户密码，手机号等信息。可以理解的是，待匹配密文信息(encPassword)是采用如下方式得到的：
encPassword＝AES(passwordKey,SHA256(password_logon))；
而由于信息加密密钥(passwordKey)存储在加密机中，所以实际的计算逻辑是：
encPassword＝AES(passwordKeyIndex,SHA256(password_logon))；
由加密机拿到密钥索引值(passwordKeyIndex)之后，在加密机内部读取信息加密密钥(passwordKey)，然后进行加密处理或解密处理。
其次，本申请实施例中，提供了一种在验证服务器侧获取第二信息摘要的方式，通过上述方式，验证服务器调用加密机以实现对待匹配密文信息的解密，也就是说，信息加密密钥存储于具有较高安全性的加密机中，进而提升信息解密的安全性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，验证服务器对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果之后，还可以包括：
若信息验证结果指示验证成功，则验证服务器生成令牌，其中，令牌配置有预设使用周期；
验证服务器向终端设备发送令牌；
当接收到终端设备发送的应用登录请求时，验证服务器响应于应用登录请求，获取令牌的使用时间，其中，应用登录请求携带令牌；
若令牌的使用时间在预设使用周期内，则验证服务器向终端设备发送应用登录成功消息。
本实施例中，介绍了一种验证服务器为端到端客户端颁发令牌。如果信息验证结果指示验证成功，那么验证服务器还可以生成一个令牌(token)，并向终端设备部署的端到端客户端颁发该令牌(token)。当目标用户再次登录目标应用时，直接使用令牌(token)，即可，而验证服务器需要验证的是该令牌(token)是否到期，假设令牌(token)的预设使用周期是2021年2月1日至2021年4月1日，那么在此期间使用令牌(token)，即可登录至第三方应用的应用服务器。
为了便于理解，下面将结合图8介绍验证令牌流程，请参阅图8，图8为本申请实施例中令牌验证的一个流程示意图，如图所示，具体地：
在步骤D1中，验证服务器获取信息验证结果。
在步骤D2中，如果信息验证结果为验证成功，则验证服务器生成一个令牌。
在步骤D3中，验证服务器将令牌透传到第三方应用的应用服务器，由应用服务器向部署于终端设备的端到端客户端接收该令牌。
在步骤D4中，端到端客户端将令牌存储在终端设备本地。
在步骤D5中，目标用户再次打开第三方应用，直接使用令牌进行验证。
在步骤D6中，端到端客户端判断该令牌是否过期，如果没有过期，则将该令牌发送至第三方应用的应用服务器。
在步骤D7中，由应用服务器验证该令牌是否有效，如果验证有效，则将令牌发送至验证服务器。
在步骤D8中，由验证服务器验证该令牌是否有效，并将验证结果反馈给应用服务器。
在步骤D9中，应用服务器根据返回的验证结果，确定目标用户本次登录是否成功。
在步骤D10中，通过部署于终端设备的端到端客户端展示本次登录的结果。
其次，本申请实施例中，提供了一种验证服务器为端到端客户端颁发令牌，通过上述方式，在用户首先验证成功之后，后续可使用令牌登录，从而减少用户信息被暴露的风险。此外，用户无需跳转到身份授权服务器进行验证，第三方应用与身份授权服务对接过程无需前端对接逻辑，减少了对接过程。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，验证服务器响应于终端设备发送的密钥协商请求，获取密钥协商数据之前，还可以包括：
若终端设备开启目标应用，则验证服务器接收应用服务器发送的鉴权请求，其中，鉴权请求携带应用密钥索引和应用密钥；
验证服务器响应于鉴权请求，对应用密钥索引和应用密钥进行验证处理，得到验证结果；
若验证结果为验证成功，则验证服务器执行响应于终端设备发送的密钥协商请求，获取密钥协商数据的步骤。
本实施例中，介绍了一种验证服务器对第三方应用进行鉴权的方式。目标用户打开第三方应用的页面或者客户端之后，第三方应用的页面或者客户端向第三方应用的应用服务器发送HTTPS请求，应用服务器调用验证服务器的应用程序接口(Application Programming Interface，API)，其中，调用的前提是三方应用开发方提前向验证服务器申请用于进行对接的应用密钥索引(AppKey)和应用密钥(AppSecret)，验证服务器会通过应用密钥索引(AppKey)和应用密钥(AppSecret)进行鉴权。
具体地，在目标用户打开第三方应用的页面或者客户端之后，通过第三方应用的应用服务器向验证服务器发送鉴权请求，其中，鉴权请求携带应用密钥索引(AppKey)和应用密钥(AppSecret)，可选地，还可以携带目标应用的应用标识(AppID)。其中，应用标识(AppID)为目标应用的唯一标识，应用密钥索引(AppKey)相当于验证服务器为应用服务器分配的账号，应用密钥(AppSecret)相当于验证服务器为应用服务器分配的密码。基于此，验证服务器验证应用密钥索引(AppKey)和应用密钥(AppSecret)在数据库中是否存在记录，如果存在记录，则表示验证结果为验证成功，由此，验证服务器可以执行后续的操作。
其次，本申请实施例中，提供了一种验证服务器对第三方应用进行鉴权的方式，通过上述方式，验证服务器在对用户进行身份验证之前，还需要对第三方应用进行鉴权，从而 增加数据交互的安全性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，验证服务器响应于终端设备发送的密钥协商请求，获取密钥协商数据之前，还可以包括：
若终端设备开启目标应用，则验证服务器接收应用服务器发送的鉴权请求，其中，鉴权请求携带应用密钥索引、时间戳、签名随机数以及第一签名信息，第一签名信息为基于散列函数加密算法对第一应用密钥、时间戳以及签名随机数进行签名后得到的；
验证服务器响应于鉴权请求，根据应用密钥索引获取第二应用密钥；
验证服务器基于散列函数加密算法对第二应用密钥、时间戳以及签名随机数进行签名，得到第二签名信息；
若第一签名信息和第二签名信息匹配成功，则验证服务器执行响应于终端设备发送的密钥协商请求，获取密钥协商数据的步骤。
本实施例中，介绍了另一种验证服务器对第三方应用进行鉴权的方式。目标用户打开第三方应用的页面或者客户端之后，第三方应用的页面或者客户端向第三方应用的应用服务器发送HTTPS请求，应用服务器调用验证服务器的API，其中，调用的前提是三方应用开发方提前向验证服务器申请用于进行对接的应用密钥索引(AppKey)和第一应用密钥(AppSecret)，验证服务器会通过应用密钥索引(AppKey)和第一应用密钥(AppSecret)进行鉴权。
具体地，在目标用户打开第三方应用的页面或者客户端之后，通过第三方应用的应用服务器向验证服务器发送鉴权请求，其中，鉴权请求携带应用密钥索引(AppKey)、时间戳、签名随机数以及第一签名信息，其中，第一签名信息是应用服务器采用散列函数加密算法对第一应用密钥(AppSecret)、时间戳以及签名随机数进行签名后得到的。需要说明的是，散列函数加密算法包含但不仅限于采用安全散列算法1(Secure Hash Algorithm，SHA1)，以及采用安全散列算法256(Secure Hash Algorithm，SHA256)等。
应用密钥索引(AppKey)相当于验证服务器为应用服务器分配的账号，第一应用密钥(AppSecret)相当于验证服务器为应用服务器分配的密码。基于此，验证服务器基于应用密钥索引(AppKey)，查找该应用密钥索引(AppKey)对应的第二应用密钥(AppSecret)，于是采用相同的散列函数加密算法，对第二应用密钥(AppSecret)、时间戳以及签名随机数进行签名，得到第二签名信息。最后，将本地的第二签名信息与接收到的第一签名信息进行比对，如果比对结果一致，即第一签名信息和第二签名信息匹配成功，由此，验证服务器可以执行后续的操作。
其次，本申请实施例中，提供了另一种验证服务器对第三方应用进行鉴权的方式，通过上述方式，验证服务器在对用户进行身份验证之前，还需要对第三方应用进行鉴权，从而增加数据交互的安全性。
结合前述实施例，为了便于理解，请参阅图9，图9为本申请实施例中信息验证以及令牌颁发的一个整体流程示意图，如图所示，具体地：
在步骤E1中，目标用户进行登录操作，输入待验证信息，例如，用户名和密码等。
在步骤E2中，第三方应用调用端到端客户端，端到端客户端生成第二随机数(challenge)， 将第一随机数(random)和第二随机数(challenge)共同作为对称加密算法所使用的对称密钥。基于非对称加密算法，用公钥(pubkey)对对称密钥(random+challenge)进行加密处理，得到对称密钥的密钥密文(saeskey)。部署于终端设备的端到端客户端还需要基于散列函数加密算法，对待验证信息进行摘要计算，得到第一信息摘要(SHA256(password))。端到端客户端再基于对称加密算法，对对称密钥以及第一信息摘要进行加密处理，得到传输密文(spassword)。
其中，spassword＝AES(challenge+random,SHA256(password)。
在步骤E3中，端到端客户端生成待验证密文信息，其中，待验证密文信息由传输密文(spassword)和密钥密文(saeskey)组成。
在步骤E4中，端到端客户端将待验证密文信息返回给第三方应用。
在步骤E5中，第三方应用将待验证密文信息携带于登录请求中，并发送至第三方应用的应用服务器。
在步骤E6中，第三方应用的应用服务器调用验证服务器中身份授权服务前置的API。
在步骤E7中，身份授权服务前置调用认证服务的API进行验证。
在步骤E8中，认证服务首先校验目标用户是否存在，并且交易是否为本***的正常状态的用户，如果校验成功，则从数据库中取出会话标识(sessionID)，通过会话标识(sessionID)向端到端加密服务发送请求。
在步骤E9中，端到端加密服务通过会话标识(sessionID)，获取存储在数据库中的的公钥索引值(pubkeyIndex)，同时，还可以获取密钥索引值(passwordKeyIndex)以及待匹配密文信息(encPassword)。
在步骤E10中，端到端加密服务调用加密机进行解密。
在步骤E11中，加密机进行解密。
在步骤E12中，端到端加密服务得到解密后的对称密钥(random+challenge)，进而得到第一信息摘要(SHA256(password))，同时根据数据库中的数据解密得到第二信息摘要(SHA256(password_logon))。
在步骤E13中，端到端加密服务比对第一信息摘要(SHA256(password))和第二信息摘要(SHA256(password_logon))是否一致，由此得到信息验证结果。
在步骤E14中，端到端加密服务将信息验证结果返回给认证服务。
在步骤E15中，认证服务根据信息验证结果，调用授权服务，由此获取用户访问授权的令牌(token)。
在步骤E16中，授权服务生成的令牌(token)返回给认证服务。
在步骤E17中，认证服务将信息验证结果返回给身份授权服务前置。
在步骤E18中，身份授权服务前置将信息验证结果返回给第三方应用的应用服务器。
在步骤E19中，第三方应用的应用服务器将验证结果返回给第三方应用。
在步骤E20中，目标用户获取信息验证结果。
在步骤E21中，后续目标用户再登录该第三方应用(即目标用于)，可使用令牌(token)进行身份验证，除非令牌(token)过期后无法使用。
结合上述介绍，下面将从终端设备的角度，对本申请中信息验证的方法进行介绍，请参阅图10，本申请实施例中信息验证方法的另一个实施例包括：
201、终端设备向验证服务器发送密钥协商请求，以使验证服务器响应于密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数。
在一种可能的实现方式中，公钥以及第一随机数为加密机生成的；
本实施例中，当目标用户启动终端设备上的第三方应用时，可自动拉起端到端客户端，由此，终端设备通过端到端客户端向验证服务器发送密钥协商请求。该密钥协商请求中携带目标用户的标识，基于此，验证服务器可建立与终端设备通信的会话。验证服务器根据密钥协商请求，调用加密机以生成本次密钥协商所需的密钥协商数据，即由加密机生成密钥协商数据，并反馈给验证服务器。其中，密钥协商数据包括公钥(pubkey)以及第一随机数(random)，第一随机数(random)可以是由ASCII组成的随机数。
202、终端设备接收验证服务器发送的密钥协商数据；
本实施例中，验证服务器向终端设备发送密钥协商数据，由部署在终端设备上的端到端客户端接收该密钥协商数据。
203、终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息。
在一种可能的实现方式中，第二随机数为终端设备生成的；
本实施例中，终端设备基于端到端客户端生成第二随机数(challenge)，于是终端设备采用第二随机数(challenge)以及密钥协商数据所包括的公钥(pubkey)以及第一随机数(random)，对目标用户输入的待验证信息进行加密处理，由此得到待验证密文信息，其中，第二随机数(challenge)可以是由ASCII组成的随机数。可以理解的是，当目标用户想要登录第三方应用时，应输入登录该目标应用所需的用户信息，即待验证信息，其中，待验证信息包括目标用户的用户信息，例如，用户名、用户账号、用户密码、用户手机号、用户邮箱以及用户身份证号码等，此处不做限定。
具体地，待验证密文信息属于“数字信封”，“数字信封”是将对称密钥通过非对称加密的结果分发对称密钥的方法，数字信封是实现信息保密性验证的技术。采用对称密码算法对消息进行加密(消息类似于信纸上的内容)，采用非对称密码算法对对称密钥加密(类似于信封)，信封将信纸包装起来，从而保证了消息的安全性。
204、终端设备向验证服务器发送待验证密文信息，以使验证服务器对待验证密文信息进行解密处理，得到第一信息摘要，并对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；
本实施例中，终端设备向验证服务器发送待验证密文信息以及会话标识(会话标识为可选项)，其中，待验证密文信息即为已经加密后的待验证信息，因此，对于第三方应用的应用服务器而言，是无法直接获取到待验证信息的。而会话标识(session ID)是一个会话的标识，每次访问验证服务器，会在验证服务器端生成一个会话(session)，在相同会话下 可进行目标用户的身份验证。
具体地，验证服务器可以例如根据会话标识(session ID)，获取对应的公钥(pubkey)，使用公钥(pubkey)对待验证密文信息进行解密处理，得到待验证信息所对应的第一信息摘要。这里之所以得到的是第一信息摘要，是考虑到直接破解出待验证信息并不安全，因此，对于验证服务器而言，并不会直接获取到待验证信息，而是通过调用加密机对待验证密文信息进行解密处理之后得到第一信息摘要，并根据会话标识(session ID)从数据库中目标用户对应的第二信息摘要。
可以理解的是，目标用户在注册时会填写相应的信息，例如，用户名、用户账号、用户密码、用户手机号、用户邮箱以及用户身份证号码等，此处不做限定。基于此，验证服务器可调用加密机生成注册信息所对应的第二信息摘要。
205、终端设备接收验证服务器发送的信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本实施例中，验证服务器将第一信息摘要和第二信息摘要进行对比，由此得到比对结果，该比对结果即为信息验证结果。由验证服务器向终端设备发送信息验证结果，终端设备可以展示该信息验证结果。具体地，如果信息验证结果用于指示验证成功，则表示目标用户可通过终端设备登录到第三方应用的应用服务器。如果信息验证结果用于指示验证失败，则表示目标用户无法通过终端设备登录到第三方应用的应用服务器。
本申请实施例中，提供了一种信息验证的方法，通过上述方式，终端设备在传输待验证信息之前，使用随机数和验证服务器颁发的公钥对待验证信息进行加密，从而得到待验证密文信息，于是在传输过程中全程使用待验证密文信息，第三方应用的服务器即使获取到待验证密文信息，也无法破解出待验证信息，只有验证服务器才能获取到待验证信息，因此，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的另一个可选实施例中，终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，具体可以包括：
终端设备生成第二随机数；
终端设备将第一随机数以及第二随机数作为对称加密算法所使用的对称密钥；
终端设备基于非对称加密算法，采用密钥协商数据所包括的公钥，对对称密钥进行加密处理，得到对称密钥的密钥密文；
终端设备基于散列函数加密算法，对目标应用的待验证信息进行摘要计算，得到第一信息摘要；
终端设备基于对称加密算法，对对称密钥以及第一信息摘要进行加密处理，得到传输密文；
终端设备根据密钥密文以及传输密文生成待验证密文信息。
本实施例中，介绍了一种端到端客户端采用密钥协商数据对待验证信息进行加密处理的方式。由前述实施例可知，待验证密文信息属于“数字信封”，下面将介绍生成待验证密 文信息的方式。
具体地，请参阅图11，图11为本申请实施例中生成待验证密文信息的一个示意图，如图所示，部署于终端设备上的端到端客户端生成一个第二随机数(challenge)，而验证服务器发送的密钥协商数据中包括公钥(pubkey)、第一随机数(random)，因此，将第一随机数(random)和第二随机数(challenge)共同作为对称加密算法所使用的对称密钥。需要说明的是，对称加密算法包含但不仅限于高级加密标准(Advanced Encryption Standard，AES)，数据加密标准(Data Encryption Standard，DES)以及三重数据加密算法(Triple Data Encryption Algorithm，TDEA)等，本申请以AES作为对称加密算法，然而这不应理解为对本申请的限定。
基于此，基于非对称加密算法，用公钥(pubkey)对对称密钥(random+challenge)进行加密处理，得到对称密钥的密钥密文(saeskey)。部署于终端设备的端到端客户端还需要基于散列函数加密算法，对待验证信息进行摘要计算，得到第一信息摘要。需要说明的是，散列函数加密算法包含但不仅限于SHA1和SHA256，本申请以采用SHA256作为散列函数加密算法，然而这并不应理解为对本申请的限定。因此，假设待验证信息为“password”，且待验证信息为明文的形式，因此，需要对待验证信息进行加密，于是采用散列函数加密算法对待验证信息进行加密，例如，采用的散列函数加密算法为SHA256，那么得到的第一信息摘要可以表示为SHA256(password)。
端到端客户端再基于对称加密算法，对对称密钥以及第一信息摘要进行加密处理，得到传输密文。例如，使用AES算法对对称密钥和第一信息摘要进行加密处理，得到传输密文(spassword)，即，spassword＝AES(challenge+random,SHA256(password)。最后生成待验证密文信息，其中，待验证密文信息由传输密文(spassword)和密钥密文(saeskey)组成。
进一步地，本申请实施例中，提供了一种端到端客户端采用密钥协商数据对待验证信息进行加密处理的方式，通过上述方式，端到端客户端使用本地生成的第二随机数，以及验证服务器发送的密钥协商数据，对待验证信息进行加密处理，并传输加密后得到的待验证密文信息，由此提升信息传输的安全性。
结合上述实施例，下面将对本申请中信息验证方法的整体流程进行介绍，请参阅图12，图12为本申请实施例中信息验证方法的一个整体流程示意图，如图所示，具体地：
在步骤S1中，若终端设备开启目标应用，则验证服务器接收应用服务器发送的鉴权请求，其中，鉴权请求携带应用密钥索引和应用密钥。
在步骤S2中，验证服务器响应于鉴权请求，对应用密钥索引和应用密钥进行验证处理，得到验证结果。
在步骤S3中，若验证结果为验证成功，则验证服务器响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数，公钥以及第一随机数为加密机生成的。
在步骤S4中，验证服务器向终端设备发送密钥协商数据，以使终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息，第 二随机数为终端设备生成的。
在步骤S5中，验证服务器接收终端设备发送的待验证密文信息以及会话标识。
在步骤S6中，验证服务器根据会话标识对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要。
在步骤S7中，验证服务器根据会话标识从数据库中获取密钥索引值以及待匹配密文信息。
在步骤S8中，验证服务器向加密机发送密钥索引值以及待匹配密文信息，以使加密机根据密钥索引值确定信息加密密钥。
在步骤S9中，验证服务器调用加密机对待匹配密文信息进行解密处理，得到第二信息摘要，其中，第二信息摘要为加密机采用信息加密密钥对待匹配密文信息进行解密处理后得到的。
在步骤S10中，验证服务器对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，第二信息摘要为已存储的信息摘要。
在步骤S11中，验证服务器向终端设备发送信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
在步骤S12中，若信息验证结果指示验证成功，则验证服务器生成令牌，其中，令牌配置有预设使用周期。
在步骤S13中，验证服务器向终端设备发送令牌。
在步骤S14中，当接收到终端设备发送的应用登录请求时，验证服务器响应于应用登录请求，获取令牌的使用时间，其中，应用登录请求携带令牌。
在步骤S15中，若令牌的使用时间在预设使用周期内，则验证服务器向终端设备发送应用登录成功消息。
下面对本申请中的信息验证装置进行详细描述，请参阅图13，图13为本申请实施例中信息验证装置的一个实施例示意图，信息验证装置30包括：
获取模块301，用于响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数；
发送模块302，用于向终端设备发送密钥协商数据，以使终端设备采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息；
接收模块303，用于接收终端设备发送的待验证密文信息；
解密模块304，用于对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要；
验证模块305，用于对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，第二信息摘要为已存储的信息摘要；
发送模块302，还用于向终端设备发送信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本申请实施例中，提供了一种信息验证装置，采用上述装置，终端设备在传输待验证 信息之前，使用随机数和验证服务器颁发的公钥对待验证信息进行加密，从而得到待验证密文信息，于是在传输过程中全程使用待验证密文信息，第三方应用的服务器即使获取到待验证密文信息，也无法破解出待验证信息，只有验证服务器才能获取到待验证信息，因此，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，
接收模块303，还用于在获取模块响应于终端设备发送的密钥协商请求，获取密钥协商数据之前，若终端设备开启目标应用，则接收应用服务器发送的鉴权请求，其中，鉴权请求携带应用密钥索引和应用密钥；
验证模块305，还用于响应于鉴权请求，对应用密钥索引和应用密钥进行验证处理，得到验证结果；
获取模块301，还用于若验证结果为验证成功，则执行响应于终端设备发送的密钥协商请求，获取密钥协商数据的步骤。
本申请实施例中，提供了一种信息验证装置，采用上述装置，验证服务器在对用户进行身份验证之前，还需要对第三方应用进行鉴权，从而增加数据交互的安全性。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，信息验证装置30还包括签名模块306；
接收模块303，还用于在获取模块301响应于终端设备发送的密钥协商请求，获取密钥协商数据之前，若终端设备开启目标应用，则接收应用服务器发送的鉴权请求，其中，鉴权请求携带应用密钥索引、时间戳、签名随机数以及第一签名信息，第一签名信息为基于散列函数加密算法对第一应用密钥、时间戳以及签名随机数进行签名后得到的；
获取模块301，还用于响应于鉴权请求，根据应用密钥索引获取第二应用密钥；
签名模块306，用于基于散列函数加密算法对第二应用密钥、时间戳以及签名随机数进行签名，得到第二签名信息；
获取模块301，还用于若第一签名信息和第二签名信息匹配成功，则执行响应于终端设备发送的密钥协商请求，获取密钥协商数据的步骤。
本申请实施例中，提供了一种信息验证装置，采用上述装置，验证服务器在对用户进行身份验证之前，还需要对第三方应用进行鉴权，从而增加数据交互的安全性。
可选的，解密模块304还用于：通过所述公钥对应的私钥对所述密钥密文进行解密处理，得到作为对称密钥的所述第一随机数和所述第二随机数；通过所述对称密钥对所述传输密文进行解密处理，得到所述第一信息摘要。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，获取模块301，具体用于向加密机发送密文生成请求，以使加密机响应于密文生成请求，生成密文数据，其中，密文数据包括公钥以及第一随机数；
接收加密机发送的密文数据；
根据密文数据所包括的公钥以及第一随机数，生成密钥协商数据。
本申请实施例中，提供了一种信息验证装置，采用上述装置，基于密钥协商过程得到密钥协商数据，由此，可使用密钥协商数据对用户的敏感信息进行加密，使其不会暴露给第三方应用，同时通过端到端加密技术实现用户敏感信息的安全传输和存储。此外，整个过程对于用户而言是无感知的，具有较好的体验。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，密文数据还包括公钥索引值，公钥索引值与公钥具有唯一对应关系；
信息验证装置30还包括建立模块307；
获取模块301，具体用于根据密钥协商请求所包括的目标用户的标识，生成会话标识；
根据会话标识、公钥以及第一随机数，生成密钥协商数据；
建立模块307，用于建立会话标识、公钥、第一随机数以及公钥索引值之间的映射关系；
解密模块304，具体用于基于映射关系，根据会话标识对终端设备发送的待验证密文信息进行解密处理，以得到第一信息摘要。
本申请实施例中，提供了一种信息验证装置，采用上述装置，能够在不以明文显示待验证信息的前提下，实现用户的身份验证，即验证服务器仅获取待验证信息的第一信息摘要即可，由此，进一步提升了验证的安全性性。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，
解密模块304，具体用于基于映射关系，根据会话标识从数据库中获取公钥索引值；
向加密机发送公钥索引值，以使加密机根据公钥索引值确定公钥；
调用加密机对待验证密文信息进行解密处理，得到第一信息摘要，其中，第一信息摘要为加密机采用公钥所对应的私钥对待验证密文信息进行解密处理后得到的。
本申请实施例中，提供了一种信息验证装置，采用上述装置，验证服务器调用加密机以实现对待验证密文信息的解密，也就是说，公钥存储于具有较高安全性的加密机中，进而提升信息解密的安全性。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，
获取模块301，还用于在验证模块305对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果之前，根据会话标识从数据库中获取密钥索引值以及待匹配密文信息；
发送模块302，还用于向加密机发送密钥索引值以及待匹配密文信息，以使加密机根据密钥索引值确定信息加密密钥；
解密模块304，还用于调用加密机对待匹配密文信息进行解密处理，得到第二信息摘要，其中，第二信息摘要为加密机采用信息加密密钥对待匹配密文信息进行解密处理后得到的。
本申请实施例中，提供了一种信息验证装置，采用上述装置，验证服务器调用加密机以实现对待匹配密文信息的解密，也就是说，信息加密密钥存储于具有较高安全性的加密机中，进而提升信息解密的安全性。
可选地，在上述图13所对应的实施例的基础上，本申请实施例提供的信息验证装置30的另一实施例中，信息验证装置30还包括生成模块308；
生成模块308，用于在验证模块305对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果之后，若信息验证结果指示验证成功，则生成令牌，其中，令牌配置有预设使用周期；
发送模块302，还用于向终端设备发送令牌；
获取模块301，还用于当接收到终端设备发送的应用登录请求时，响应于应用登录请求，获取令牌的使用时间，其中，应用登录请求携带令牌；
发送模块302，还用于若令牌的使用时间在预设使用周期内，则向终端设备发送应用登录成功消息。
本申请实施例中，提供了一种信息验证装置，采用上述装置，在用户首先验证成功之后，后续可使用令牌登录，从而减少用户信息被暴露的风险。此外，用户无需跳转到身份授权服务器进行验证，第三方应用与身份授权服务对接过程无需前端对接逻辑，减少了对接过程。
下面对本申请中的信息验证装置进行详细描述，请参阅图14，图14为本申请实施例中信息验证装置的另一个实施例示意图，信息验证装置40包括：
发送模块401，用于向验证服务器发送密钥协商请求，以使验证服务器响应于密钥协商请求，获取密钥协商数据，其中，密钥协商请求携带目标用户的标识，密钥协商数据包括公钥以及第一随机数；
接收模块402，用于接收验证服务器发送的密钥协商数据；
加密模块403，用于采用第二随机数以及密钥协商数据所包括的公钥以及第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，待验证信息包括目标用户所对应的用户信息；
发送模块401，还用于向验证服务器发送待验证密文信息，以使验证服务器对待验证密文信息进行解密处理，得到第一信息摘要，并对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；
接收模块402，还用于接收验证服务器发送的信息验证结果，其中，信息验证结果用于指示终端设备登录应用服务器的结果，应用服务器为目标应用的服务器。
本申请实施例中，提供了一种信息验证装置，采用上述装置，终端设备在传输待验证信息之前，使用随机数和验证服务器颁发的公钥对待验证信息进行加密，从而得到待验证密文信息，于是在传输过程中全程使用待验证密文信息，第三方应用的服务器即使获取到待验证密文信息，也无法破解出待验证信息，只有验证服务器才能获取到待验证信息，因此，可以在用户隐私信息不暴露给第三方应用的情况下，登录至第三方应用的服务器，由此提升身份认证的安全性。
可选地，在上述图14所对应的实施例的基础上，本申请实施例提供的信息验证装置40的另一实施例中，
加密模块403，具体用于生成第二随机数；
将第一随机数以及第二随机数作为对称加密算法所使用的对称密钥；
基于非对称加密算法，采用密钥协商数据所包括的公钥，对对称密钥进行加密处理， 得到对称密钥的密钥密文；
基于散列函数加密算法，对目标应用的待验证信息进行摘要计算，得到第一信息摘要；
基于对称加密算法，对对称密钥以及第一信息摘要进行加密处理，得到传输密文；
根据密钥密文以及传输密文生成待验证密文信息。
本申请实施例中，提供了一种信息验证装置，采用上述装置，端到端客户端使用本地生成的第二随机数，以及验证服务器发送的密钥协商数据，对待验证信息进行加密处理，并传输加密后得到的待验证密文信息，由此提升信息传输的安全性。
本申请实施例还提供了另一种信息验证装置，该信息验证装置部署于服务器，图15是本申请实施例提供的一种服务器结构示意图，该服务器500可因配置或性能不同而产生比较大的差异，可以包括一个或一个以***处理器(central processing units，CPU)522(例如，一个或一个以上处理器)和存储器532，一个或一个以上存储应用程序542或数据544的存储介质530(例如一个或一个以上海量存储设备)。其中，存储器532和存储介质530可以是短暂存储或持久存储。存储在存储介质530的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对服务器中的一系列指令操作。更进一步地，中央处理器522可以设置为与存储介质530通信，在服务器500上执行存储介质530中的一系列指令操作。
服务器500还可以包括一个或一个以上电源526，一个或一个以上有线或无线网络接口550，一个或一个以上输入输出接口558，和/或，一个或一个以上操作***541，例如Windows Server TM，Mac OS X TM，Unix TM,Linux TM，FreeBSD TM等等。
上述实施例中由服务器所执行的步骤可以基于该图15所示的服务器结构。
本申请实施例还提供了另一种信息验证装置，该信息验证装置部署于终端设备，如图16所示，为了便于说明，仅示出了与本申请实施例相关的部分，具体技术细节未揭示的，请参照本申请实施例方法部分。该终端设备可以为包括手机、平板电脑、个人数字助理(Personal Digital Assistant，PDA)、销售终端设备(Point of Sales，POS)、车载电脑等任意终端设备，以终端设备为手机为例：
图16示出的是与本申请实施例提供的终端设备相关的手机的部分结构的框图。参考图16，手机包括：射频(Radio Frequency，RF)电路610、存储器620、输入单元630、显示单元640、传感器650、音频电路660、无线保真(WiFi)模块670、处理器680、以及电源690等部件。本领域技术人员可以理解，图16中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图16对手机的各个构成部件进行具体的介绍：
RF电路610可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器680处理；另外，将设计上行的数据发送给基站。
存储器620可用于存储软件程序以及模块，处理器680通过运行存储在存储器620的软件程序以及模块，从而执行手机的各种功能应用以及数据处理。
输入单元630可用于接收输入的数字或字符信息，以及产生与手机的用户设置以及功能控制有关的键信号输入。具体地，输入单元630可包括触控面板631以及其他输入设备632。触控面板631，也称为触摸屏。
显示单元640可用于显示由用户输入的信息或提供给用户的信息以及手机的各种菜单。显示单元640可包括显示面板641，可选的，可以采用液晶显示器(Liquid Crystal Display，LCD)、有机发光二极管(Organic Light-Emitting Diode，OLED)等形式来配置显示面板641。
手机还可包括至少一种传感器650，例如光传感器、运动传感器以及其他传感器。
音频电路660、扬声器661，传声器662可提供用户与手机之间的音频接口。
WiFi属于短距离无线传输技术，手机通过WiFi模块670可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。
处理器680是手机的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器620内的软件程序和/或模块，以及调用存储在存储器620内的数据，执行手机的各种功能和处理数据。
上述实施例中由终端设备所执行的步骤可以基于该图16所示的终端设备结构。
本申请实施例中还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如前述各个实施例描述的方法。
本申请实施例中还提供一种包括程序的计算机程序产品，当其在计算机上运行时，使得计算机执行前述各个实施例描述的方法。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的***，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (17)

  1. 一种信息验证的方法，所述方法由验证服务器执行，所述方法包括：
    响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，所述密钥协商请求携带目标用户的标识，所述密钥协商数据包括公钥以及第一随机数；
    向所述终端设备发送所述密钥协商数据，以使所述终端设备采用第二随机数以及所述密钥协商数据所包括的所述公钥以及所述第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，所述待验证信息包括所述目标用户所对应的用户信息；
    接收所述终端设备发送的所述待验证密文信息；
    对所述终端设备发送的所述待验证密文信息进行解密处理，以得到第一信息摘要；
    对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，所述第二信息摘要为已存储的信息摘要；
    向所述终端设备发送所述信息验证结果，其中，所述信息验证结果用于指示所述终端设备登录应用服务器的结果，所述应用服务器为所述目标应用的服务器。
  2. 根据权利要求1所述的方法，所述获取密钥协商数据，包括：
    向加密机发送密文生成请求，以使所述加密机响应于所述密文生成请求，生成密文数据，其中，所述密文数据包括所述公钥以及所述第一随机数；
    接收所述加密机发送的所述密文数据；
    根据所述密文数据所包括的所述公钥以及所述第一随机数，生成所述密钥协商数据。
  3. 根据权利要求2所述的方法，所述密文数据还包括公钥索引值，所述公钥索引值与所述公钥具有唯一对应关系；
    所述根据所述密文数据所包括的所述公钥以及所述第一随机数，生成所述密钥协商数据，包括：
    根据所述密钥协商请求所包括的所述目标用户的标识，生成会话标识；
    根据所述会话标识、所述公钥以及所述第一随机数，生成所述密钥协商数据；
    所述方法还包括：
    建立所述会话标识、所述公钥、所述第一随机数以及所述公钥索引值之间的映射关系；
    所述对所述终端设备发送的所述待验证密文信息进行解密处理，以得到第一信息摘要，包括：
    基于所述映射关系，根据所述会话标识对所述终端设备发送的所述待验证密文信息进行解密处理，以得到所述第一信息摘要。
  4. 根据权利要求3所述的方法，所述基于所述映射关系，根据所述会话标识对所述终端设备发送的所述待验证密文信息进行解密处理，以得到所述第一信息摘要，包括：
    基于所述映射关系，根据所述会话标识从数据库中获取所述公钥索引值；
    向所述加密机发送所述公钥索引值，以使所述加密机根据所述公钥索引值确定所述公钥；
    调用所述加密机对所述待验证密文信息进行解密处理，得到第一信息摘要，其中，第 一信息摘要为所述加密机采用所述公钥所对应的私钥对所述待验证密文信息进行解密处理后得到的。
  5. 根据权利要求1所述的方法，其特征在于，所述待验证密文信息是所述终端设备根据密钥密文以及传输密文生成的，所述对所述终端设备发送的所述待验证密文信息进行解密处理，以得到第一信息摘要，包括：
    通过所述公钥对应的私钥对所述密钥密文进行解密处理，得到作为对称密钥的所述第一随机数和所述第二随机数；
    通过所述对称密钥对所述传输密文进行解密处理，得到所述第一信息摘要。
  6. 根据权利要求1所述的方法，所述对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果之前，所述方法还包括：
    从数据库中获取密钥索引值以及待匹配密文信息；
    向加密机发送所述密钥索引值以及所述待匹配密文信息，以使所述加密机根据所述密钥索引值确定信息加密密钥；
    调用所述加密机对所述待匹配密文信息进行解密处理，得到所述第二信息摘要，其中，所述第二信息摘要为所述加密机采用所述信息加密密钥对所述待匹配密文信息进行解密处理后得到的。
  7. 根据权利要求1所述的方法，所述对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果之后，所述方法还包括：
    若所述信息验证结果指示验证成功，则生成令牌，其中，所述令牌配置有预设使用周期；
    向所述终端设备发送所述令牌；
    当接收到所述终端设备发送的应用登录请求时，响应于所述应用登录请求，获取所述令牌的使用时间，其中，所述应用登录请求携带所述令牌；
    若所述令牌的使用时间在所述预设使用周期内，则向所述终端设备发送应用登录成功消息。
  8. 根据权利要求1至7中任一项所述的方法，所述方法还包括：
    若所述终端设备开启所述目标应用，则接收所述应用服务器发送的鉴权请求，其中，所述鉴权请求携带应用密钥索引和应用密钥；
    响应于所述鉴权请求，对所述应用密钥索引和所述应用密钥进行验证处理，得到验证结果；
    若所述验证结果为验证成功，则执行所述响应于终端设备发送的密钥协商请求，获取密钥协商数据的步骤。
  9. 根据权利要求1至7中任一项所述的方法，所述方法还包括：
    若所述终端设备开启所述目标应用，则接收所述应用服务器发送的鉴权请求，其中，所述鉴权请求携带应用密钥索引、时间戳、签名随机数以及第一签名信息，所述第一签名信息为基于散列函数加密算法对第一应用密钥、所述时间戳以及所述签名随机数进行签名后得到的；
    响应于所述鉴权请求，根据所述应用密钥索引获取第二应用密钥；
    基于所述散列函数加密算法对所述第二应用密钥、所述时间戳以及所述签名随机数进行签名，得到第二签名信息；
    若所述第一签名信息和所述第二签名信息匹配成功，则执行所述响应于终端设备发送的密钥协商请求，获取密钥协商数据的步骤。
  10. 一种信息验证的方法，所述方法由终端设备执行，所述方法包括：
    向验证服务器发送密钥协商请求，以使所述验证服务器响应于所述密钥协商请求，获取密钥协商数据，其中，所述密钥协商请求携带目标用户的标识，所述密钥协商数据包括公钥以及第一随机数；
    接收所述验证服务器发送的所述密钥协商数据；
    采用第二随机数以及所述密钥协商数据所包括的所述公钥以及所述第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，所述待验证信息包括所述目标用户所对应的用户信息；
    向所述验证服务器发送所述待验证密文信息，以使所述验证服务器对所述待验证密文信息进行解密处理，得到第一信息摘要，并对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；
    接收所述验证服务器发送的所述信息验证结果，其中，所述信息验证结果用于指示所述终端设备登录应用服务器的结果，所述应用服务器为所述目标应用的服务器。
  11. 根据权利要求10所述的方法，所述采用第二随机数以及所述密钥协商数据所包括的所述公钥以及所述第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，包括：
    生成所述第二随机数；
    将所述第一随机数以及所述第二随机数作为对称加密算法所使用的对称密钥；
    基于非对称加密算法，采用所述密钥协商数据所包括的所述公钥，对所述对称密钥进行加密处理，得到所述对称密钥的密钥密文；
    基于散列函数加密算法，对所述目标应用的所述待验证信息进行摘要计算，得到第一信息摘要；
    基于所述对称加密算法，对所述对称密钥以及所述第一信息摘要进行加密处理，得到传输密文；
    根据所述密钥密文以及所述传输密文生成所述待验证密文信息。
  12. 一种信息验证装置，包括：
    获取模块，用于响应于终端设备发送的密钥协商请求，获取密钥协商数据，其中，所述密钥协商请求携带目标用户的标识，所述密钥协商数据包括公钥以及第一随机数；
    发送模块，用于向所述终端设备发送所述密钥协商数据，以使所述终端设备采用第二随机数以及所述密钥协商数据所包括的所述公钥以及所述第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，所述待验证信息包括所述目标用户所对应的用户信息；
    接收模块，用于接收所述终端设备发送的所述待验证密文信息；
    解密模块，用于对所述终端设备发送的所述待验证密文信息进行解密处理，以得到第一信息摘要；
    验证模块，用于对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果，其中，所述第二信息摘要为已存储的信息摘要；
    所述发送模块，还用于向所述终端设备发送所述信息验证结果，其中，所述信息验证结果用于指示所述终端设备登录应用服务器的结果，所述应用服务器为所述目标应用的服务器。
  13. 一种信息验证装置，包括：
    发送模块，用于向验证服务器发送密钥协商请求，以使所述验证服务器响应于所述密钥协商请求，获取密钥协商数据，其中，所述密钥协商请求携带目标用户的标识，所述密钥协商数据包括公钥以及第一随机数；
    接收模块，用于接收所述验证服务器发送的所述密钥协商数据；
    加密模块，用于采用第二随机数以及所述密钥协商数据所包括的所述公钥以及所述第一随机数，对针对于目标应用的待验证信息进行加密处理，得到待验证密文信息，其中，所述待验证信息包括所述目标用户所对应的用户信息；
    所述发送模块，还用于向所述验证服务器发送所述待验证密文信息，以使所述验证服务器对所述待验证密文信息进行解密处理，得到第一信息摘要，并对第一信息摘要与第二信息摘要进行匹配处理，得到信息验证结果；
    所述接收模块，还用于接收所述验证服务器发送的所述信息验证结果，其中，所述信息验证结果用于指示所述终端设备登录应用服务器的结果，所述应用服务器为所述目标应用的服务器。
  14. 一种服务器，包括：存储器、处理器以及总线***；
    其中，所述存储器用于存储程序；
    所述处理器用于执行所述存储器中的程序，所述处理器用于根据程序代码中的指令执行权利要求1至9中任一项所述的方法；
    所述总线***用于连接所述存储器以及所述处理器，以使所述存储器以及所述处理器进行通信。
  15. 一种终端设备，包括：存储器、处理器以及总线***；
    其中，所述存储器用于存储程序；
    所述处理器用于执行所述存储器中的程序，所述处理器用于根据程序代码中的指令执行权利要求10或11所述的方法；
    所述总线***用于连接所述存储器以及所述处理器，以使所述存储器以及所述处理器进行通信。
  16. 一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1至9中任一项所述的方法，或，行如权利要求10或11所述的方法。
  17. 一种包括指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行 权利要求1至9中任一项所述的方法，或，行如权利要求10或11所述的方法。
PCT/CN2022/080538 2021-04-02 2022-03-14 一种信息验证的方法、相关装置、设备以及存储介质 WO2022206349A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22778533.4A EP4216081A4 (en) 2021-04-02 2022-03-14 INFORMATION VERIFICATION METHOD, RELATED APPARATUS, DEVICE, AND STORAGE MEDIUM
US17/977,407 US20230071847A1 (en) 2021-04-02 2022-10-31 Information verification method and related apparatus, device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110360917.2A CN112733107B (zh) 2021-04-02 2021-04-02 一种信息验证的方法、相关装置、设备以及存储介质
CN202110360917.2 2021-04-02

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/977,407 Continuation US20230071847A1 (en) 2021-04-02 2022-10-31 Information verification method and related apparatus, device, and storage medium

Publications (1)

Publication Number Publication Date
WO2022206349A1 true WO2022206349A1 (zh) 2022-10-06

Family

ID=75596443

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/080538 WO2022206349A1 (zh) 2021-04-02 2022-03-14 一种信息验证的方法、相关装置、设备以及存储介质

Country Status (4)

Country Link
US (1) US20230071847A1 (zh)
EP (1) EP4216081A4 (zh)
CN (1) CN112733107B (zh)
WO (1) WO2022206349A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115001864A (zh) * 2022-07-27 2022-09-02 深圳市西昊智能家具有限公司 智能家具的通信认证方法、装置、计算机设备和存储介质
CN116155497A (zh) * 2023-01-06 2023-05-23 南京通力峰达软件科技有限公司 一种车联网用户应用程序中的敏感数据加密和保存方法
CN116702218A (zh) * 2023-08-07 2023-09-05 腾讯科技（深圳）有限公司 小程序中三维模型的渲染方法、装置、终端及存储介质
CN116938594A (zh) * 2023-09-08 2023-10-24 北京数盾信息科技有限公司 一种基于高速加密技术的多层次身份验证***
CN117118750A (zh) * 2023-10-23 2023-11-24 中山职业技术学院 基于白盒密码的数据共享方法、装置、电子设备及介质

Families Citing this family (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112733107B (zh) * 2021-04-02 2021-06-22 腾讯科技（深圳）有限公司 一种信息验证的方法、相关装置、设备以及存储介质
CN113300842B (zh) * 2021-05-26 2022-07-22 清创网御(北京)科技有限公司 一种提高对称加密算法安全性的方法
CN113378136B (zh) * 2021-06-08 2022-10-25 罗克佳华(重庆)科技有限公司 一种指纹识别方法、装置、密码钥匙及存储介质
CN113726772B (zh) * 2021-08-30 2023-07-07 深圳平安智慧医健科技有限公司 实现在线问诊会话的方法、装置、设备及存储介质
CN113746833B (zh) * 2021-09-02 2023-06-16 上海商汤智能科技有限公司 通信方法及装置、电子设备和存储介质
CN114285581B (zh) * 2021-12-07 2024-05-14 西安广和通无线通信有限公司 应用管理方法及相关产品
CN114327956A (zh) * 2021-12-28 2022-04-12 阿波罗智联(北京)科技有限公司 车载应用的请求处理方法、装置、电子设备和存储介质
CN114448641A (zh) * 2021-12-30 2022-05-06 北京航天晨信科技有限责任公司 一种隐私加密方法、电子设备、存储介质以及芯片
CN114443161B (zh) * 2021-12-31 2024-05-28 北京达佳互联信息技术有限公司 一种应用对接方法、装置、设备及存储介质
CN114244514B (zh) * 2022-02-21 2022-05-24 图灵人工智能研究院（南京）有限公司 一种基于车联网的数据安全处理方法
CN114598465B (zh) * 2022-03-08 2024-05-17 潍柴动力股份有限公司 一种数据更新方法和控制器
CN114697945B (zh) * 2022-04-02 2023-10-24 中国电信股份有限公司 发现响应消息的生成方法及装置、发现消息的处理方法
CN114826616B (zh) * 2022-04-27 2024-04-26 中国建设银行股份有限公司 数据处理方法、装置、电子设备和介质
CN114978503B (zh) * 2022-05-23 2024-02-23 国汽智控(北京)科技有限公司 车载数据存储方法、车载数据获取方法、设备及存储介质
CN114826778B (zh) * 2022-06-21 2022-09-27 杭州安恒信息技术股份有限公司 一种鉴权方法、装置、设备及介质
CN115037552A (zh) * 2022-06-29 2022-09-09 北京大甜绵白糖科技有限公司 鉴权方法、装置、设备及存储介质
CN115118523B (zh) * 2022-08-22 2022-11-08 广州万协通信息技术有限公司 终端设备调整加密策略的安全芯片加密处理方法及装置
CN115438324A (zh) * 2022-09-20 2022-12-06 中国建设银行股份有限公司 一种身份验证方法、装置及设备
CN115964681A (zh) * 2023-03-16 2023-04-14 北京艾瑞数智科技有限公司 目标应用程序的证书文件的生成方法
CN116094841B (zh) * 2023-04-07 2023-06-02 北京豪密科技有限公司 加密信道中的行为识别方法、装置及电子设备
CN116405734B (zh) * 2023-06-08 2023-08-25 深圳奥联信息安全技术有限公司 确保数据安全的数据传输方法和***
CN116680685B (zh) * 2023-06-09 2024-03-08 深圳普菲特信息科技股份有限公司 基于分布式存储的用户登录控制方法、***和存储介质
CN116761167B (zh) * 2023-08-21 2023-11-03 北京领创医谷科技发展有限责任公司 一种数据加密传输方法、***、电子设备及存储介质
CN116915403B (zh) * 2023-09-11 2023-11-17 湖南省不动产登记中心 不动产数据检查方法及***
CN117611330B (zh) * 2024-01-23 2024-04-09 天津金城银行股份有限公司 一种征信数据处理***、方法、装置、设备及介质
CN117852004B (zh) * 2024-03-07 2024-05-28 中建三局集团华南有限公司 一种建筑幕墙的建模方法、装置、设备及存储介质
CN118018336B (zh) * 2024-04-10 2024-06-11 江苏中天互联科技有限公司 数据传输方法、服务器及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103391292A (zh) * 2013-07-18 2013-11-13 百度在线网络技术（北京）有限公司 针对移动应用的安全登录方法、***和装置
CN104065652A (zh) * 2014-06-09 2014-09-24 韩晟 一种身份验证方法、装置、***及相关设备
CN109600223A (zh) * 2017-09-30 2019-04-09 腾讯科技（深圳）有限公司 验证方法、激活方法、装置、设备及存储介质
CN111193695A (zh) * 2019-07-26 2020-05-22 腾讯科技（深圳）有限公司 一种第三方账号登录的加密方法、装置及存储介质
CN112118223A (zh) * 2020-08-11 2020-12-22 北京智芯微电子科技有限公司 主站与终端的认证方法、主站、终端及存储介质
CN112733107A (zh) * 2021-04-02 2021-04-30 腾讯科技（深圳）有限公司 一种信息验证的方法、相关装置、设备以及存储介质

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102821085B (zh) * 2011-11-23 2015-12-02 腾讯科技（深圳）有限公司 第三方授权登录方法、开放平台及***
CN104917721B (zh) * 2014-03-10 2019-05-07 腾讯科技（北京）有限公司 基于oAuth协议的授权方法、装置和***
CN104113533B (zh) * 2014-07-02 2017-10-27 百度在线网络技术（北京）有限公司 登录授权方法和装置
US11316689B2 (en) * 2017-09-29 2022-04-26 Oracle International Corporation Trusted token relay infrastructure
CN108650239A (zh) * 2018-04-17 2018-10-12 新大陆（福建）公共服务有限公司 一种OAuth协议的认证方法
CN111327582B (zh) * 2019-08-22 2022-12-20 刘高峰 一种基于OAuth协议的授权方法、装置及***
CN111526130B (zh) * 2020-04-03 2021-12-21 杭州电子科技大学 一种轻量级的无证书工业物联网访问控制方法和***

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103391292A (zh) * 2013-07-18 2013-11-13 百度在线网络技术（北京）有限公司 针对移动应用的安全登录方法、***和装置
CN104065652A (zh) * 2014-06-09 2014-09-24 韩晟 一种身份验证方法、装置、***及相关设备
CN109600223A (zh) * 2017-09-30 2019-04-09 腾讯科技（深圳）有限公司 验证方法、激活方法、装置、设备及存储介质
CN111193695A (zh) * 2019-07-26 2020-05-22 腾讯科技（深圳）有限公司 一种第三方账号登录的加密方法、装置及存储介质
CN112118223A (zh) * 2020-08-11 2020-12-22 北京智芯微电子科技有限公司 主站与终端的认证方法、主站、终端及存储介质
CN112733107A (zh) * 2021-04-02 2021-04-30 腾讯科技（深圳）有限公司 一种信息验证的方法、相关装置、设备以及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4216081A4 *

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115001864A (zh) * 2022-07-27 2022-09-02 深圳市西昊智能家具有限公司 智能家具的通信认证方法、装置、计算机设备和存储介质
CN116155497A (zh) * 2023-01-06 2023-05-23 南京通力峰达软件科技有限公司 一种车联网用户应用程序中的敏感数据加密和保存方法
CN116155497B (zh) * 2023-01-06 2023-09-29 南京通力峰达软件科技有限公司 一种车联网用户应用程序中的敏感数据加密和保存方法
CN116702218A (zh) * 2023-08-07 2023-09-05 腾讯科技（深圳）有限公司 小程序中三维模型的渲染方法、装置、终端及存储介质
CN116702218B (zh) * 2023-08-07 2023-12-05 腾讯科技（深圳）有限公司 小程序中三维模型的渲染方法、装置、终端及存储介质
CN116938594A (zh) * 2023-09-08 2023-10-24 北京数盾信息科技有限公司 一种基于高速加密技术的多层次身份验证***
CN116938594B (zh) * 2023-09-08 2024-03-22 数盾信息科技股份有限公司 一种基于高速加密技术的多层次身份验证***
CN117118750A (zh) * 2023-10-23 2023-11-24 中山职业技术学院 基于白盒密码的数据共享方法、装置、电子设备及介质
CN117118750B (zh) * 2023-10-23 2024-03-29 中山职业技术学院 基于白盒密码的数据共享方法、装置、电子设备及介质

Also Published As

Publication number Publication date
US20230071847A1 (en) 2023-03-09
CN112733107A (zh) 2021-04-30
CN112733107B (zh) 2021-06-22
EP4216081A1 (en) 2023-07-26
EP4216081A4 (en) 2024-05-15

Similar Documents

Publication Publication Date Title
WO2022206349A1 (zh) 一种信息验证的方法、相关装置、设备以及存储介质
WO2019120091A1 (zh) 身份认证方法、***及计算设备
US11102191B2 (en) Enabling single sign-on authentication for accessing protected network services
US11546321B2 (en) Non-custodial tool for building decentralized computer applications
US10601590B1 (en) Secure secrets in hardware security module for use by protected function in trusted execution environment
CN105027107A (zh) 安全虚拟机迁移
CN103067399A (zh) 无线发射/接收单元
CN113992346B (zh) 一种基于国密加固的安全云桌面的实现方法
US20180262352A1 (en) Secure Authentication of Remote Equipment
EP4096147A1 (en) Secure enclave implementation of proxied cryptographic keys
EP4096160A1 (en) Shared secret implementation of proxied cryptographic keys
CN114584306A (zh) 一种数据处理方法和相关装置
KR20180087543A (ko) 키 관리 방법 및 ｆｉｄｏ 소프트웨어 인증장치
CN111698264A (zh) 用于保持用户认证会话的方法和装置
CN113411187A (zh) 身份认证方法和***、存储介质及处理器
KR20190010016A (ko) 사용자 인증 서버 및 시스템
US11611541B2 (en) Secure method to replicate on-premise secrets in a cloud environment
CN113904830A (zh) 一种spa认证的方法、装置、电子设备和可读存储介质
WO2009066978A2 (en) Method and system for generating a proxy digital certificate to a grid portal in distributed computing infrastructure by data transfer across a public network
KR102678262B1 (ko) 분산형 컴퓨터 애플리케이션들을 구축하기 위한 비-보관 툴
CN116389168B (zh) 一种身份认证方法和装置
CN102780812A (zh) 一种利用移动终端实现安全输入的方法和***
Xu et al. Qrtoken: Unifying authentication framework to protect user online identity
CN116961973A (zh) 数据传输方法、装置、电子设备及计算机可读存储介质
CN114513299A (zh) 基于开放式授权的数据传输方法及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22778533

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022778533

Country of ref document: EP

Effective date: 20230419

NENP Non-entry into the national phase

Ref country code: DE