CN116055172A - A device authentication method, system, electronic device and storage medium - Google Patents

Abstract

The application provides a device authentication method, a system, electronic equipment and a storage medium, when a client detects a target APP initialization client sdk, parameter information is sent to a server, the server receives the parameter information, generates a key according to a device identifier and an encryption salt value, and sends the target parameter information generated according to a first timestamp and a time slice to the client; when the client receives the target parameter information, calculating clock deviation according to the first time stamp and the second time stamp, and sending a dynamic token generated according to the second time stamp, the clock deviation, the time slice and a key pre-agreed with the server to the server; when the server receives the dynamic token, generating at least one target dynamic token according to the first timestamp, the time slice and the secret key; if a target dynamic token consistent with the dynamic token exists, determining that the client authentication passes, and sending corresponding authentication passing information to a server corresponding to the target APP.

Description

A device authentication method, system, electronic device and storage medium

technical field

The present invention relates to the technical field of encryption, and more specifically, relates to a device authentication method, system, electronic device and storage medium.

Background technique

The application (Application, APP) provided by the e-commerce industry often holds activities, such as new pull and voting; the client can participate in the activity by installing the APP in order to access the corresponding server, in order to ensure that the participating equipment All are legal, and the server can verify the legitimacy of the accessed client.

Existing verification methods for device legitimacy usually involve the client encrypting and signing the corresponding device information. After obtaining the corresponding encrypted information, the server decrypts the encrypted information and verifies the signature to verify whether the client is legal. , if it is determined to be legal, receive the access request sent by the client. Although this method guarantees the legitimacy of a single device (client), it cannot guarantee that the third-party business behavior occurs on the device (client), that is, it cannot guarantee that the device (client) is in the real environment. For example, illegal users simulate the device (client) through virtual software to send corresponding access requests to the server, so it is easy for users to use a single legitimate device to create a large number of accounts to collect wool.

Contents of the invention

In view of this, the present invention provides a device authentication method, system, electronic device and storage medium, so as to ensure that the device operates in a real environment under the premise of ensuring the legitimacy of the device, and prevent users from using a single legal device to create a large number of accounts. Carry out fleece.

The first aspect of the present invention discloses a device authentication method, the method comprising:

When the client detects that the target APP initializes the client sdk, it sends parameter information to the server, wherein the parameter information includes at least a device identifier;

When the server receives the parameter information, it generates a key according to the device identifier and encrypted salt value, and sends the target parameter information generated according to the first timestamp and time slice to the client; wherein , the first timestamp is the local timestamp of the server;

When the client receives the target parameter information, it calculates a clock offset according to the first timestamp and the second timestamp, and calculates the clock offset according to the second timestamp, the clock offset, the time slice and the The key pre-agreed by the server generates a dynamic token, and sends the dynamic token to the server; wherein, the key predetermined by the server is the same as the key; The second timestamp is a local timestamp of the client;

When the server receives the dynamic token, it generates at least one target dynamic token according to the first timestamp, the time slice and the key;

If there is a target dynamic token consistent with the dynamic token, the server determines that the client has passed the authentication, and sends corresponding authentication passing information to the service party corresponding to the target APP.

Optionally, when the server receives the parameter information, it generates a key according to the device identifier and encrypted salt value, and sends the target parameter information generated according to the first timestamp and time slice to the Clients, including:

When the server receives the parameter information, it obtains the first time stamp and time slice from the time synchronization clock, and intercepts the target device identifier from the device identifier;

The server generates a key according to the target device identifier and the encrypted salt value;

The server generates target parameter information according to the first timestamp and the time slice, and sends the target parameter information to the client.

Optionally, when the client receives the target parameter information, it calculates a clock offset according to the first timestamp and the second timestamp, and calculates a clock offset according to the second timestamp, the clock offset, The time slice and the pre-booked key with the server generate a dynamic token, and send the dynamic token to the server, including:

When the client receives the target parameter information, it obtains a second time stamp from the time synchronization clock, and calculates a clock offset according to the first time stamp and the second time stamp; wherein, the target The parameter information includes the first time stamp and the first time slice;

The client generates a calibration time according to the second timestamp, the first clock offset, and the time slice; wherein, the calibration time is the same as the target calibration time;

The client uses a hash algorithm to process the calibration time and the key pre-determined with the server to obtain a corresponding first hash value, and uses the HMAC-sha1 algorithm to process the first hash value process, generate a corresponding dynamic token, and send the dynamic token to the server.

Optionally, when the server receives the dynamic token, it generates at least one target dynamic token according to the first timestamp, the time slice and the key, including:

When the server receives the dynamic token, it determines the target calibration time according to the first time stamp, and adds a preset value to the target calibration time to obtain the first calibration time, and calculates the target calibration time Subtracting the preset data to obtain a second calibration time;

The server uses a hash algorithm to process the target calibration time and the key to obtain a second hash value, and uses the HMAC-sha1 algorithm to process the second hash value to generate a first target Dynamic token; use a hash algorithm to process the first calibration time and the key to obtain a third hash value, and use the HMAC-sha1 algorithm to process the third hash value to generate a second The target dynamic token; use a hash algorithm to process the second calibration time and the key to obtain a fourth hash value, and use the HMAC-sha1 algorithm to process the fourth hash value to generate a fourth hash value Three-goal dynamic token.

Optionally, the server judges whether there is a target dynamic token consistent with the dynamic token in the at least one target dynamic token; if there is a target dynamic token consistent with the dynamic token, determine The client passes the authentication, and sends corresponding authentication passing information to the service party corresponding to the target APP, including:

The server determines whether the dynamic token is consistent with the first target dynamic token, or whether it is consistent with the second target dynamic token, or whether it is consistent with the third target dynamic token;

If the dynamic token is consistent with the first target dynamic token, or is consistent with the second target dynamic token, or is consistent with the third target dynamic token, the server determines that the client If the authentication is passed, corresponding authentication passing information is sent to the service party corresponding to the target APP.

The second aspect of the present invention discloses a device authentication system, the device authentication system includes a client and a server;

The client is configured to send parameter information to the server when detecting that the target APP initializes the client sdk, wherein the parameter information includes at least a device identifier; when receiving the target parameter information, according to the first Timestamp and second timestamp, calculate the clock offset, and generate a dynamic token according to the second timestamp, the clock offset, the time slice and the key pre-agreed with the server, and send the The dynamic token is sent to the server; wherein, the key predetermined by the server is the same as the key; the second timestamp is the local timestamp of the client;

The server is configured to generate a key according to the device identifier and encrypted salt value when receiving the parameter information, and send the target parameter information generated according to the first timestamp and time slice to the client terminal; wherein, the first timestamp is the local timestamp of the server; when the dynamic token is received, at least one target is generated according to the first timestamp, the time slice and the key Dynamic token; if there is a target dynamic token consistent with the dynamic token, determine that the client has passed the authentication, send corresponding authentication passing information to the service party corresponding to the target APP, and allow the client to access the server.

Optionally, when the parameter information is received, a key is generated according to the device identifier and encrypted salt value, and the target parameter information generated according to the key, the first timestamp and the time slice is sent to the The server of the client, specifically for:

When receiving the parameter information, obtain the first time stamp and time slice from the time synchronization clock, and intercept the target device ID from the device ID; generate a key according to the target device ID and encrypted salt value; The first timestamp and the time slice are used to generate target parameter information, and the target parameter information is sent to the client.

Optionally, when the target parameter information is received, a clock offset is calculated according to the first timestamp and the second timestamp, and a clock offset is calculated according to the second timestamp, the clock offset, and the time slice Generate a dynamic token with the pre-booked key with the server, and send the dynamic token to the client of the server, specifically for:

When receiving the target parameter information, obtain a second time stamp from the time synchronization clock, and calculate a clock offset according to the first time stamp and the second time stamp; wherein the target parameter information includes the The first time stamp and the first time slice; according to the second time stamp, the clock offset and the time slice, generate a calibration time; use a hash algorithm to compare the calibration time and the server Pre-determined keys are processed to obtain the corresponding first hash value, and the HMAC-sha1 algorithm is used to process the first hash value to generate a corresponding dynamic token, and the dynamic token is sent to the server.

An electronic device disclosed in the third aspect of the present invention includes: a processor and a memory, the processor and the memory are connected through a communication bus; wherein the processor is used to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement the device authentication method disclosed in the first aspect of the present invention.

The fourth aspect of the present invention discloses a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and the computer-executable instructions are used to perform device authentication as disclosed in the above-mentioned first aspect of the present invention method.

The present invention provides a device authentication method, system, electronic device and storage medium. When the client detects that the target APP initializes the client sdk, the client sends parameter information to the server, wherein the parameter information includes at least the device identifier; the server receives For parameter information, generate a key according to the device ID and encrypted salt value, and send the target parameter information generated according to the first time stamp and time slice to the client; when the client receives the target parameter information, it will stamp and the second timestamp, calculate the clock offset, and generate a dynamic token based on the first timestamp, clock offset, time slice and pre-booked key with the server, and send the dynamic token to the server; the server receives When the dynamic token is received, at least one target dynamic token is generated according to the first timestamp, time slice and key; if there is a target dynamic token consistent with the dynamic token on the server side, it is determined that the client authentication is passed, and the target APP The corresponding server sends corresponding authentication passing information. The technical solution provided by the present invention generates unique and time-sensitive dynamic tokens through the client and the server respectively, and compares the dynamic tokens generated by the client and the server, thereby preventing illegal users from passing virtual software Simulating the device (client) to access the server can effectively ensure that the device (client) runs in a real environment, thereby preventing users from using a single legitimate device to create a large number of accounts for scamming.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

FIG. 1 is a schematic flowchart of a device authentication method provided by an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a device authentication system provided by an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

As used herein, the term "comprise" and its variations are open-ended, ie "including but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one further embodiment"; the term "some embodiments" means "at least some embodiments." Relevant definitions of other terms will be given in the description below.

It should be noted that concepts such as "first" and "second" mentioned in the disclosure of the present invention are only used to distinguish different devices, modules or units, and are not used to limit the functions performed by these devices, modules or units. sequence or interdependence.

It should be noted that the modifications of "one" and "multiple" mentioned in the disclosure of the present invention are illustrative and not restrictive, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "a or more".

Referring to FIG. 1 , it shows a schematic flowchart of a device authentication method provided by an embodiment of the present invention. The device authentication method is applied to a device authentication system. The device authentication system includes a client and a server. The device authentication method specifically includes the following step:

S101: When the client detects that the target APP initializes the client sdk, it sends parameter information to the server.

In the embodiment of the present application, the target APP can be pre-installed on the client, and when the user wants to participate in a marketing activity organized by the service party in the target APP, he can participate through the target APP installed on the client. Wherein, the target APP includes sdk.

In the process of specifically executing step S101, the client can detect in real time whether the target APP initializes the client sdk; when the client detects that the target APP initializes the client sdk, it can call the sdk to establish a connection with the server corresponding to the target APP; After establishing a connection with the server, obtain the device did and the appid of the target APP, and pass the parameter information generated according to the device did and appid to the server. Wherein, the device did is the device identifier of the client.

It should be noted that the client can pre-determine the corresponding key with the server. The pre-agreed key generation process is as follows: the client intercepts a part of the device ID from the device ID as the target device ID, and the target device ID and encryption The salt value is spliced, and the spliced target device ID and encrypted salt value are encrypted to obtain the corresponding key.

S102: When the server receives the parameter information, it generates a key according to the device identifier and the encrypted salt value.

During the specific execution of step S102, when the server receives the parameter information sent by the client, it can obtain the first time stamp and time slice from the time synchronization clock, and intercept a part of the device identifier from the received parameter information The device ID is used as the target device ID; the corresponding key is generated according to the target device ID and the encrypted salt value.

Wherein, the first timestamp is the current timestamp of the server.

It should be noted that the part of the device ID intercepted by the server from the device ID is the same as that intercepted by the client from the device ID. The pre-agreed key on the server side is the same.

In the embodiment of the present application, the target device ID and the encrypted salt value may be concatenated, and the spliced target device ID and encrypted salt value may be encrypted to obtain a corresponding key.

S103: The server sends the target parameter information generated according to the first timestamp and the time slice to the client.

During the specific execution of step S103, the server may generate corresponding target parameter information according to the first timestamp, time slice and key, and send the generated target parameter information to the client.

S104: When the client receives the target parameter information, calculate a clock offset according to the first timestamp and the second timestamp.

During the specific execution of step S104, when the client receives the target parameter information sent by the server, it obtains the second timestamp from the time synchronization clock, and according to the first timestamp and the second timestamp in the target parameter information, Calculate the corresponding time offset.

It should be noted that the second timestamp is the current local timestamp of the client.

S105: The client generates a dynamic token according to the second timestamp, the clock offset, the time slice and the key pre-agreed with the server, and sends the dynamic token to the server.

In this embodiment of the application, after calculating the time offset, the client can generate the calibration time according to the calculated time offset, the second timestamp, and the time slice in the target parameter information; The pre-agreed key on the server is processed to obtain the corresponding first hash value, and the first hash value is processed by the HMAC-sha1 algorithm to generate a corresponding dynamic token, and the dynamic token is sent to the server .

It should be noted that the calibration time and the key pre-determined with the server are processed by the hash algorithm to obtain the corresponding first hash value, and the first hash value is processed by the HMAC-sha1 algorithm to generate the corresponding The way of the dynamic token can be: code=HOTP(K, T)=Truncate(hash algorithm (K, T)); wherein, code is the dynamic token, K is the key predetermined by the client and the server, T is the calibration time.

It should also be noted that the dynamic token may be a 6-bit dynamic token number.

In some embodiments, the client can subtract the second timestamp from the first timestamp to obtain the time offset; and subtract the time offset from the second timestamp to obtain the corresponding difference, and divide the difference by the time slice , to get the calibration time.

S106: When the server receives the dynamic token, generate at least one target dynamic token according to the first timestamp, the time slice and the key.

During the specific execution of step S106, when the server receives the dynamic token sent by the client, it can determine the target calibration time based on the first time stamp through the clock synchronization clock. Wherein, the target calibration time is the same as the calibration time at the client side.

After obtaining the target calibration time, the server can add the target calibration time to the preset value to obtain the first calibration time, and subtract the preset data from the target calibration time to obtain the second calibration time; finally, use the hash algorithm to Process the target calibration time and key to obtain the second hash value, and use the HMAC-sha1 algorithm to process the second hash value to generate the first target dynamic token; use the hash algorithm to process the first calibration time and password key to obtain the third hash value, and use the HMAC-sha1 algorithm to process the third hash value to generate the second target dynamic token; use the hash algorithm to process the second calibration time and key to obtain the fourth hash value, and use the HMAC-sha1 algorithm to process the fourth hash value to generate the third target dynamic token.

It should be noted that the preset value may be 1, which may be set according to actual applications, which is not limited in this embodiment of the present application. According to the key in the target calibration time and the target parameter information, the way to generate at least one corresponding target dynamic token can be: code1=HOTP(K, T)=Truncate(hash algorithm (K, T1)), where code1 is the second target dynamic token, K is the key, and T1 is the target calibration time; code2=HOTP(K, T1-1)=Truncate(hash algorithm (K, T1-1)), wherein, code2 is the third target Dynamic token, K is the key, T1-1 is the first calibration time; code3=HOTP(K, T1+1)=Truncate(hash algorithm (K, T1+1)), wherein, code3 is the fourth target dynamic Token, K is the key, and T1+1 is the second calibration time.

S107: If there is a target dynamic token consistent with the dynamic token at the server end, determine that the client terminal has passed the authentication, and send corresponding authentication pass information to the service party corresponding to the target APP.

During the specific execution of step S107, after the server generates at least one target dynamic token according to the first timestamp, time slice and key, it can determine whether there is a The target dynamic token; if there is a target dynamic token consistent with the dynamic token, determine that the client has passed the authentication, send the corresponding authentication pass information to the server corresponding to the target APP, and allow the client to access the server.

If there is no target dynamic token consistent with the dynamic token in at least one target dynamic token, it can be considered that the client authentication fails, that is, it can be considered that the client is not legal, and the corresponding service party corresponding to the target APP is sent. Authentication failed information, and the client is prohibited from accessing the server to prevent illegal users from simulating the device (client) to access the server through virtual software, thereby preventing users from using a single legitimate device to create a large number of accounts for profit.

As a preferred mode of the embodiment of this application, at least one target dynamic token includes a first target dynamic token, a second target dynamic token and a third target dynamic token; the server determines whether the dynamic token is consistent with the first target dynamic token card, or whether it is consistent with the second target dynamic token, or whether it is consistent with the third target dynamic token.

If the dynamic token is consistent with the first target dynamic token, or the second target dynamic token, or the third target dynamic token, the server determines that the client authentication is passed, and sends a corresponding response to the server corresponding to the target APP. The authentication pass information.

If the dynamic token is inconsistent with the first target dynamic token, and inconsistent with the second target dynamic token, and inconsistent with the third target dynamic token, the server determines that the client authentication fails, and then the corresponding service of the target APP The corresponding authentication failure information is sent to prevent illegal users from simulating the device (client) through virtual software to access the server, so as to prevent users from using a single legitimate device to create a large number of accounts for profit.

The present invention provides a device authentication method. When the client detects that the target APP initializes the client sdk, the client sends parameter information to the server, wherein the parameter information includes at least the device identifier; when the server receives the parameter information, it Encrypt the salt value, generate a key, and send the target parameter information generated according to the first timestamp and time slice to the client; when the client receives the target parameter information, it calculates according to the first timestamp and the second timestamp Clock deviation, and generate a dynamic token according to the first timestamp, clock deviation, time slice and pre-booked key with the server, and send the dynamic token to the server; when the server receives the dynamic token, according to the first A timestamp, time slice and key to generate at least one target dynamic token; if there is a target dynamic token consistent with the dynamic token on the server side, determine that the client authentication is passed, and send the corresponding authentication to the service party corresponding to the target APP pass information. The technical solution provided by the present invention generates unique and time-sensitive dynamic tokens through the client and the server respectively, and compares the dynamic tokens generated by the client and the server, thereby preventing illegal users from passing virtual software Simulating the device (client) to access the server can effectively ensure that the device (client) runs in a real environment, thereby preventing users from using a single legitimate device to create a large number of accounts for scamming.

Based on the device authentication method disclosed in the embodiment of the present invention, the embodiment of the present invention also discloses a corresponding device authentication system, as shown in Figure 2, the device authentication system includes a client and a server, and the device authentication system includes:

The client is configured to send parameter information to the server when detecting that the target APP initializes the client sdk, wherein the parameter information includes at least a device identifier; when receiving the target parameter information, according to the first timestamp and the second timestamp, Calculate the clock deviation, and generate a dynamic token according to the second timestamp, clock deviation, time slice and the key pre-agreed with the server, and send the dynamic token to the server; The key is the same as the key; the second timestamp is the local timestamp of the client;

The server is configured to generate a key according to the device identifier and encrypted salt value when receiving the parameter information, and send the target parameter information generated according to the first timestamp and time slice to the client; wherein, the first timestamp is the local timestamp of the server; when receiving the dynamic token, generate at least one target dynamic token according to the first timestamp, time slice and key; if there is a target dynamic token consistent with the dynamic token, determine the client If the authentication is passed, corresponding authentication passing information is sent to the service party corresponding to the target APP.

The present invention provides a device authentication system. When the client detects that the target APP initializes the client sdk, it sends parameter information to the server, wherein the parameter information includes at least the device identifier; when the server receives the parameter information, it Encrypt the salt value, generate a key, and send the target parameter information generated according to the first timestamp and time slice to the client; when the client receives the target parameter information, it calculates according to the first timestamp and the second timestamp Clock deviation, and generate a dynamic token according to the first timestamp, clock deviation, time slice and pre-booked key with the server, and send the dynamic token to the server; when the server receives the dynamic token, according to the first A timestamp, time slice and key to generate at least one target dynamic token; if there is a target dynamic token consistent with the dynamic token on the server side, determine that the client authentication is passed, and send the corresponding authentication to the service party corresponding to the target APP pass information. The technical solution provided by the present invention generates unique and time-sensitive dynamic tokens through the client and the server respectively, and compares the dynamic tokens generated by the client and the server, thereby preventing illegal users from passing virtual software Simulating the device (client) to access the server can effectively ensure that the device (client) runs in a real environment, thereby preventing users from using a single legitimate device to create a large number of accounts for scamming.

Optionally, when the parameter information is received, a key is generated according to the device identifier and the encrypted salt value, and the target parameter information generated according to the first timestamp and time slice is sent to the server of the client, specifically for:

When the parameter information is received, obtain the first timestamp and time slice from the time synchronization clock, and intercept the target device ID from the device ID; generate a key according to the target device ID and encrypted salt value; according to the first timestamp and time slice , generate target parameter information, and send the target parameter information to the client.

Optionally, when the target parameter information is received, calculate the clock offset according to the first timestamp and the second timestamp, and generate a dynamic Token, and send the dynamic token to the server client, specifically for:

When the target parameter information is received, the second time stamp is obtained from the time synchronization clock, and the clock deviation is calculated according to the first time stamp and the second time stamp; wherein, the target parameter information includes the first time stamp and the first time slice; according to The second timestamp, clock offset and time slice generate the calibration time; use the hash algorithm to process the calibration time and the pre-scheduled key with the server to obtain the corresponding first hash value, and use the HMAC-sha1 algorithm to process the calibration time The first hash value is processed, a corresponding dynamic token is generated, and the dynamic token is sent to the server.

Optionally, when receiving the dynamic token, generate at least one target dynamic token server according to the first timestamp, time slice and key, specifically for:

When the dynamic token is received, the target calibration time is determined according to the first time stamp; the target calibration time is added to a preset value to obtain the first calibration time, and the target calibration time is subtracted from the preset data to obtain the second calibration time Time; use the hash algorithm to process the target calibration time and key to obtain the second hash value, and use the HMAC-sha1 algorithm to process the second hash value to generate the first target dynamic token; use the hash algorithm Process the first calibration time and key to obtain a third hash value, and use the HMAC-sha1 algorithm to process the third hash value to generate a second target dynamic token; use the hash algorithm to process the second calibration time and the key to obtain the fourth hash value, and use the HMAC-sha1 algorithm to process the fourth hash value to generate the third target dynamic token.

Optionally, if there is a target dynamic token that is consistent with the dynamic token, determine that the client has passed the authentication, send corresponding authentication passing information to the server corresponding to the target APP, and allow the client to access the server, specifically for:

Judging whether the dynamic token is consistent with the first target dynamic token, or whether it is consistent with the second target dynamic token, or whether it is consistent with the third target dynamic token; if the dynamic token is consistent with the first target dynamic token, or Consistent with the second target dynamic token, or consistent with the third target dynamic token, determine that the client is authenticated, send corresponding authentication pass information to the server corresponding to the target APP, and allow the client to access the server.

An embodiment of the present application provides an electronic device. As shown in FIG. 3 , the electronic device includes a processor 301 and a memory 302, the memory 302 is used for program codes and data for device authentication, and the processor 301 is used to call program instructions in the memory Execute the steps shown in the device authentication method in the above embodiment.

An embodiment of the present application provides a storage medium, and the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the device authentication method shown in the foregoing embodiments.

Each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment. The above-described systems and system embodiments are only illustrative, where the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

The above are only preferred embodiments of the present invention, and it should be pointed out that for those of ordinary skill in the art, some improvements and modifications can also be made without departing from the principle of the present invention, and these improvements and modifications should also be considered Be the protection scope of the present invention.

Claims (10)

1. A device authentication method, characterized in that the method comprises: When the client detects that the target APP initializes the client sdk, it sends parameter information to the server, wherein the parameter information includes at least a device identifier; When the server receives the parameter information, it generates a key according to the device identifier and encrypted salt value, and sends the target parameter information generated according to the first timestamp and time slice to the client; wherein , the first timestamp is the local timestamp of the server; When the client receives the target parameter information, it calculates a clock offset according to the first timestamp and the second timestamp, and calculates the clock offset according to the second timestamp, the clock offset, the time slice and the The key pre-agreed by the server generates a dynamic token, and sends the dynamic token to the server; wherein, the key predetermined by the server is the same as the key; The second timestamp is a local timestamp of the client; When the server receives the dynamic token, it generates at least one target dynamic token according to the first timestamp, the time slice and the key; If there is a target dynamic token consistent with the dynamic token, the server determines that the client has passed the authentication, and sends corresponding authentication passing information to the service party corresponding to the target APP. 2. The method according to claim 1, wherein when the server receives the parameter information, it generates a key according to the device identifier and encrypted salt value, and generates a key according to the first timestamp and time sheet, the generated target parameter information is sent to the client, including: When the server receives the parameter information, it obtains the first time stamp and time slice from the time synchronization clock, and intercepts the target device identifier from the device identifier; The server generates a key according to the target device identifier and the encrypted salt value; The server generates target parameter information according to the first timestamp and the time slice, and sends the target parameter information to the client. 3. The method according to claim 2, wherein when the client receives the target parameter information, it calculates the clock offset according to the first timestamp and the second timestamp, and calculates the clock offset according to the The second timestamp, the clock deviation, the time slice and the key pre-determined with the server, generate a dynamic token, and send the dynamic token to the server, including: When the client receives the target parameter information, it obtains a second time stamp from the time synchronization clock, and calculates a clock offset according to the first time stamp and the second time stamp; wherein, the target The parameter information includes the first time stamp and the first time slice; The client generates a calibration time according to the second timestamp, the first clock offset, and the time slice; wherein, the calibration time is the same as the target calibration time; The client uses a hash algorithm to process the calibration time and the key pre-determined with the server to obtain a corresponding first hash value, and uses the HMAC-sha1 algorithm to process the first hash value process, generate a corresponding dynamic token, and send the dynamic token to the server. 4. The method according to claim 2, wherein when the server receives the dynamic token, it generates at least one target dynamic token according to the first timestamp, the time slice and the key cards, including: When the server receives the dynamic token, it determines the target calibration time according to the first time stamp, and adds a preset value to the target calibration time to obtain the first calibration time, and calculates the target calibration time Subtracting the preset data to obtain a second calibration time; The server uses a hash algorithm to process the target calibration time and the key to obtain a second hash value, and uses the HMAC-sha1 algorithm to process the second hash value to generate a first target Dynamic token; use a hash algorithm to process the first calibration time and the key to obtain a third hash value, and use the HMAC-sha1 algorithm to process the third hash value to generate a second The target dynamic token; use a hash algorithm to process the second calibration time and the key to obtain a fourth hash value, and use the HMAC-sha1 algorithm to process the fourth hash value to generate a fourth hash value Three-goal dynamic token. 5. The method according to claim 4, wherein the server judges whether there is a target dynamic token consistent with the dynamic token among the at least one target dynamic token; The target dynamic token with the same dynamic token determines that the client has passed the authentication, and sends corresponding authentication pass information to the service party corresponding to the target APP, including: The server determines whether the dynamic token is consistent with the first target dynamic token, or whether it is consistent with the second target dynamic token, or whether it is consistent with the third target dynamic token; If the dynamic token is consistent with the first target dynamic token, or is consistent with the second target dynamic token, or is consistent with the third target dynamic token, the server determines that the client If the authentication is passed, corresponding authentication passing information is sent to the service party corresponding to the target APP. 6. A device authentication system, characterized in that the device authentication system includes a client and a server; The client is configured to send parameter information to the server when detecting that the target APP initializes the client sdk, wherein the parameter information includes at least a device identifier; when receiving the target parameter information, according to the first Timestamp and second timestamp, calculate the clock offset, and generate a dynamic token according to the second timestamp, the clock offset, the time slice and the key pre-agreed with the server, and send the The dynamic token is sent to the server; wherein, the key predetermined by the server is the same as the key; the second timestamp is the local timestamp of the client; The server is configured to generate a key according to the device identifier and encrypted salt value when receiving the parameter information, and send the target parameter information generated according to the first timestamp and time slice to the client terminal; wherein, the first timestamp is the local timestamp of the server; when the dynamic token is received, at least one target is generated according to the first timestamp, the time slice and the key Dynamic token; if there is a target dynamic token consistent with the dynamic token, determine that the client has passed the authentication, send corresponding authentication passing information to the service party corresponding to the target APP, and allow the client to access the server. 7. The system according to claim 6, wherein when the parameter information is received, a key is generated according to the device identifier and encrypted salt value, and a key is generated according to the key, the first timestamp and Time slice, the generated target parameter information is sent to the server of the client, specifically for: When receiving the parameter information, obtain the first time stamp and time slice from the time synchronization clock, and intercept the target device ID from the device ID; generate a key according to the target device ID and encrypted salt value; The first timestamp and the time slice are used to generate target parameter information, and the target parameter information is sent to the client. 8. The system according to claim 7, wherein when the target parameter information is received, the clock offset is calculated according to the first time stamp and the second time stamp, and according to the second time stamp Stamp, the clock deviation, the time slice and the pre-booked key with the server, generate a dynamic token, and send the dynamic token to the client of the server, specifically for: When receiving the target parameter information, obtain a second time stamp from the time synchronization clock, and calculate a clock offset according to the first time stamp and the second time stamp; wherein the target parameter information includes the The first time stamp and the first time slice; according to the second time stamp, the clock offset and the time slice, generate a calibration time; use a hash algorithm to compare the calibration time and the server Pre-determined keys are processed to obtain the corresponding first hash value, and the HMAC-sha1 algorithm is used to process the first hash value to generate a corresponding dynamic token, and the dynamic token is sent to the server. 9. An electronic device, characterized in that it includes: a processor and a memory, the processor and the memory are connected through a communication bus; wherein the processor is used to call and execute a program stored in the memory; the The memory is used to store a program, and the program is used to realize the device authentication method according to any one of claims 1-5. 10. A computer-readable storage medium, characterized in that, computer-executable instructions are stored in the computer-readable storage medium, and the computer-executable instructions are used to execute the method according to any one of claims 1-5. Device authentication method.

Images