Information verification method and related apparatus, device, and storage medium for logging in to a server of a target application without exposing privacy information of a user to the target application

Patent metadata

Field	Value
Publication number	US-12294572-B2
Application number	US-202217977407-A
Country	US
Kind code	B2
Filing date	Oct 31, 2022
Priority date	Apr 2, 2021
Publication date	May 6, 2025
Grant date	May 6, 2025

Abstract

An information verification method based on a cloud security technology is provided. Before transmitting to-be-verified information including user information, a terminal device performs encryption processing on the to-be-verified information by using random numbers and a public key issued by a verification server, to obtain to-be-verified ciphertext information, which is to be used throughout transmission for logging into a server of a third-party application. The server of the third-party application cannot decrypt the to-be-verified information and the to-be-verified information may be obtained only by the verification server. The verification server transmits an application login success message to the terminal device based on decryption processing on the to-be-verified ciphertext information. In this way, the server of the third-party application may be logged in to without exposing privacy information of a user to the third-party application, thereby improving the security of identity verification.

First claim

What is claimed is:

1. An information verification method, performed by a verification server, the information verification method comprising:
obtaining, in response to a key agreement request from a terminal device, key agreement data comprising a public key and a first random number, the key agreement request including an identifier of a target user;
transmitting, to the terminal device, the key agreement data, based on which, after an application login request to an application server is initiated by the terminal device and to-be-verified information is entered through the terminal device, encryption processing is performed at the terminal device on the to-be-verified information for a target application by using a second random number, the public key, and the first random number included in the key agreement data, to obtain to-be-verified ciphertext information, the to-be-verified information comprising user information corresponding to the target user, the application server being a server of the target application;
receiving, either from the terminal device or from the application server, the to-be-verified ciphertext information;
performing decryption processing on the to-be-verified ciphertext information, to obtain a first information digest;
matching the first information digest with a second information digest, to obtain an information verification result, the second information digest being a stored information digest; and
transmitting the information verification result to the terminal device, the information verification result indicating a result of logging in to the application server by the terminal device, without providing the to-be-verified information to the server of the target application.

2. The information verification method according to claim 1 , wherein the obtaining the key agreement data comprises:
transmitting a ciphertext generation request to an encryptor;
receiving, from the encryptor, ciphertext data generated based on the ciphertext generation request, the ciphertext data comprising the public key and the first random number; and
generating the key agreement data based on the public key and the first random number included in the ciphertext data.

3. The information verification method according to claim 2 , wherein the ciphertext data further comprises a public key index value, the public key index value uniquely corresponding to the public key;
the generating the key agreement data comprises:
generating a session identifier based on the identifier of the target user included in the key agreement request; and
generating the key agreement data based on the session identifier, the public key, and the first random number;
the information verification method further comprising:
establishing a mapping relationship between the session identifier, the public key, the first random number, and the public key index value; and
wherein the performing the decryption processing comprises:
performing, based on the mapping relationship and the session identifier, the decryption processing on the to-be-verified ciphertext information, to obtain the first information digest.

4. The information verification method according to claim 3 , wherein the performing the decryption processing based on the mapping relationship and the session identifier comprises:
obtaining the public key index value from a database based on the mapping relationship and the session identifier;
transmitting the public key index value to the encryptor; and
invoking the encryptor to perform the decryption processing on the to-be-verified ciphertext information by using a private key corresponding to the public key, to obtain the first information digest, the public key being determined based on the public key index value.

5. The information verification method according to claim 1 , wherein the to-be-verified ciphertext information is generated by the terminal device based on a key ciphertext and a transmission ciphertext, and the performing the decryption processing comprises:
performing decryption processing on the key ciphertext by using a private key corresponding to the public key, to obtain the first random number and the second random number that are used as symmetric keys; and
performing decryption processing on the transmission ciphertext by using the symmetric keys, to obtain the first information digest.

6. The information verification method according to claim 1 , further comprising, prior to the matching the first information digest with the second information digest:
obtaining a key index value and to-be-matched ciphertext information from a database;
transmitting the key index value and the to-be-matched ciphertext information to an encryptor; and
invoking the encryptor to perform decryption processing on the to-be-matched ciphertext information, to obtain the second information digest, the second information digest being obtained by the encryptor by performing decryption processing on the to-be-matched ciphertext information by using an information encryption key, the information encryption key being determined based on the key index value.

7. The information verification method according to claim 1 , further comprising, after the matching the first information digest with the second information digest:
generating a token based on the information verification result indicating that verification succeeds, a preset usage cycle being set for the token;
transmitting the token to the terminal device;
obtaining, based on the application login request from the terminal device being received, a usage time of the token in response to the application login request, the application login request including the token; and
transmitting an application login success message to the terminal device based on the usage time of the token being within the preset usage cycle.

8. The information verification method according to claim 1 , further comprising:
receiving an authentication request from the application server, the authentication request including an application key index and an application key;
performing verification processing on the application key index and the application key in response to the authentication request, to obtain a verification result; and
performing, based on the verification result being successful, the obtaining the key agreement data in response to the key agreement request.

9. The information verification method according to claim 1 , further comprising:
receiving an authentication request from the application server, the authentication request including an application key index, a timestamp, a signature random number, and first signature information, the first signature information being obtained by signing a first application key, the timestamp, and the signature random number based on a hash function encryption algorithm;
obtaining a second application key in response to the authentication request and based on the application key index;
signing the second application key, the timestamp, and the signature random number based on the hash function encryption algorithm, to obtain second signature information; and
performing, based on the first signature information and the second signature information being successfully matched, the obtaining the key agreement data in response to the key agreement request.

10. An information verification method, performed by a terminal device, the information verification method comprising:
initiating an application login request to an application server by the terminal device, and entering, through the terminal device, to-be-verified information, the application server being a server of a target application;
transmitting

Assignees

• Tencent Tech Shenzhen Co Ltd

Inventors

• Wang Ben
• Wang Xu
• Zeng Xiangkai
• Li Junhao

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• G06F21/46

  by designing passwords or checking the strength of passwords · CPC title