An identity authentication method, apparatus, device, medium, and product.

Abstract

This disclosure relates to an identity authentication method, apparatus, device, medium, and product. The method includes: after a user on a client side has successfully registered, sending an access request to a server; wherein the access request carries the user's username; obtaining an encrypted string returned by the server and sending the encrypted string to a SIM card; wherein the encrypted string is obtained by encrypting a verification information string using the public key of a key pair generated by the server for the user on the SIM card, and the SIM card stores the key pair generated for the successfully registered user; obtaining the decryption result of the SIM card decrypting the encrypted string using the user's corresponding private key, and sending the decryption result to the server, so that the server can authenticate the user's identity based on the decryption result. This disclosure can improve the security of identity authentication.

Description

Technical Field

[0001] This disclosure relates to the field of internet security, and in particular to an identity authentication method, device, equipment, medium, and product. Background Technology

[0002] Identity authentication technology refers to the process by which computer and network systems verify the identity of an operator. In the network era, to ensure the credibility and reliability of transaction communications, it is essential to correctly identify the identities of both parties in the communication. The level of development of identity authentication technology directly determines the level of development of the information technology industry.

[0003] In related technologies, identity authentication relies on third-party systems or requires the introduction of additional physical secure identity authentication devices to complete the authentication process. The identity authentication methods in these technologies carry the risk of leaking personal information and cannot guarantee the security of identity authentication. Summary of the Invention

[0004] This disclosure provides an identity authentication method, apparatus, device, medium, and product.

[0005] According to a first aspect of this disclosure, an authentication method is provided, applied to a client, the method comprising:

[0006] After a user on the client side successfully registers, an access request is sent to the server; wherein the access request carries the user's username;

[0007] The server retrieves the encrypted string returned by the server and sends the encrypted string to the SIM card; wherein the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated by the SIM card for the user, and the SIM card stores the key pair generated for successfully registered users;

[0008] The system obtains the decryption result of the encrypted string decrypted by the SIM card based on the user's private key, and sends the decryption result to the server so that the server can authenticate the user's identity based on the decryption result.

[0009] Furthermore, sending the encrypted string to the SIM includes:

[0010] Determine the key pair name corresponding to the user;

[0011] The key pair name and the encrypted string are sent to the SIM card; wherein the SIM card determines a private key for decrypting the encrypted string based on the key pair name.

[0012] Further, determining the key pair name corresponding to the user includes:

[0013] Send a request to the SIM card to obtain a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user;

[0014] Obtain and display the list of key pair names;

[0015] In response to a selection operation on the list of key pair names, the key pair name corresponding to the selection operation is determined as the key pair name corresponding to the user.

[0016] Furthermore, before sending an access request to the server, the method further includes:

[0017] Send a key generation request to the SIM card; wherein the key generation request carries the name and / or key tag information of the key pair to be requested;

[0018] Obtain the public key from the key pair generated by the SIM card based on the key generation request;

[0019] Send an account registration request to the server; wherein the account registration request carries the user's public key and username;

[0020] Obtain the account registration result from the server based on the account registration application.

[0021] According to a second aspect of this disclosure, an authentication method is provided, applied to a server, the method comprising:

[0022] Get the access request sent by the client;

[0023] Send an encrypted string to the client; wherein the encrypted string is obtained by encrypting the verification information string with the public key in the key pair generated for the user by the SIM card, and the SIM card stores the key pair generated for the successfully registered user;

[0024] Obtain the decryption result sent by the client; wherein the decryption result is obtained by the SIM card decrypting the encrypted string based on the private key corresponding to the key pair name;

[0025] The user is authenticated based on the decryption result to obtain the authentication result.

[0026] Furthermore, sending the encrypted string to the client includes:

[0027] After receiving the access request, a verification information string is generated;

[0028] The verification information string is encrypted using the user's public key to generate the encrypted string, which is then sent to the client.

[0029] Further, the step of authenticating the user's identity based on the decryption result to obtain the authentication result includes:

[0030] Obtain the first ciphertext ID carried in the decryption result returned by the client;

[0031] Compare the first ciphertext ID with the second ciphertext ID carried in the encrypted string;

[0032] If the first ciphertext ID and the second ciphertext ID are found to be the same, and the decryption result is the same as the verification information string, an authentication result is obtained that the user's identity has been authenticated.

[0033] Furthermore, before obtaining the access request sent by the client, the method further includes:

[0034] Obtain the account registration request sent by the client; wherein the account registration request carries the user's public key and username;

[0035] In response to the account registration request, an account is registered for the user, and the account registration result is returned to the client.

[0036] According to a third aspect of this disclosure, an identity authentication method is provided, applied to a SIM card, the method comprising:

[0037] Obtain the encrypted string sent by the client; wherein the encrypted string is sent by the server to the client in response to the client's access request, and the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card;

[0038] The encrypted string is decrypted based on the user's private key to obtain the decryption result;

[0039] The decryption result is sent to the client so that the client can authenticate the user's identity through the server based on the decryption result.

[0040] Furthermore, before obtaining the encrypted string sent by the client, the method further includes:

[0041] Obtain the key generation request sent by the client; wherein the key generation request carries the name and / or key tag information of the key pair to be requested;

[0042] In response to the key generation request, generate the user's key pair;

[0043] Store the private key in the key pair and return the public key in the key pair to the client.

[0044] Further, the step of decrypting the encrypted string based on the user's private key to obtain the decryption result includes:

[0045] Determine the key pair name corresponding to the user;

[0046] The encrypted string is decrypted using the private key corresponding to the key pair name to obtain the decryption result.

[0047] Further, determining the key pair name corresponding to the user includes:

[0048] Obtain the request to obtain the list of key pair names sent by the client; wherein the list of key pair names contains the names of the key pairs corresponding to each registered user;

[0049] Return the list of key pair names to the client;

[0050] Obtain the key pair name selected by the client based on the key pair name list, and obtain the key pair name corresponding to the user.

[0051] Further, the step of decrypting the encrypted string based on the user's private key to obtain the decryption result includes:

[0052] The encrypted string is decrypted using each private key to obtain the decryption result.

[0053] According to a fourth aspect of this disclosure, an identity authentication device is provided, disposed on a client, the device comprising:

[0054] The first sending module is used to send an access request to the server after the user of the client has successfully registered; wherein the access request carries the user's username;

[0055] The first acquisition module is used to acquire the encrypted string returned by the server and send the encrypted string to the SIM card; wherein, the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated by the SIM card for the user, and the SIM card stores the key pair generated for the successfully registered user;

[0056] The second sending module is used to obtain the decryption result of the SIM card decrypting the encrypted string based on the user's private key, and send the decryption result to the server so that the server can authenticate the user's identity based on the decryption result.

[0057] According to a fifth aspect of this disclosure, an identity authentication device is provided, disposed on a server, the device comprising:

[0058] The fourth acquisition module is used to acquire access requests sent by the client;

[0059] The fourth sending module is used to send an encrypted string to the client; wherein the encrypted string is obtained by encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card, and the SIM card stores the key pair generated for successfully registered users;

[0060] The fifth acquisition module is used to acquire the decryption result sent by the client; wherein the decryption result is obtained by the SIM card decrypting the encrypted string based on the private key corresponding to the key pair name;

[0061] The authentication module performs identity authentication on the user based on the decryption result, and obtains the identity authentication result.

[0062] According to a sixth aspect of this disclosure, an identity authentication device is provided, disposed on a SIM card, the device comprising:

[0063] The seventh acquisition module is used to acquire the encrypted string sent by the client; wherein, the encrypted string is sent by the server to the client in response to the client's access request, and the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card;

[0064] The decryption module is used to decrypt the encrypted string based on the user's private key to obtain the decryption result;

[0065] The fifth sending module is used to send the decryption result to the client so that the client can authenticate the user's identity through the server based on the decryption result.

[0066] According to a seventh aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, the memory storing a computer program, the processor executing the program to implement the method as described in the first aspect of this disclosure, and / or the method as described in the second aspect of this disclosure, and / or the method as described in the third aspect of this disclosure.

[0067] According to an eighth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method as described in the first aspect of this disclosure, and / or the method as described in the second aspect of this disclosure, and / or the method as described in the third aspect of this disclosure.

[0068] According to a ninth aspect of this disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, implements the methods described in the first aspect of this disclosure, and / or the methods described in the second aspect of this disclosure, and / or the methods described in the third aspect of this disclosure.

[0069] This disclosure provides an identity authentication method, apparatus, device, medium, and product. In this embodiment, firstly, after a user on the client side successfully registers, the client sends an access request to the server, carrying the user's username. Then, the client obtains an encrypted string returned by the server and sends the encrypted string to the SIM card. The encrypted string is obtained by encrypting a verification information string using the public key from a key pair generated for the user on the SIM card. The SIM card stores the key pair generated for the successfully registered user. Finally, the client obtains the decryption result of the encrypted string decrypted by the SIM card using the user's corresponding private key and sends the decryption result to the server, enabling the server to authenticate the user based on the decryption result.

[0070] As described above, during the authentication process, after the client sends an access request to the server, the server encrypts the verification information string using the public key from the key pair generated for the user on the SIM card, resulting in an encrypted string. The client can then decrypt this encrypted string using the user's private key via the SIM card, obtaining the decryption result. The server then authenticates the user based on the decryption result. This authentication process uses a symmetric key; the private key is stored on the SIM card. In use, the server encrypts a random string using the public key, decrypts the encrypted string on the SIM card, and returns the decrypted string. This method ensures key security while achieving authentication, avoiding the risk of private key leakage and guaranteeing the security of the authentication process. Attached Figure Description

[0071] Further details, features, and advantages of this disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0072] Figure 1 A flowchart illustrating an exemplary embodiment of this disclosure;

[0073] Figure 2 A schematic diagram illustrating the interaction process between a client, a server, and a SIM card, provided as an exemplary embodiment of this disclosure;

[0074] Figure 3 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0075] Figure 4 A schematic diagram illustrating the interaction process between a client and a SIM card, provided as an exemplary embodiment of this disclosure;

[0076] Figure 5 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0077] Figure 6 A schematic diagram illustrating the interaction process between a client, a server, and a SIM card, provided as another exemplary embodiment of this disclosure;

[0078] Figure 7 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0079] Figure 8 A schematic diagram illustrating the interaction process between a client and a server provided for an exemplary embodiment of this disclosure;

[0080] Figure 9 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0081] Figure 10 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0082] Figure 11 A schematic diagram illustrating the interaction process between a client and a SIM card, provided as another exemplary embodiment of this disclosure;

[0083] Figure 12 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0084] Figure 13 A schematic diagram illustrating the interaction process between a client and a SIM card, provided as another exemplary embodiment of this disclosure;

[0085] Figure 14 A flowchart of an identity authentication method provided as another exemplary embodiment of this disclosure;

[0086] Figure 15 A schematic diagram illustrating the interaction process between a client and a SIM card, provided as another exemplary embodiment of this disclosure;

[0087] Figure 16 A schematic block diagram of the functional modules of an identity authentication device provided in an exemplary embodiment of this disclosure;

[0088] Figure 17 A schematic block diagram of the functional modules of an identity authentication device provided as another exemplary embodiment of this disclosure;

[0089] Figure 18 A schematic block diagram of the functional modules of an identity authentication device provided as another exemplary embodiment of this disclosure;

[0090] Figure 19 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure;

[0091] Figure 20 A block diagram of a computer system provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0092] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0093] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0094] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0095] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0096] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0097] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0098] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0099] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of this disclosure; other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0100] In one embodiment, such as Figure 1 As shown, an authentication method is provided for application on a client side, including the following steps:

[0101] Step 101: After the user on the client side has successfully registered, an access request is sent to the server.

[0102] In one possible embodiment, such as Figure 2 As shown, Figure 2 An exemplary diagram illustrates the interaction process between the client, server, and SIM card. The user registers by entering their username on the client. After the user's registration is successful, the client sends an access request to the server, which includes the user's username.

[0103] Step 102: Obtain the encrypted string returned by the server and send the encrypted string to the SIM card.

[0104] After a user on the client successfully registers and sends an access request to the server, the client obtains the encrypted string returned by the server and sends the encrypted string to the SIM card. The encrypted string is obtained by encrypting the verification information string with the public key in the key pair generated for the user by the SIM card. The SIM card stores the key pair generated for the successfully registered user.

[0105] In one possible embodiment, sending an encrypted string to the SIM card includes the following steps:

[0106] Determine the key pair name corresponding to the user;

[0107] Send the key pair name and encryption string to the SIM card.

[0108] Specifically, such as Figure 2 As shown, after the user on the client successfully registers and sends an access request to the server, the client obtains the encrypted string returned by the server. First, the client determines the key pair name corresponding to the user. This key pair is the key pair generated by the SIM card when the user successfully registers. Then, the client sends the key pair name and the encrypted string to the SIM card. The SIM card will determine the private key used to decrypt the encrypted string based on the key pair name.

[0109] Step 103: Obtain the decryption result of the SIM card decrypting the encrypted string based on the user's private key, and send the decryption result to the server so that the server can authenticate the user's identity based on the decryption result.

[0110] After the client obtains the encrypted string returned by the server and sends the encrypted string to the SIM card, the client obtains the decryption result of the encrypted string decrypted by the SIM card based on the user's private key, and sends the decryption result to the server so that the server can authenticate the user's identity based on the decryption result.

[0111] In one possible embodiment, such as Figure 2 As shown, after the client obtains the encrypted string returned by the server and sends the encrypted string to the SIM card, the SIM card decrypts the encrypted string. The client obtains the decryption result of the SIM card decrypting the encrypted string based on the user's private key and sends the decryption result to the server so that the server can authenticate the user's identity based on the decryption result.

[0112] This disclosure provides an identity authentication method, apparatus, device, medium, and product. In this embodiment, firstly, after a user on the client side successfully registers, the client sends an access request to the server, carrying the user's username. Then, the client obtains an encrypted string returned by the server and sends the encrypted string to the SIM card. The encrypted string is obtained by encrypting a verification information string using the public key from a key pair generated for the user on the SIM card. The SIM card stores the key pair generated for the successfully registered user. Finally, the client obtains the decryption result of the encrypted string decrypted by the SIM card using the user's corresponding private key and sends the decryption result to the server, enabling the server to authenticate the user based on the decryption result.

[0113] As described above, during the authentication process, after the client sends an access request to the server, the server encrypts the verification information string using the public key from the key pair generated for the user on the SIM card, resulting in an encrypted string. The client can then decrypt this encrypted string using the user's private key via the SIM card, obtaining the decryption result. The server then authenticates the user based on the decryption result. This authentication process uses a symmetric key; the private key is stored on the SIM card. In use, the server encrypts a random string using the public key, decrypts the encrypted string on the SIM card, and returns the decrypted string. This method ensures key security while achieving authentication, avoiding the risk of private key leakage and guaranteeing the security of the authentication process.

[0114] In one embodiment, such as Figure 3 As shown, the client determines the key pair name corresponding to the user, and also includes the following steps:

[0115] Step 301: Send a request to the SIM card to obtain the list of key pair names.

[0116] In one possible embodiment, such as Figure 4 As shown, Figure 4 An exemplary diagram illustrates the interaction process between the client and the SIM card. After obtaining the encrypted string returned by the server, the client first sends a request to the SIM card to obtain a list of key pair names, which contains the names of the key pairs corresponding to each registered user.

[0117] Step 302: Obtain and display the list of key pair names.

[0118] In one possible embodiment, such as Figure 4As shown, after the client sends a request to the SIM card to obtain the list of key pair names, the SIM card sends the list of key pair names to the client. The client obtains and displays the list of key pair names, and the user can select a key pair name based on the list.

[0119] Step 303: In response to the selection operation of the key pair name list, the key pair name corresponding to the selection operation is determined as the key pair name corresponding to the user.

[0120] In one possible embodiment, such as Figure 4 As shown, after the client obtains and displays the list of key pair names, the client responds to the selection operation of the key pair name list by determining the key pair name corresponding to the user.

[0121] In this embodiment, firstly, the client sends a request to the SIM card to obtain the key pair name list. Then, the client obtains and displays the key pair name list. Finally, in response to the selection operation of the key pair name list, the client determines the key pair name corresponding to the selection operation as the key pair name corresponding to the user. The user can intuitively see the key pair name list, which contains the key pair names corresponding to each registered user. The user selects the corresponding key pair name according to the server to be accessed. Moreover, when a user registers, different platforms can also use the same key pair for registration. When accessing different platforms, selecting the same key pair name can be used for identity authentication, which improves the user experience and the flexibility of the identity authentication method.

[0122] In one embodiment, such as Figure 5 As shown, before sending an access request to the server, the client also includes the following steps:

[0123] Step 501: Send a key generation request to the SIM card.

[0124] In one possible embodiment, such as Figure 6 As shown, Figure 6 An exemplary diagram illustrates another interaction process between a client, server, and SIM card. Before sending an access request to the server, the client needs to register as a user. The client sends a key generation request to the SIM card, which carries the name and / or key tag information of the requested key pair. The name and key tag information of the key pair are user-defined. The name of the key pair can be "XX website key", and the key tag information can be "generated on April 10, 2024". It should be noted that the specific content of the name and key tag information of the key pair is not limited here.

[0125] Step 502: Obtain the public key from the key pair generated by the SIM card based on the key generation request.

[0126] In one possible embodiment, such as Figure 6 As shown, after the client sends a key generation request to the SIM card, the SIM card generates a key pair based on the key generation request. The key pair includes a private key and a public key. The SIM card saves the private key and sends the public key to the client. The client then obtains the public key from the key pair generated by the SIM card based on the key generation request.

[0127] Step 503: Send an account registration request to the server.

[0128] In one possible embodiment, such as Figure 6 As shown, after the client obtains the public key from the key pair generated by the SIM card based on the key generation request, it sends an account registration application to the server. The account registration application carries the user's public key and username.

[0129] Step 504: Obtain the account registration result from the server based on the account registration application.

[0130] In one possible embodiment, such as Figure 6 As shown, after the client sends an account registration request to the server, the client obtains the account registration result from the server based on the account registration request.

[0131] In this embodiment, firstly, the client sends a key generation request to the SIM card to obtain the public key from the key pair generated by the SIM card based on the key generation request. Then, the client sends an account registration application to the server to obtain the account registration result from the server based on the account registration application. The account registration application carries the user's public key and username. Throughout the entire interaction process, the server only obtains the public key, while the user's private key is always stored on the SIM card, avoiding the risk that the private key may be leaked by the server and ensuring the security of identity authentication.

[0132] In one embodiment, such as Figure 7 As shown, an authentication method is provided, applied to a server, including the following steps:

[0133] Step 701: Obtain the access request sent by the client.

[0134] In one possible embodiment, such as Figure 8 As shown, Figure 8 An exemplary diagram illustrates the interaction process between a client and a server. After a user on the client successfully registers, they send an access request to the server, which then receives the access request from the client.

[0135] Step 702: Send an encrypted string to the client.

[0136] After receiving the access request sent by the client, the server sends an encrypted string to the client. The encrypted string is obtained by encrypting the verification information string with the public key in the key pair generated for the user by the SIM card. The SIM card stores the key pair generated for successfully registered users.

[0137] In one possible embodiment, sending an encrypted string to the client includes the following steps:

[0138] After receiving the access request, a verification information string is generated;

[0139] The verification information string is encrypted using the user's public key to generate an encrypted string, which is then sent to the client.

[0140] Specifically, such as Figure 8 As shown, after the server receives the access request sent by the client, the server randomly generates a dynamic verification information string. Then, the server encrypts the verification information string based on the user's public key to generate an encrypted string, and sends the encrypted string to the client.

[0141] Step 703: Obtain the decryption result sent by the client.

[0142] In one possible embodiment, such as Figure 8 As shown, after the server sends an encrypted string to the client, the server obtains the decryption result sent by the client. The decryption result is obtained by the SIM card decrypting the encrypted string based on the private key corresponding to the key pair name.

[0143] Step 704: Authenticate the user's identity based on the decryption result to obtain the authentication result.

[0144] After the server obtains the decryption result sent by the client, the server performs identity authentication on the user based on the decryption result and obtains the identity authentication result.

[0145] In one possible embodiment, user authentication is performed based on the decryption result to obtain the authentication result, including the following steps:

[0146] Obtain the first ciphertext ID carried in the decryption result returned by the client;

[0147] Compare the first ciphertext ID with the second ciphertext ID carried in the encrypted string;

[0148] If the first ciphertext ID and the second ciphertext ID are the same, and the decryption result and the verification information string are the same, then the authentication result of the user's identity authentication is obtained.

[0149] Specifically, after the server receives the decryption result sent by the client, it first obtains the first ciphertext ID carried in the decryption result returned by the client. Then, the server compares the first ciphertext ID with the second ciphertext ID carried in the encrypted string. If the first ciphertext ID and the second ciphertext ID are the same, it means that the decryption result returned by the client and the verification information string were generated in the same session. Then, the server compares the decryption result and the verification information string. If the decryption result and the verification information string are the same, the server obtains the authentication result that the user's identity has been successfully authenticated.

[0150] In this embodiment, firstly, the server receives the access request sent by the client and sends an encrypted string to the client. Then, the server receives the decryption result sent by the client. Finally, the server authenticates the user based on the decryption result. Because the server may send different ciphertexts multiple times, in order to distinguish which ciphertext the decrypted result corresponds to, the server obtains the first ciphertext ID carried in the decryption result returned by the client and compares the first ciphertext ID with the second ciphertext ID carried in the encrypted string. If the first ciphertext ID and the second ciphertext ID are the same, the server then compares the decryption result with the verification information string. If the decryption result and the verification information string are the same, the authentication result of the user's identity is obtained, which improves the reliability and security of the authentication method.

[0151] In one embodiment, such as Figure 9 As shown, before the server receives the access request sent by the client, it also includes the following steps:

[0152] Step 901: Obtain the account registration request sent by the client.

[0153] In one possible embodiment, the server obtains the account registration request sent by the client before obtaining the access request sent by the client, wherein the account registration request carries the user's public key and username.

[0154] Step 902: In response to the account registration request, register an account for the user and return the account registration result to the client.

[0155] In one possible embodiment, after receiving an account registration request sent by the client, the server responds to the account registration request, registers an account for the user, and returns the account registration result to the client.

[0156] In this embodiment, the server receives the account registration request sent by the client, responds to the account registration request, registers an account for the user, and returns the account registration result to the client. The account registration request only carries the user's public key and username, while the user's private key is always stored on the SIM card, ensuring that the user's private key will not be leaked and improving the security of the identity authentication method.

[0157] In one embodiment, such as Figure 10 As shown, an identity authentication method is provided for a SIM card, including the following steps:

[0158] Step 1001: Obtain the encrypted string sent by the client.

[0159] In one possible embodiment, such as Figure 11 As shown, Figure 11 An exemplary diagram illustrates another interaction process between the client and the SIM card, whereby the SIM card receives an encrypted string sent by the client. This encrypted string is sent by the server to the client in response to the client's access request, and is obtained by the server encrypting a verification information string based on the public key in the key pair generated by the SIM card for the user.

[0160] Step 1002: Decrypt the encrypted string based on the user's private key to obtain the decryption result.

[0161] After the SIM card receives the encrypted string sent by the client, it decrypts the encrypted string based on the user's private key to obtain the decryption result.

[0162] In one possible embodiment, the encrypted string is decrypted based on the user's private key to obtain the decryption result, including the following steps:

[0163] Determine the key pair name corresponding to the user;

[0164] The encrypted string is decrypted using the private key corresponding to the key pair name, and the decryption result is obtained.

[0165] Specifically, such as Figure 11 As shown, after the SIM card obtains the encrypted string sent by the client, it first determines the key pair name corresponding to the user, and then decrypts the encrypted string according to the private key corresponding to the key pair name to obtain the decryption result.

[0166] Step 1003: Send the decryption result to the client so that the client can authenticate the user's identity through the server based on the decryption result.

[0167] In one possible embodiment, such as Figure 11As shown, the SIM card decrypts the encrypted string based on the user's private key. After obtaining the decryption result, the SIM card sends the decryption result to the client, so that the client can authenticate the user's identity through the server based on the decryption result.

[0168] In this embodiment, firstly, the SIM card obtains the encrypted string sent by the client. Then, the SIM card decrypts the encrypted string based on the user's corresponding private key to obtain the decryption result. Finally, the SIM card sends the decryption result to the client so that the client can authenticate the user's identity through the server based on the decryption result. During the decryption process, the private key is always stored in the SIM card, and the decryption process is performed by the SIM card, so the user's personal information will not be leaked, thus ensuring the security of identity authentication.

[0169] In one embodiment, such as Figure 12 As shown, the SIM card determines the key pair name corresponding to the user, including the following steps:

[0170] Step 1201: Obtain the request from the client to retrieve the list of key pair names.

[0171] In one possible embodiment, such as Figure 13 As shown, Figure 13 An exemplary diagram illustrates another interaction process between the client and the SIM card, in which the SIM card receives a request from the client to obtain a list of key pair names, wherein the list of key pair names contains the names of key pairs corresponding to each registered user.

[0172] Step 1202: Return a list of key pair names to the client.

[0173] In one possible embodiment, such as Figure 13 As shown, after the SIM card receives the request from the client to obtain the list of key pair names, the SIM card returns the list of key pair names to the client.

[0174] Step 1203: Obtain the key pair name selected by the client based on the key pair name list, and get the key pair name corresponding to the user.

[0175] In one possible embodiment, such as Figure 13 As shown, after the SIM card returns a list of key pair names to the client, the SIM card obtains the key pair name selected by the client based on the list of key pair names, and obtains the key pair name corresponding to the user.

[0176] In this embodiment, firstly, the SIM card receives a request from the client to obtain a list of key pair names. Then, the SIM card returns the list of key pair names to the client. Finally, the SIM card obtains the key pair name selected by the client based on the list of key pair names, thus obtaining the key pair name corresponding to the user. After the SIM card returns the list of key pair names to the client, the user can intuitively see the list of key pair names, which contains the names of key pairs corresponding to each registered user. The user selects the corresponding key pair name according to the server to be accessed. Moreover, when a user registers, different platforms can also use the same key pair for registration. When accessing different platforms, selecting the same key pair name is sufficient for identity authentication, improving the user experience and the flexibility of the identity authentication method.

[0177] In one embodiment, the SIM card decrypts the encrypted string based on the user's private key to obtain the decryption result, and may further include the following steps:

[0178] The encrypted string is decrypted using each private key to obtain the decryption result.

[0179] In one possible implementation, the SIM card decrypts the encrypted string using each private key. That is, the SIM card iterates through all stored private keys to decrypt the encrypted string, obtains all decryption results, and returns all decryption results to the client. The client then sends all decryption results to the server. During the server's comparison process, as long as one decryption result is the same as the verification information string, the server obtains the authentication result that the user's identity has been successfully authenticated.

[0180] In this embodiment, the SIM card decrypts the encrypted string using each private key to obtain the decryption result. Compared to the user manually selecting a private key to decrypt the encrypted string, the authentication method provided in this embodiment improves the efficiency of authentication and enhances the flexibility of the authentication method.

[0181] In one embodiment, such as Figure 14 As shown, before the SIM card receives the encrypted string sent by the client, it includes the following steps:

[0182] Step 1401: Obtain the key generation request sent by the client.

[0183] In one possible embodiment, such as Figure 15 As shown, Figure 15An exemplary diagram illustrates another interaction process between the client and the SIM card. The SIM card receives a key generation request sent by the client. The key generation request carries the name and / or key tag information of the requested key pair. The name and key tag information of the key pair are user-defined. The name of the key pair can be "XX website key", and the key tag information can be "generated on April 10, 2024". It should be noted that the specific content of the name and key tag information of the key pair is not limited here.

[0184] Step 1402: In response to the key generation request, generate the user's key pair.

[0185] In one possible embodiment, such as Figure 15 As shown, after the SIM card receives the key generation request sent by the client, the SIM card responds to the key generation request and generates the user's key pair.

[0186] Step 1403: Store the private key in the key pair and return the public key in the key pair to the client.

[0187] In one possible embodiment, such as Figure 15 As shown, in response to a key generation request, the SIM card generates a key pair for the user, stores the private key in the key pair, and returns the public key in the key pair to the client.

[0188] In this embodiment, firstly, the SIM card receives a key generation request sent by the client. Then, in response to the key generation request, the SIM card generates a key pair for the user. Finally, the SIM card stores the private key in the key pair and returns the public key in the key pair to the client. Throughout the process, the private key is always stored on the SIM card, thereby avoiding the risk of private key leakage and ensuring the security and reliability of the authentication method.

[0189] By dividing each functional module according to its corresponding function, this disclosure provides an identity authentication device, which can be a server or a chip applied to a server. Figure 16 This is a schematic block diagram illustrating the functional modules of an identity authentication device provided as an exemplary embodiment of this disclosure. Figure 16 As shown, the identity authentication device includes:

[0190] The first sending module 1601 is used to send an access request to the server after the user of the client has successfully registered; wherein the access request carries the username of the user;

[0191] The first acquisition module 1602 is used to acquire the encrypted string returned by the server and send the encrypted string to the SIM card; wherein, the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated by the SIM card for the user, and the SIM card stores the key pair generated for the successfully registered user;

[0192] The second sending module 1603 is used to obtain the decryption result of the SIM card decrypting the encrypted string based on the private key corresponding to the user, and send the decryption result to the server so that the server can authenticate the user's identity based on the decryption result.

[0193] In one embodiment, the first acquisition module 1602 includes:

[0194] The first determining unit is used to determine the key pair name corresponding to the user;

[0195] The first sending unit is used to send the key pair name and the encrypted string to the SIM card; wherein the SIM card determines a private key for decrypting the encrypted string based on the key pair name.

[0196] In one embodiment, the first acquisition module 1602 further includes:

[0197] The second sending unit is used to send a request to the SIM card to obtain a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user;

[0198] The first acquisition unit is used to acquire and display the list of key pair names;

[0199] The second determining unit is configured to, in response to a selection operation on the list of key pair names, determine the key pair name corresponding to the selection operation as the key pair name corresponding to the user.

[0200] In one embodiment, the apparatus further includes:

[0201] The second sending module is used to send a key generation request to the SIM card; wherein the key generation request carries the name and / or key tag information of the key pair to be requested;

[0202] The second acquisition module is used to acquire the public key in the key pair generated by the SIM card based on the key generation request;

[0203] The third sending module is used to send an account registration application to the server; wherein the account registration application carries the user's public key and username;

[0204] The third acquisition module is used to acquire the account registration result obtained by the server based on the account registration application.

[0205] In the case of dividing each functional module according to its corresponding function, this disclosure also provides an identity authentication device, which can be a server or a chip applied to a server. Figure 17 This is a schematic block diagram illustrating the functional modules of an identity authentication device provided as an exemplary embodiment of this disclosure. Figure 17 As shown, the identity authentication device includes:

[0206] The fourth acquisition module 1701 is used to acquire access requests sent by the client;

[0207] The fourth sending module 1702 is used to send an encrypted string to the client; wherein the encrypted string is obtained by encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card, and the SIM card stores the key pair generated for the successfully registered user;

[0208] The fifth acquisition module 1703 is used to acquire the decryption result sent by the client; wherein the decryption result is obtained by the SIM card decrypting the encrypted string based on the private key corresponding to the key pair name;

[0209] The authentication module 1704 performs identity authentication on the user based on the decryption result to obtain the identity authentication result.

[0210] In one embodiment, the fourth transmitting module 1702 includes:

[0211] The generation unit is used to generate a verification information string after the access request is received;

[0212] The third sending unit is used to encrypt the verification information string based on the public key corresponding to the user, generate the encrypted string, and send the encrypted string to the client.

[0213] In one embodiment, the fourth transmitting module 1702 further includes:

[0214] The second acquisition unit is used to acquire the first ciphertext ID carried in the decryption result returned by the client;

[0215] The comparison unit is used to compare the first ciphertext ID with the second ciphertext ID carried in the encrypted string;

[0216] The authentication unit determines that if the first ciphertext ID and the second ciphertext ID are the same, and the decryption result is the same as the verification information string, then the user's identity is authenticated.

[0217] In one embodiment, the apparatus further includes:

[0218] The sixth acquisition module is used to acquire the account registration application sent by the client; wherein the account registration application carries the user's public key and username;

[0219] The first return module is used to respond to the account registration application, register an account for the user, and return the account registration result to the client.

[0220] In the case of dividing each functional module according to its corresponding function, this disclosure also provides an identity authentication device, which can be a server or a chip applied to a server. Figure 18 This is a schematic block diagram illustrating the functional modules of an identity authentication device provided as an exemplary embodiment of this disclosure. Figure 18 As shown, the identity authentication device includes:

[0221] The seventh acquisition module 1801 is used to acquire an encrypted string sent by the client; wherein the encrypted string is sent by the server to the client in response to the client's access request, and the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card;

[0222] The decryption module 1802 is used to decrypt the encrypted string based on the private key corresponding to the user, and obtain the decryption result;

[0223] The fifth sending module 1803 is used to send the decryption result to the client so that the client can authenticate the user's identity through the server based on the decryption result.

[0224] In one embodiment, the apparatus further includes:

[0225] The eighth acquisition module is used to acquire the key generation request sent by the client; wherein the key generation request carries the name and / or key tag information of the key pair to be requested;

[0226] The generation module is configured to generate the user's key pair in response to the key generation request;

[0227] The second return module is used to store the private key in the key pair and return the public key in the key pair to the client.

[0228] In one embodiment, the decryption module 1802 includes:

[0229] The third determining unit is used to determine the key pair name corresponding to the user;

[0230] The first decryption unit is used to decrypt the encrypted string according to the private key corresponding to the key pair name to obtain the decryption result.

[0231] In one embodiment, the decryption module 1802 further includes:

[0232] The third acquisition unit is used to acquire the key pair name list acquisition request sent by the client; wherein the key pair name list contains the name of the key pair corresponding to each registered user;

[0233] The return unit is used to return the list of key pair names to the client;

[0234] The fourth acquisition unit is used to acquire the key pair name selected by the client based on the key pair name list, and obtain the key pair name corresponding to the user.

[0235] In one embodiment, the decryption module 1802 further includes:

[0236] The second decryption unit is used to decrypt the encrypted string using each private key to obtain the decryption result.

[0237] This disclosure also provides an electronic device, including: at least one processor; a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the methods disclosed in this disclosure.

[0238] Figure 19 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 19 As shown, the electronic device 1900 includes at least one processor 1901 and a memory 1902 coupled to the processor 1901. The processor 1901 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0239] The processor 1901 described above can also be referred to as a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 1901 or by software instructions. The processor 1901 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 1902, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 1901 reads information from the memory 1902 and, in conjunction with its hardware, completes the steps of the method described above.

[0240] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 20 The computer system 2000 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including those described above. Figure 20 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0241] Computer System 2000 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0242] like Figure 20As shown, the computer system 2000 includes a computing unit 2001, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 2002 or a computer program loaded from a storage unit 2008 into a random access memory (RAM) 2003. The RAM 2003 may also store various programs and data required for the operation of the computer system 2000. The computing unit 2001, ROM 2002, and RAM 2003 are interconnected via a bus 2004. An input / output (I / O) interface 2005 is also connected to the bus 2004.

[0243] Multiple components in the computer system 2000 are connected to the I / O interface 2005, including: an input unit 2006, an output unit 2007, a storage unit 2008, and a communication unit 2009. The input unit 2006 can be any type of device capable of inputting information into the computer system 2000. The input unit 2006 can receive input numerical or character information and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 2007 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. The storage unit 2008 may include, but is not limited to, a hard disk and an optical disk. The communication unit 2009 allows the computer system 2000 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, a modem, network card, infrared communication device, wireless communication transceiver, and / or chipset, such as Bluetooth™ device, WiFi device, WiMax device, cellular communication device, and / or the like.

[0244] The computing unit 2001 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 2001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 2001 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 2008. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1900 via ROM 2002 and / or communication unit 2009. In some embodiments, the computing unit 2001 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0245] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0246] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0247] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0248] This disclosure also provides a computer program product, including a computer program, wherein the computer program, when executed by a processor, implements the methods disclosed in the embodiments of this disclosure.

[0249] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0250] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0251] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0252] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0253] The above description is merely an embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0254] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. An identity authentication method, characterized in that, Applied to a client, the method includes: After a user on the client side successfully registers, an access request is sent to the server; wherein the access request carries the user's username; The server retrieves the encrypted string returned by the server and sends the encrypted string to the SIM card; wherein the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated by the SIM card for the user, and the SIM card stores the key pair generated for the successfully registered user; The system obtains the decryption result of the SIM card decrypting the encrypted string based on the user's private key, and sends the decryption result to the server so that the server can authenticate the user's identity based on the decryption result; Sending the encrypted string to the SIM card includes: Send a request to the SIM card to obtain a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user; Obtain and display the list of key pair names; In response to a selection operation on the list of key pair names, the key pair name corresponding to the selection operation is determined as the key pair name corresponding to the user; The key pair name and the encrypted string are sent to the SIM card; wherein the SIM card determines a private key for decrypting the encrypted string based on the key pair name.

2. The method according to claim 1, characterized in that, Before sending an access request to the server, the method further includes: Send a key generation request to the SIM card; wherein the key generation request carries the name and / or key tag information of the key pair to be requested; Obtain the public key from the key pair generated by the SIM card based on the key generation request; Send an account registration request to the server; wherein the account registration request carries the user's public key and username; Obtain the account registration result from the server based on the account registration application.

3. An identity authentication method, characterized in that, Applied to a server, the method includes: Get the access request sent by the client; The client sends an encrypted string to the client; wherein the encrypted string is obtained by encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card, and the SIM card stores the key pair generated for successfully registered users; wherein the client sending the encrypted string to the SIM card includes: the client sending a request to the SIM card to obtain a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user; the client obtaining and displaying the list of key pair names; the client responding to a selection operation on the list of key pair names, determining the key pair name corresponding to the selection operation as the key pair name corresponding to the user; the client sending the key pair name and the encrypted string to the SIM card; wherein the SIM card determines the private key used to decrypt the encrypted string based on the key pair name; Obtain the decryption result sent by the client; wherein the decryption result is obtained by the SIM card decrypting the encrypted string based on the private key corresponding to the key pair name; The user is authenticated based on the decryption result to obtain the authentication result.

4. The method according to claim 3, characterized in that, Sending the encrypted string to the client includes: After receiving the access request, a verification information string is generated; The verification information string is encrypted using the user's public key to generate the encrypted string, and then the encrypted string is sent to the client.

5. The method according to claim 4, characterized in that, The step of authenticating the user's identity based on the decryption result to obtain the authentication result includes: Obtain the first ciphertext ID carried in the decryption result returned by the client; Compare the first ciphertext ID with the second ciphertext ID carried in the encrypted string; If the first ciphertext ID and the second ciphertext ID are found to be the same, and the decryption result is the same as the verification information string, an authentication result is obtained that the user's identity has been authenticated.

6. The method according to claim 3, characterized in that, Before obtaining the access request sent by the client, the method further includes: Obtain the account registration request sent by the client; wherein the account registration request carries the user's public key and username; In response to the account registration request, an account is registered for the user, and the account registration result is returned to the client.

7. An identity authentication method, characterized in that, Applied to a SIM card, the method includes: The system retrieves an encrypted string sent by the client; wherein the encrypted string is sent by the server to the client in response to the client's access request, and the encrypted string is obtained by encrypting the verification information string based on the public key in the key pair generated by the server for the user on the SIM card; wherein the client sends the encrypted string to the SIM card, including: the client sending a request to the SIM card to retrieve a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user; the client retrieving and displaying the list of key pair names; the client, in response to a selection operation on the list of key pair names, determining the key pair name corresponding to the selection operation as the key pair name corresponding to the user; the client sending the key pair name and the encrypted string to the SIM card; wherein the SIM card determines the private key used to decrypt the encrypted string based on the key pair name; The encrypted string is decrypted based on the user's private key to obtain the decryption result; The decryption result is sent to the client so that the client can authenticate the user's identity through the server based on the decryption result.

8. The method according to claim 7, characterized in that, Before obtaining the encrypted string sent by the client, the method further includes: Obtain the key generation request sent by the client; wherein the key generation request carries the name and / or key tag information of the key pair to be requested; In response to the key generation request, a key pair for the user is generated; Store the private key in the key pair and return the public key in the key pair to the client.

9. The method according to claim 7, characterized in that, The process of decrypting the encrypted string based on the user's private key to obtain the decryption result includes: Determine the key pair name corresponding to the user; The encrypted string is decrypted using the private key corresponding to the key pair name to obtain the decryption result.

10. The method according to claim 9, characterized in that, Determining the key pair name corresponding to the user includes: Obtain the request to obtain the list of key pair names sent by the client; wherein the list of key pair names contains the names of the key pairs corresponding to each registered user; Return the list of key pair names to the client; Obtain the key pair name selected by the client based on the key pair name list, and obtain the key pair name corresponding to the user.

11. The method according to claim 7, characterized in that, The process of decrypting the encrypted string based on the user's private key to obtain the decryption result includes: The encrypted string is decrypted using each private key to obtain the decryption result.

12. An identity authentication device, characterized in that, The device, configured on the client side, includes: The first sending module is used to send an access request to the server after the user of the client has successfully registered; wherein the access request carries the user's username; The first acquisition module is used to acquire the encrypted string returned by the server and send the encrypted string to the SIM card; wherein, the encrypted string is obtained by the server encrypting the verification information string based on the public key in the key pair generated by the SIM card for the user, and the SIM card stores the key pair generated for the successfully registered user; The second sending module is used to obtain the decryption result of the SIM card decrypting the encrypted string based on the private key corresponding to the user, and send the decryption result to the server so that the server can authenticate the user's identity based on the decryption result; The first acquisition module is further configured to: Send a request to the SIM card to obtain a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user; Obtain and display the list of key pair names; In response to a selection operation on the list of key pair names, the key pair name corresponding to the selection operation is determined as the key pair name corresponding to the user; The key pair name and the encrypted string are sent to the SIM card; wherein the SIM card determines a private key for decrypting the encrypted string based on the key pair name.

13. An identity authentication device, characterized in that, The device, located on a server, includes: The fourth acquisition module is used to acquire access requests sent by the client; The fourth sending module is used to send an encrypted string to the client; wherein the encrypted string is obtained by encrypting the verification information string based on the public key in the key pair generated for the user by the SIM card, and the SIM card stores the key pair generated for successfully registered users; wherein the client sending the encrypted string to the SIM card includes: the client sending a request to the SIM card to obtain a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user; the client obtaining and displaying the list of key pair names; the client responding to a selection operation on the list of key pair names, determining the key pair name corresponding to the selection operation as the key pair name corresponding to the user; the client sending the key pair name and the encrypted string to the SIM card; wherein the SIM card determines the private key used to decrypt the encrypted string based on the key pair name; The fifth acquisition module is used to acquire the decryption result sent by the client; wherein the decryption result is obtained by the SIM card decrypting the encrypted string based on the private key corresponding to the key pair name; The authentication module performs identity authentication on the user based on the decryption result, and obtains the identity authentication result.

14. An identity authentication device, characterized in that, Located on a SIM card, the device includes: The seventh acquisition module is used to acquire an encrypted string sent by the client; wherein the encrypted string is sent by the server to the client in response to the client's access request, and the encrypted string is obtained by encrypting the verification information string based on the public key in the key pair generated by the server for the user on the SIM card; wherein the client sending the encrypted string to the SIM card includes: the client sending a request to the SIM card to acquire a list of key pair names; wherein the list of key pair names contains the names of key pairs corresponding to each registered user; the client acquiring and displaying the list of key pair names; the client, in response to a selection operation on the list of key pair names, determining the key pair name corresponding to the selection operation as the key pair name corresponding to the user; the client sending the key pair name and the encrypted string to the SIM card; wherein the SIM card determines the private key used to decrypt the encrypted string based on the key pair name; The decryption module is used to decrypt the encrypted string based on the user's private key to obtain the decryption result; The fifth sending module is used to send the decryption result to the client so that the client can authenticate the user's identity through the server based on the decryption result.

15. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1-2, and / or to implement the method as described in any one of claims 3-6, and / or to implement the method as described in any one of claims 7-11.

16. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method as described in any one of claims 1-2, and / or to perform the method as described in any one of claims 3-6, and / or to perform the method as described in any one of claims 7-11.

17. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the method as described in any one of claims 1-2, and / or the method as described in any one of claims 3-6, and / or the method as described in any one of claims 7-11.

Images