Identity authentication method, terminal equipment, identity authentication system and storage medium

Abstract

The invention provides an identity authentication method, terminal equipment, an identity authentication system and a storage medium, and relates to the technical field of information security. Comprising the following steps: obtaining key information of a post-quantum cryptographic algorithm and key information of an asymmetric cryptographic algorithm based on an intelligent cryptographic key; applying for a first user signature certificate corresponding to the post quantum cryptographic algorithm from a certificate issuing server according to the public key of the post quantum cryptographic algorithm; a second user signature certificate corresponding to the asymmetric cryptographic algorithm is applied to the certificate issuing server according to the public key of the asymmetric cryptographic algorithm; the key information of the post quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate and the second user signature certificate are used as authentication information to be written into a secure storage area of the intelligent password key; and performing identity authentication according to the authentication information stored in the secure storage area of the intelligent password key. According to the method, the quantum cryptographic algorithm is fused on the basis of the asymmetric cryptographic algorithm, so that the attack of quantum computing is effectively resisted.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically, to an identity authentication method, terminal equipment, identity authentication system and storage medium. Background Art

[0002] Identity authentication is an important part of ensuring the security of information systems. Smart password keys are widely used in user management of information systems due to their convenience and security.

[0003] With the improvement of computer capabilities and the progress of mathematics, asymmetric cryptographic algorithms such as traditional ECC (Elliptic Curves Cryptography) and SM2 (Elliptic Curve Algorithm) used by smart password keys face huge security risks in the post-quantum era and cannot effectively resist quantum computing attacks.

[0004] Therefore, how to balance the requirements of the existing cryptographic system and provide security capabilities in the post-quantum era has become an urgent problem to be solved in the identity authentication system. Summary of the invention

[0005] The purpose of this application is to provide an identity authentication method, terminal device, identity authentication system and storage medium to address the deficiencies in the above-mentioned prior art, so as to improve the security and accuracy of identity authentication.

[0006] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows: In a first aspect, an embodiment of the present application provides an identity authentication method, including: Log in to the smart password key according to the login password input by the user, obtain key information of the post-quantum cryptographic algorithm based on the smart password key, and obtain key information of the asymmetric cryptographic algorithm based on the smart password key; the key information includes: a public key and a private key; Applying for a first user signature certificate corresponding to the post-quantum cryptographic algorithm from a certificate issuing server according to the public key of the post-quantum cryptographic algorithm; and applying for a second user signature certificate corresponding to the asymmetric cryptographic algorithm from the certificate issuing server according to the public key of the asymmetric cryptographic algorithm; Writing the key information of the post-quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate, and the second user signature certificate as authentication information into the secure storage area of ​​the smart password key; Identity authentication is performed according to the authentication information stored in the secure storage area of ​​the smart password key.

[0007] Optionally, obtaining key information of a post-quantum cryptographic algorithm based on the smart cryptographic key includes: If the smart cryptographic key supports the post-quantum cryptographic algorithm, calling the post-quantum cryptographic algorithm program running in the smart cryptographic key to generate key information of the post-quantum cryptographic algorithm; If the smart password key does not support the post-quantum cryptographic algorithm, key information of the post-quantum cryptographic algorithm is generated, and the generated key information of the post-quantum cryptographic algorithm is encrypted according to the login password to obtain the processed key information of the post-quantum cryptographic algorithm.

[0008] Optionally, encrypting the generated key information of the post-quantum cryptographic algorithm according to the login password to obtain the processed key information of the post-quantum cryptographic algorithm includes: According to the login password, generating a derived key of the login password; Using the derived key to encrypt the private key in the key information of the post-quantum cryptographic algorithm to obtain the private key ciphertext of the post-quantum cryptographic algorithm; The processed key information of the post-quantum cryptographic algorithm is obtained according to the private key ciphertext of the post-quantum cryptographic algorithm and the public key in the key information of the post-quantum cryptographic algorithm.

[0009] Optionally, obtaining key information of an asymmetric cryptographic algorithm based on the smart cryptographic key includes: The asymmetric cryptographic algorithm program running in the smart cryptographic key is called to generate key information of the asymmetric cryptographic algorithm.

[0010] Optionally, applying to a certificate issuing server for a first user signature certificate corresponding to the post-quantum cryptographic algorithm according to the public key of the post-quantum cryptographic algorithm; and applying to the certificate issuing server for a second user signature certificate corresponding to the asymmetric cryptographic algorithm according to the public key of the asymmetric cryptographic algorithm, comprises: Initiate a certificate application to the certificate issuing server according to the public key of the post-quantum cryptographic algorithm, and receive a first user signature certificate corresponding to the post-quantum cryptographic algorithm returned by the certificate issuing server; A certificate application is initiated to the certificate issuing server according to the public key of the asymmetric cryptographic algorithm, and a second user signature certificate corresponding to the asymmetric cryptographic algorithm returned by the certificate issuing server is received.

[0011] Optionally, performing identity authentication according to the authentication information stored in the secure storage area of ​​the smart password key includes: Calling the smart password key, generating and receiving signature information of the authentication data returned by the smart password key and a user signature certificate; the signature information is generated by the smart password key according to the key information stored in the secure storage area of ​​the smart password key; Initiate an authentication request to the issuing server according to the signature information, the user signature certificate and the authentication data; receive the authentication result returned by the certificate issuing server, and determine the identity authentication result of the user according to the authentication result.

[0012] Optionally, before calling the smart password key and generating and receiving signature information of the authentication data returned by the smart password key, the process includes: Initiate a login request to the certificate issuing server, and obtain a first message field returned by the certificate issuing server; the first message field includes a first random number; Calling the smart password key to generate a second message field; the second message field includes: a second random number; The authentication data is generated according to the first message field, the second message field and a user message field.

[0013] Optionally, calling the smart password key to generate and receive signature information of the authentication data returned by the smart password key includes: The smart cryptographic key is called to generate first signature information of the authentication data according to the key information of the post-quantum cryptographic algorithm; and second signature information of the authentication data is generated according to the key information of the asymmetric cryptographic algorithm; the signature information of the authentication data includes the first signature information and the second signature information.

[0014] Optionally, calling the smart cryptographic key to generate first signature information of the authentication data according to key information of the post-quantum cryptographic algorithm includes: If the smart cryptographic key supports the post-quantum cryptographic algorithm, the post-quantum cryptographic algorithm program running in the smart cryptographic key is called, and the smart cryptographic key performs signature calculation on the authentication data according to the private key of the post-quantum cryptographic algorithm stored in the secure storage area to generate first signature information of the authentication data.

[0015] Optionally, calling the smart cryptographic key to generate first signature information of the authentication data according to key information of the post-quantum cryptographic algorithm includes: If the smart cryptographic key does not support the post-quantum cryptographic algorithm, reading the private key ciphertext of the post-quantum cryptographic algorithm; Decrypting the private key ciphertext of the post-quantum cryptographic algorithm according to the derived key of the login password; The authentication data is signature-calculated according to the private key of the post-quantum cryptographic algorithm obtained after decryption to generate first signature information of the authentication data.

[0016] Optionally, the generating the second signature information of the authentication data according to the key information of the asymmetric cryptographic algorithm includes: The asymmetric cryptographic algorithm program running in the smart cryptographic key is called, and the smart cryptographic key performs signature calculation on the authentication data according to the private key of the asymmetric cryptographic algorithm stored in the secure storage area to generate second signature information of the authentication data.

[0017] Optionally, initiating an authentication request to the issuing server according to the signature information, the user signing certificate and the authentication data; receiving an authentication result returned by the certificate issuing server, and determining an identity authentication result of the user according to the authentication result, includes: Initiate an authentication request to the certificate issuing server according to the first signature information, the second signature information, the first user signature certificate, the second user signature certificate and the authentication data; Receive the authentication result returned by the certificate issuing server, and determine the identity authentication result of the user according to the authentication result.

[0018] Optionally, the receiving an authentication result returned by the certificate issuing server and determining the identity authentication result of the user according to the authentication result includes: Receiving a first authentication result corresponding to the post-quantum cryptographic algorithm and a second authentication result corresponding to the asymmetric cryptographic algorithm returned by the certificate issuing server; If both the first authentication result and the second authentication result are authenticated, the identity authentication result of the user is determined to be authenticated.

[0019] In the second aspect, an embodiment of the present application also provides a terminal device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the terminal device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to implement the identity authentication method provided in the first aspect above.

[0020] In a third aspect, an embodiment of the present application further provides an identity authentication system, comprising: the terminal device, the smart password key, and the certificate issuing server described in the second aspect above; The terminal device is used for identity authentication using the identity authentication method described in the first aspect above; The smart password key is used to interact with the terminal device to obtain key information of the cryptographic algorithm, store and provide authentication information containing the key information, and perform signature calculation based on the key information; The certificate issuing server is used to interact with the terminal device to perform identity authentication.

[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the identity authentication method provided in the first aspect is executed.

[0022] The beneficial effects of this application are: The present application provides an identity authentication method, terminal device, identity authentication system and storage medium, including: logging in to a smart password key according to a login password input by a user, obtaining key information of a post-quantum cryptographic algorithm based on the smart password key, and obtaining key information of an asymmetric cryptographic algorithm based on the smart password key; applying for a first user signature certificate corresponding to the post-quantum cryptographic algorithm from a certificate issuing server according to the public key of the post-quantum cryptographic algorithm; and applying for a second user signature certificate corresponding to the asymmetric cryptographic algorithm from a certificate issuing server according to the public key of the asymmetric cryptographic algorithm; writing the key information of the post-quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate and the second user signature certificate as authentication information into a secure storage area of ​​the smart password key; and performing identity authentication according to the authentication information stored in the secure storage area of ​​the smart password key. The present method combines the post-quantum cryptographic algorithm with the asymmetric cryptographic algorithm, and integrates the identity authentication means of the post-quantum cryptographic algorithm on the basis of the traditional smart password key using the asymmetric cryptographic algorithm for identity authentication. Through the dual algorithm authentication method, the security and accuracy of the identity authentication are improved, which not only meets the requirements of the existing security system, but also provides security capabilities in the post-quantum era, and effectively resists the attack of quantum computing.

[0023] In addition, this solution provides different processing flows for whether the smart password key supports the post-quantum cryptographic algorithm, so that the key information generation and signature calculation of the post-quantum cryptographic algorithm can be realized in both cases where the smart password key supports the post-quantum cryptographic algorithm and does not support the post-quantum cryptographic algorithm. It can better adapt to the situation where most current smart password keys do not support the post-quantum cryptographic algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A schematic diagram of the architecture of an identity authentication system provided in an embodiment of the present application; Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application; Figure 3 A flowchart of another identity authentication method provided in an embodiment of the present application; Figure 4 A flowchart of another identity authentication method provided in an embodiment of the present application; Figure 5 A flowchart of another identity authentication method provided in an embodiment of the present application; Figure 6 A flowchart of another identity authentication method provided in an embodiment of the present application; Figure 7 A flowchart of another identity authentication method provided in an embodiment of the present application; Figure 8 A flowchart of another identity authentication method provided in an embodiment of the present application; Fig. 9 A flowchart of another identity authentication method provided in an embodiment of the present application; Fig.10 A signaling interaction diagram provided for an embodiment of the present application; Fig.11 Another signaling interaction diagram provided for an embodiment of the present application; Fig.12 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0027] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0028] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0029] With the continuous development of information technology, it is particularly important to protect the security, confidentiality and integrity of information. As an important means to ensure information security, cryptographic algorithms are constantly developing and improving.

[0030] Cryptographic algorithms are widely used in many fields, mainly including the following aspects: Data Encryption: Symmetric cryptographic algorithms (such as AES (Advanced Encryption Standard), SM4 (National Secret Block Cipher Algorithm), etc.) are widely used for data encryption to protect the confidentiality of data. These algorithms use the same key for encryption and decryption, are fast and efficient, and are suitable for encryption of large amounts of data.

[0031] Asymmetric cryptographic algorithms (such as RSA (public key cryptography algorithm), ECC (Elliptic Curve Cryptography, a public key encryption algorithm based on elliptic curve mathematics), etc.) are used in scenarios such as key exchange and digital signatures to provide higher security.

[0032] Network communication security: In network communications, cryptographic algorithms are used to protect the confidentiality and integrity of the communication content. For example, in the SSL (Secure Sockets Layer) / TLS (Transport Layer Security) protocol, an asymmetric cryptographic algorithm is used for key exchange, and then a symmetric cryptographic algorithm is used to encrypt the communication content.

[0033] Virtual Private Networks (VPN) also widely use symmetric encryption algorithms to encrypt network communications to ensure the confidentiality and integrity of data transmission.

[0034] Digital Signature: Asymmetric cryptographic algorithms are used to generate digital signatures to verify the integrity and authenticity of data. The sender signs the data using a private key, and the receiver verifies it using a public key.

[0035] Authentication and access control: Cryptographic algorithms are also used for identity authentication and access control. For example, in remote access control, cryptographic algorithms are used to verify the identity of remote users and encrypt data for remote access.

[0036] IoT Security: With the development of the Internet of Things, cryptographic algorithms play an important role in the security of IoT devices. Lightweight cryptographic algorithms are particularly suitable for IoT devices and wireless sensor networks due to their simple design, high computational efficiency, and low resource consumption.

[0037] Cloud computing and big data security: In the field of cloud computing and big data, cryptographic algorithms are used to protect the confidentiality and integrity of data. By encrypting the storage and transmission of data, data leakage and tampering can be prevented.

[0038] With the rapid development of quantum computing technology, traditional encryption algorithms such as RSA and elliptic curve cryptography have become vulnerable to quantum computers. Therefore, it is particularly important to develop encryption algorithms that can maintain security in the era of quantum computing.

[0039] Post-Quantum Cryptography (PQC) is a type of encryption algorithm designed to resist quantum computer attacks and can meet the security requirements of the post-quantum era. However, post-quantum cryptography also has problems such as lack of effective security proof and inability to meet the requirements of existing security evaluation standards. Therefore, how to take into account the requirements of the existing cryptographic system while providing security capabilities in the post-quantum era is an urgent problem to be solved.

[0040] Based on this, the identity authentication method provided by this solution, by mixing the PQC cryptographic algorithm on the basis of the traditional authentication of the smart password key, uses the traditional asymmetric cryptographic algorithm and the PQC cryptographic algorithm for dual authentication, which can meet the requirements of the existing security system and resist the attacks of quantum computing, providing security capabilities in the post-quantum era and ensuring the security and accuracy of identity authentication.

[0041] Figure 1 This is a schematic diagram of the architecture of an identity authentication system provided in an embodiment of the present application. Figure 1 As shown, the identity authentication system may include a client and a certificate issuing server, and the client may run a post-quantum cryptographic algorithm terminal service, namely a PQC terminal service. As an important hardware security device deployed on the client, the smart password key can be connected to the client computer through a USB interface, so that the user can conveniently use the password service provided by the smart password key on the computer.

[0042] Users can log in to the smart password key through the PQC terminal service and generate key information of the cryptographic algorithm based on the smart password key. The smart password key can store the key information and signature certificate of the cryptographic algorithm. The smart key can also perform signature calculation on the user's authentication data based on the stored key information of the cryptographic algorithm. The user can initiate an authentication request to the certificate issuing server based on the signature information of the authentication data, the signature certificate, etc., to obtain the authentication result.

[0043] Among them, based on the intelligent password key, it can realize the creation of key information for traditional asymmetric cryptographic algorithms, and it can also realize the creation of key information for PQC cryptographic algorithms. In the process of signature calculation, it supports signature calculation using traditional asymmetric cryptographic algorithms, and supports signature calculation using PQC cryptographic algorithms, thereby combining traditional asymmetric cryptographic algorithms with PQC cryptographic algorithms to realize user identity authentication. The dual authentication method not only meets the requirements of the existing security system, but also provides security capabilities in the post-quantum era.

[0044] Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application; the execution subject of this method can be the above Figure 1 The PQC terminal service running in the client. Figure 2 As shown, the method may include: S101. Log in to the smart password key according to the login password input by the user, obtain key information of the post-quantum cryptographic algorithm based on the smart password key, and obtain key information of the asymmetric cryptographic algorithm based on the smart password key.

[0045] The key information includes: public key and private key.

[0046] The user can enter the login password through the PQC terminal service. The login password refers to the password used to log in to the smart password key. The login password of the smart password key is set by the user or system administrator during the configuration or use process, and is stored in the management system or database associated with it in an encrypted manner. The user needs to enter the correct login password to pass the identity authentication and access the sensitive information in the smart password key.

[0047] After logging in to the smart password key, the key information of the post-quantum cryptographic algorithm and the key information of the asymmetric cryptographic algorithm can be obtained based on the smart password key.

[0048] Generally, asymmetric cryptographic algorithms may include multiple types, including but not limited to: SM2 cryptographic algorithm, RSA (Rivest-Shamir-Adleman, asymmetric cryptographic algorithm), ECC (Elliptic Curve Cryptography, elliptic curve cryptography), DSA (Digital Signature Algorithm, digital signature algorithm), etc.; post-quantum cryptographic algorithms may also include multiple types, including but not limited to: PQC cryptographic algorithm, lattice-based cryptographic algorithm, encoding-based cryptographic algorithm, multivariate-based cryptographic algorithm, etc.

[0049] In the subsequent embodiments of this solution, the post-quantum cryptographic algorithm will be exemplified by the PQC cryptographic algorithm, and the asymmetric cryptographic algorithm will be exemplified by the SM2 cryptographic algorithm.

[0050] Optionally, the key information of the obtained PQC cryptographic algorithm includes: a PQC public key and a PQC private key; the key information of the obtained SM2 cryptographic algorithm includes: an SM2 public key and an SM2 private key.

[0051] By creating the key information of the post-quantum cryptographic algorithm and the key information of the asymmetric cryptographic algorithm respectively, the basic preparation can be made for the subsequent integration of the post-quantum cryptographic algorithm and the asymmetric cryptographic algorithm for identity authentication.

[0052] S102. Apply to the certificate issuing server for a first user signature certificate corresponding to the post-quantum cryptographic algorithm according to the public key of the post-quantum cryptographic algorithm; and apply to the certificate issuing server for a second user signature certificate corresponding to the asymmetric cryptographic algorithm according to the public key of the asymmetric cryptographic algorithm.

[0053] In some embodiments, the PQC terminal service may apply for a first user signature certificate from a certificate issuing server based on the obtained PQC public key; and apply for a second user signature certificate from a certificate issuing server based on the SM2 public key.

[0054] An important function of a signed certificate is to verify the identity of the holder. By using a public key to apply for a signed certificate, the certificate issuing server can verify the binding relationship between the public key and the holder's identity, ensuring the authenticity and validity of the certificate. In this way, when the certificate is used in scenarios such as encrypted communication and digital signatures, the recipient can trust the identity represented by the certificate.

[0055] Usually, the public key and the user's identity information can be sent to the certificate issuing server to apply for a signed certificate. The certificate issuing server will verify the user's identity information to ensure that the public key does belong to the user. Once the user's identity is verified, the certificate issuing server can use the private key of the cryptographic algorithm initialized locally to sign the public key sent by the user and generate a certificate containing the public key, signature, certificate validity period, issuer information, etc., that is, the user signed certificate is obtained.

[0056] Optionally, during the initialization process, the certificate issuing server may respectively initialize the key pair of the PQC cryptographic algorithm and the key pair of the SM2 cryptographic algorithm, and generate the root certificate of the PQC cryptographic algorithm and the root certificate of the SM2 cryptographic algorithm.

[0057] When the PQC terminal service applies for the first user signature certificate from the certificate issuing server based on the PQC public key, the certificate issuing service can sign the PQC public key based on the private key of the initialized PQC cryptographic algorithm to generate a first user signature certificate containing the PQC public key, signature, certificate validity period, issuer information and other contents.

[0058] When the PQC terminal service applies for a second user signature certificate from the certificate issuing server based on the SM2 public key, the certificate issuing service can sign the SM2 public key based on the private key of the initialized SM2 cryptographic algorithm to generate a second user signature certificate containing the SM2 public key, signature, certificate validity period, issuer information and other contents.

[0059] S103, writing the key information of the post-quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate and the second user signature certificate as authentication information into the secure storage area of ​​the smart cryptographic key.

[0060] Optionally, the smart cryptographic algorithm may import the key information of the generated PQC cryptographic algorithm and the key information of the SM2 cryptographic algorithm into the secure storage area of ​​the smart cryptographic key for storage. Of course, in some cases, the key information of the PQC cryptographic algorithm may be generated by the PQC terminal service, and the PQC terminal service imports the generated key information of the PQC cryptographic algorithm into the secure storage area of ​​the smart cryptographic key for storage.

[0061] In addition, the PQC terminal service can also import the first user signature certificate and the second user signature certificate returned by the certificate issuance service into the secure storage area of ​​the smart password key for storage, so as to be used in the subsequent identity authentication process.

[0062] S104: Perform identity authentication according to the authentication information stored in the secure storage area of ​​the smart password key.

[0063] Optionally, the PQC terminal service can perform signature calculation on the user message based on the authentication information stored in the secure storage area of ​​the smart password key to obtain the signature information, and initiate a login request to the certificate issuing service based on the signature information, the user signature certificate provided by the smart password key, and the user's authentication data. The certificate issuing server can check the fields in the authentication data, verify the user signature certificate according to the root certificate of the generated cryptographic algorithm, verify the signature information according to the user signature certificate, and finally complete the identity authentication.

[0064] Among them, the certificate signing server can combine the post-quantum cryptographic algorithm and the asymmetric cryptographic algorithm to jointly calculate the signature of the user message to achieve dual authentication combining the post-quantum cryptographic algorithm and the asymmetric cryptographic algorithm.

[0065] In summary, the identity authentication method provided in this embodiment includes: logging in to the smart password key according to the login password input by the user, obtaining the key information of the post-quantum cryptographic algorithm based on the smart password key, and obtaining the key information of the asymmetric cryptographic algorithm based on the smart password key; applying for the first user signature certificate corresponding to the post-quantum cryptographic algorithm from the certificate issuing server according to the public key of the post-quantum cryptographic algorithm; and applying for the second user signature certificate corresponding to the asymmetric cryptographic algorithm from the certificate issuing server according to the public key of the asymmetric cryptographic algorithm; writing the key information of the post-quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate and the second user signature certificate as authentication information into the secure storage area of ​​the smart password key; and performing identity authentication according to the authentication information stored in the secure storage area of ​​the smart password key. This method combines the post-quantum cryptographic algorithm with the asymmetric cryptographic algorithm, and integrates the identity authentication means of the post-quantum cryptographic algorithm on the basis of the traditional smart password key using the asymmetric cryptographic algorithm for identity authentication. Through the dual algorithm authentication method, the security and accuracy of the identity authentication are improved, which not only meets the requirements of the existing security system, but also provides security capabilities in the post-quantum era, and effectively resists the attack of quantum computing.

[0066] Optionally, in step S101, obtaining key information of a post-quantum cryptographic algorithm based on a smart cryptographic key may include: if the smart cryptographic key supports the post-quantum cryptographic algorithm, calling a post-quantum cryptographic algorithm program running in the smart cryptographic key to generate key information of the post-quantum cryptographic algorithm.

[0067] If the smart password key does not support the post-quantum cryptographic algorithm, key information of the post-quantum cryptographic algorithm is generated, and the generated key information of the post-quantum cryptographic algorithm is encrypted according to the login password to obtain the processed key information of the post-quantum cryptographic algorithm.

[0068] This method provides different processing flows for the two situations where the smart password key supports and does not support the post-quantum cryptographic algorithm, and can better adapt to the situation where most current smart password keys do not support the post-quantum cryptographic algorithm.

[0069] Optionally, if the smart password key supports the PQC cryptographic algorithm, the PQC terminal service can directly call the program of the PQC cryptographic algorithm running in the smart password key, so that the smart password key generates the key information of the PQC cryptographic algorithm based on the PQC cryptographic algorithm. And the generated key information of the PQC cryptographic algorithm is stored in the local secure storage area. At the same time, the generated public key of the PQC cryptographic algorithm is fed back to the PQC terminal service, so that the PQC terminal service uses the public key of the PQC cryptographic algorithm to apply for the first user signature certificate from the certificate issuance service.

[0070] If the smart password key does not support the PQC cryptographic algorithm, the key information of the PQC cryptographic algorithm is generated by the PQC terminal service. In order to prevent the private key in the generated key information from being leaked or attacked, the private key in the generated key information of the PQC cryptographic algorithm can be further encrypted according to the login password used when logging into the smart password key to obtain the processed key information of the PQC cryptographic algorithm.

[0071] Figure 3 A flowchart of another identity authentication method provided in an embodiment of the present application; optionally, Figure 3 As shown, in the above steps, the key information of the generated post-quantum cryptographic algorithm is encrypted according to the login password to obtain the processed key information of the post-quantum cryptographic algorithm, which may include: S201. Generate a derived key of the login password according to the login password.

[0072] Generating a derived key for a login password typically involves using a key derivation function, which is an algorithm that securely generates another key from a password, key, or other secret value.

[0073] There are many types of key derivation functions, such as PBKDF2 (Password-Base Key Derivation Function), bcrypt (file encryption tool), HKDF (a key derivation function based on HMAC), etc. These functions have their own characteristics in terms of security, computational cost, and memory usage. For example: PBKDF2: A password-based key derivation function that uses a hash function and salt to resist rainbow table attacks. PBKDF2 requires a higher computational cost to resist malicious cracking.

[0074] bcrypt: A hash function designed specifically for password storage that includes salt and cost parameters so that the computational cost can be adjusted to suit different hardware.

[0075] HKDF: A key derivation function based on HMAC (Hash-based Message Authentication Code, an algorithm that uses a hash function and a key to calculate a message authentication code), suitable for extracting uniformly distributed keys from non-uniformly distributed key materials.

[0076] Optionally, a suitable key derivation function may be selected, and the login password may be used as an input of the key derivation function to generate a derived key of the login password.

[0077] Of course, there may be other ways to generate derived keys, which can be understood by referring to existing technologies.

[0078] S202. Use a derived key to encrypt a private key in the key information of a post-quantum cryptographic algorithm to obtain a private key ciphertext of the post-quantum cryptographic algorithm.

[0079] The derived key generated above is used to encrypt the private key of the PQC cryptographic algorithm to obtain the private key ciphertext of the PQC cryptographic algorithm.

[0080] S203. Obtain processed key information of the post-quantum cryptographic algorithm according to the private key ciphertext of the post-quantum cryptographic algorithm and the public key in the key information of the post-quantum cryptographic algorithm.

[0081] The processed key information of the PQC cryptographic algorithm may include: the public key of the PQC cryptographic algorithm and the private key ciphertext of the PQC cryptographic algorithm.

[0082] The PQC terminal service will then write the generated public key of the PQC cryptographic algorithm and the private key ciphertext of the PQC cryptographic algorithm into the secure storage area of ​​the smart cryptographic key.

[0083] Optionally, obtaining the key information of the asymmetric cryptographic algorithm based on the smart cryptographic key may include: calling an asymmetric cryptographic algorithm program running in the smart cryptographic key to generate the key information of the asymmetric cryptographic algorithm.

[0084] Since the smart password key itself supports asymmetric cryptographic algorithms, the program of the SM2 cryptographic algorithm running in the smart password key can be directly called, so that the smart password key generates the key information of the SM2 cryptographic algorithm based on the SM2 cryptographic algorithm, and directly imports the key information of the SM2 cryptographic algorithm into the local secure storage area. Afterwards, the public key in the key information of the SM2 cryptographic algorithm is sent to the PQC terminal service, and the PQC terminal service applies for the second user signature certificate from the certificate issuance service based on the public key of the SM2 cryptographic algorithm.

[0085] Figure 4 A flowchart of another identity authentication method provided in an embodiment of the present application; optionally, as Figure 4 As shown, in step S102, applying for a first user signature certificate corresponding to the post-quantum cryptographic algorithm from a certificate issuing server according to the public key of the post-quantum cryptographic algorithm; and applying for a second user signature certificate corresponding to the asymmetric cryptographic algorithm from a certificate issuing server according to the public key of the asymmetric cryptographic algorithm may include: S301. Initiate a certificate application to a certificate issuing server according to the public key of the post-quantum cryptographic algorithm, and receive a first user signature certificate corresponding to the post-quantum cryptographic algorithm returned by the certificate issuing server.

[0086] The PQC terminal service can send the public key of the PQC cryptographic algorithm and the user's identity information to the certificate issuing server. After successfully verifying the user's identity information, the certificate issuing server signs the public key of the PQC cryptographic algorithm sent by the PQC terminal service according to the private key information of the PQC cryptographic algorithm generated in the initialization phase, generates a first user signature certificate corresponding to the PQC cryptographic algorithm, and returns the generated first user signature certificate to the PQC terminal service. The first user signature certificate can also be understood as a public key signature certificate of the PQC cryptographic algorithm, which is used to prove that the public key of the PQC cryptographic algorithm does belong to a specific user and prevent other users from tampering with the public key.

[0087] S302: Initiate a certificate application to a certificate issuing server according to the public key of the asymmetric cryptographic algorithm, and receive a second user signature certificate corresponding to the asymmetric cryptographic algorithm returned by the certificate issuing server.

[0088] Similar to the above process of generating the first user signature certificate, the PQC terminal service sends the public key of the SM2 cryptographic algorithm and the user's identity information to the certificate issuing server, and the certificate issuing service generates the second user signature certificate corresponding to the SM2 cryptographic algorithm, and returns the generated second user signature certificate to the PQC terminal service.

[0089] The above embodiment describes the process of user creation for two cryptographic algorithms, and the following embodiment describes the process of user identity authentication based on the created user information.

[0090] Figure 5 A flowchart of another identity authentication method provided by an embodiment of the present application; Optionally, in step S104, identity authentication is performed according to the authentication information stored in the secure storage area of ​​the smart password key, which may include: S401, calling the smart password key, generating and receiving the signature information of the authentication data returned by the smart password key and the user signature certificate; the signature information is generated by the smart password key according to the key information stored in the secure storage area of ​​the smart password key.

[0091] After logging in with the smart password key, the user can initiate a login request to the certificate issuing server. The user can only log in successfully after the certificate issuing server successfully authenticates the user's identity, thereby realizing the interaction between the client and the server.

[0092] The smart password key performs signature calculation as an important step in the identity authentication process. In this embodiment, the smart password key can use the PQC cryptographic algorithm to verify the user's identity, and at the same time, the SM2 cryptographic algorithm can also be used to verify the user's identity to implement an authentication method that combines the post-quantum cryptographic algorithm with the asymmetric cryptographic algorithm.

[0093] Optionally, during the authentication process, the PQC terminal service may call the key information of the cryptographic algorithm stored in the smart cryptographic key, perform signature calculation, generate signature information, and feed the signature information and the user signature certificate back to the PQC terminal service.

[0094] S402: Initiate an authentication request to the issuing server based on the signature information, the user signature certificate and the authentication data; receive the authentication result returned by the certificate issuing server, and determine the user's identity authentication result based on the authentication result.

[0095] The PQC terminal service sends the signature information, user signature certificate and authentication data to the certificate issuing server, which performs authentication based on the PQC cryptographic algorithm and the SM2 cryptographic algorithm, and returns the authentication result to the PQC terminal service. The user's identity authentication result can be determined based on the authentication result.

[0096] Figure 6 A flowchart of another identity authentication method provided by an embodiment of the present application; optionally, in step S401, before calling the smart password key and generating and receiving the signature information of the authentication data returned by the smart password key, it may include: S501. Initiate a login request to a certificate issuing server, and obtain a first message field returned by the certificate issuing server; the first message field includes a first random number.

[0097] Here you can refer to the digital signature technology mechanism in the "GB / T 15843.3-2008" standard for implementation.

[0098] After the PQC terminal service initiates a login request to the certificate issuing server, it can obtain the first message field returned by the certificate issuing server. The first message field may include a first random number and a first protocol field. The first protocol field may be a field pre-negotiated by the PQC terminal service and the certificate issuing server for both parties to confirm each other's identity.

[0099] S502, calling the smart password key to generate a second message field; the second message field includes: a second random number.

[0100] The PQC terminal service calls the smart password key to generate a second message field, the second message field includes: a second random number, and the smart password key returns the generated second message field to the PQC terminal service.

[0101] S503: Generate authentication data according to the first message field, the second message field and the user message field.

[0102] The PQC terminal service generates authentication data based on the first message field, the second message field and the user message field. The user message field may refer to a user message. In addition, when the authentication data is sent to the smart password key for signature calculation, a second protocol field may be carried on the basis of the authentication data, which has a similar function to the first protocol field. In different interaction stages, the protocol fields contained in the interaction data may be different, but their function is to confirm the identities of the two parties to the interaction.

[0103] Exemplarily, after initiating a login request to the certificate issuing server, the PQC terminal service may receive the first message field returned by the certificate issuing server: RB+"QHSM1"; wherein RB is the first random number, and QHSM1 is the first protocol field.

[0104] The PQC terminal service calls the smart password key to generate a second message field, and receives the second message field returned by the smart password key: RA; wherein RA is a second random number.

[0105] The PQC terminal service generates authentication data based on RB, RA, and the user message field "qhsm_server". The generated authentication data is: RA+RB+"qhsm_server". The PQC terminal service sends the authentication data carrying the second protocol field "QHSM2" to the smart password key for signature calculation.

[0106] Next, the authentication data is signed based on the smart password key, which involves signature calculation based on the PQC cryptographic algorithm and signature calculation based on the SM2 cryptographic algorithm.

[0107] Optionally, in step S401, calling the smart cryptographic key, generating and receiving signature information of authentication data returned by the smart cryptographic key, may include: calling the smart cryptographic key to generate first signature information of the authentication data according to the key information of the post-quantum cryptographic algorithm; and generating second signature information of the authentication data according to the key information of the asymmetric cryptographic algorithm; the signature information of the authentication data includes the first signature information and the second signature information.

[0108] In one possible implementation, the smart password key can perform signature calculation on the authentication data according to the PQC cryptographic algorithm to generate first signature information corresponding to the authentication data; at the same time, it can also perform signature calculation on the authentication data according to the SM2 cryptographic algorithm to generate second signature information corresponding to the authentication data.

[0109] Optionally, calling the smart cryptographic key to generate the first signature information of the authentication data according to the key information of the post-quantum cryptographic algorithm may include: if the smart cryptographic key supports the post-quantum cryptographic algorithm, calling the post-quantum cryptographic algorithm program running in the smart cryptographic key, and the smart cryptographic key performing a signature calculation on the authentication data according to the private key of the post-quantum cryptographic algorithm stored in the secure storage area to generate the first signature information of the authentication data.

[0110] For the PQC cryptographic algorithm, there are two situations in the signature calculation process. One is that the smart password key supports the PQC cryptographic algorithm, and the other is that the smart password key does not support the PQC cryptographic algorithm. This solution also provides different processing flows for different situations.

[0111] Optionally, if the smart password key supports the PQC cryptographic algorithm, the smart password key uses the private key in the key information of the PQC cryptographic algorithm stored in the secure storage area, adopts the PQC cryptographic algorithm, performs signature calculation on the authentication data, and obtains the first signature information corresponding to the authentication data. The first signature information and the first user signature certificate stored in the secure storage area are fed back to the PQC terminal service.

[0112] Figure 7A flowchart of another identity authentication method provided in an embodiment of the present application; Optionally, in step S401, calling a smart cryptographic key to generate first signature information of authentication data according to key information of a post-quantum cryptographic algorithm may include: S601. If the smart cryptographic key does not support the post-quantum cryptographic algorithm, read the private key ciphertext of the post-quantum cryptographic algorithm.

[0113] If the smart password key does not support the PQC cryptographic algorithm, the PQC terminal service reads the private key ciphertext of the PQC cryptographic algorithm, which can be read from the background database of the PQC terminal service.

[0114] S602. Decrypt the private key ciphertext of the post-quantum cryptographic algorithm according to the derived key of the login password.

[0115] Since the private key ciphertext is encrypted data, and the encryption process has been explained above, it is obtained by encryption based on the derived key of the login password. Therefore, the private key ciphertext can be decrypted according to the derived key of the login password to obtain the private key of the PQC cryptographic algorithm.

[0116] S603. Perform signature calculation on the authentication data according to the private key of the post-quantum cryptographic algorithm obtained after decryption to generate first signature information of the authentication data.

[0117] The PQC terminal service performs signature calculation on the authentication data according to the private key of the PQC cryptographic algorithm obtained by decryption, and generates the first signature information of the authentication data.

[0118] Optionally, the step of generating second signature information of authentication data according to key information of an asymmetric cryptographic algorithm may include: calling an asymmetric cryptographic algorithm program running in a smart cryptographic key, and having the smart cryptographic key perform signature calculation on the authentication data according to a private key of the asymmetric cryptographic algorithm stored in a secure storage area to generate second signature information of the authentication data.

[0119] Regarding the signature calculation under the SM2 cryptographic algorithm, since the smart cryptographic key itself supports asymmetric cryptographic algorithms, the smart cryptographic algorithm can use the SM2 key algorithm to perform signature calculation on the authentication data based on the private key in the key information of the SM2 cryptographic algorithm stored in the secure storage area to generate the second signature information of the authentication data.

[0120] Figure 8 A flow chart of another identity authentication method provided in an embodiment of the present application; optionally, in step S402, an authentication request is initiated to an issuing server according to the signature information, the user signature certificate, and the authentication data; an authentication result returned by the certificate issuing server is received, and an identity authentication result of the user is determined according to the authentication result, which may include: S701. Initiate an authentication request to a certificate issuing server according to the first signature information, the second signature information, the first user signature certificate, the second user signature certificate and the authentication data.

[0121] Optionally, when authentication is performed based on the PQC cryptographic algorithm, the PQC terminal service may send the first signature information, the authentication data, and the first user signature certificate together to the certificate issuing server for authentication. The authentication data carrying the third protocol field may be sent to the certificate issuing server. The third protocol field has the same function as the first protocol field and the second protocol field.

[0122] When authentication is performed based on the SM2 cryptographic algorithm, the PQC terminal service may send the second signature information, the authentication data, and the second user signature certificate to the certificate issuing server for authentication. The authentication data carrying the third protocol field may be sent to the certificate issuing server.

[0123] S702: Receive the authentication result returned by the certificate issuing server, and determine the user's identity authentication result according to the authentication result.

[0124] For the verification of the SM2 cryptographic algorithm, the certificate issuing server can first check the first random number in the authentication data. When the first random number is the same as the first random number sent by the certificate issuing server to the PQC terminal service, the first random number verification is successful. The user message field and the third protocol field carried in the authentication data can also be verified. If the field is consistent with the field in the protocol, the verification is successful. Then, the second user signature certificate can be used to verify the second signature information, that is, the public key in the second user signature certificate is used to decrypt the second signature information. The second user signature certificate is verified according to the root certificate of the SM2 cryptographic algorithm generated during initialization. After all the verifications are completed, the authentication results based on the SM2 cryptographic algorithm are returned to the PQC terminal service.

[0125] Similarly, for the verification of the PQC cryptographic algorithm, since the first random number, user message field, and third protocol field have been verified in the verification process of the SM2 cryptographic algorithm, only the first user signature certificate is used to verify the first signature information, that is, the first signature information is decrypted using the public key in the first user signature certificate; and the first user signature certificate is verified according to the root certificate of the PQC cryptographic algorithm generated during initialization. Similarly, after the verification is completed, the authentication result based on the PQC cryptographic algorithm is returned to the PQC terminal service.

[0126] Fig. 9A flowchart of another identity authentication method provided in an embodiment of the present application; Optionally, in step S702, receiving the authentication result returned by the certificate issuing server, and determining the identity authentication result of the user according to the authentication result may include: S801. Receive a first authentication result corresponding to a post-quantum cryptographic algorithm and a second authentication result corresponding to an asymmetric cryptographic algorithm returned by a certificate issuing server.

[0127] Optionally, the PQC terminal service may receive a first authentication result corresponding to the PQC cryptographic algorithm and a second authentication result corresponding to the SM2 algorithm returned by the certificate issuing server.

[0128] S802: If both the first authentication result and the second authentication result are authenticated, determine that the user's identity authentication result is authenticated.

[0129] If both the first authentication result and the second authentication result are authentication success, it can be determined that the user's identity authentication result is authentication success.

[0130] Through dual authentication of post-quantum cryptographic algorithms and asymmetric cryptographic algorithms, user identity authentication is achieved. Compared with the traditional authentication method of only using asymmetric cryptographic algorithms, it effectively resists quantum computing attacks, the authentication process is more secure, and the authentication results are more accurate.

[0131] In summary, the identity authentication method provided in this embodiment includes: logging in to the smart password key according to the login password input by the user, obtaining the key information of the post-quantum cryptographic algorithm based on the smart password key, and obtaining the key information of the asymmetric cryptographic algorithm based on the smart password key; applying for the first user signature certificate corresponding to the post-quantum cryptographic algorithm from the certificate issuing server according to the public key of the post-quantum cryptographic algorithm; and applying for the second user signature certificate corresponding to the asymmetric cryptographic algorithm from the certificate issuing server according to the public key of the asymmetric cryptographic algorithm; writing the key information of the post-quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate and the second user signature certificate as authentication information into the secure storage area of ​​the smart password key; and performing identity authentication according to the authentication information stored in the secure storage area of ​​the smart password key. This method combines the post-quantum cryptographic algorithm with the asymmetric cryptographic algorithm, and integrates the identity authentication means of the post-quantum cryptographic algorithm on the basis of the traditional smart password key using the asymmetric cryptographic algorithm for identity authentication. Through the dual algorithm authentication method, the security and accuracy of the identity authentication are improved, which not only meets the requirements of the existing security system, but also provides security capabilities in the post-quantum era, and effectively resists the attack of quantum computing.

[0132] In addition, this solution provides different processing flows for whether the smart password key supports the post-quantum cryptographic algorithm, so that the key information generation and signature calculation of the post-quantum cryptographic algorithm can be realized in both cases where the smart password key supports the post-quantum cryptographic algorithm and does not support the post-quantum cryptographic algorithm. It can better adapt to the situation where most current smart password keys do not support the post-quantum cryptographic algorithm.

[0133] Optionally, the present application also provides an identity authentication system. The architecture diagram of the identity authentication system can be referenced as follows: Figure 1 The identity authentication system may include: a terminal device, an intelligent password key, and a certificate issuing server; the above-mentioned PQC terminal service is deployed on the terminal device.

[0134] The terminal device is used to perform identity authentication based on the identity authentication method provided in the embodiment of the present application; The smart password key is used to interact with the terminal device to obtain the key information of the cryptographic algorithm, store and provide authentication information containing the key information, and perform signature calculation based on the key information; The certificate issuing server is used to interact with the terminal device for identity authentication.

[0135] Fig.10 A signaling interaction diagram provided for an embodiment of the present application. Fig.10 The method flow of generating key information of cryptographic algorithm based on intelligent cryptographic key is shown. It mainly involves the following steps: First: Initialize the certificate signing server: The certificate signing server initializes the key pair of the SM2 cryptographic algorithm and the key pair of the PQC cryptographic algorithm as the root signing key pair of the certificate signing server; and generates the root certificate corresponding to the SM2 cryptographic algorithm and the root certificate of the PQC cryptographic algorithm.

[0136] Second: User creation (including generating key information for SM2 cryptographic algorithm and PQC cryptographic algorithm respectively): (1) Generation of key information for SM2 cryptographic algorithm: After successfully logging into the smart password key, call the smart password key to generate key information of the SM2 cryptographic algorithm, and apply for a second user signature certificate from the certificate signing server based on the received public key of the SM2 cryptographic algorithm; import the second user signature certificate into the secure storage area of ​​the smart password key.

[0137] (2) Key information generation of PQC cryptographic algorithm: If the smart password key supports the PQC cryptographic algorithm, the smart password key is called to generate the key information of the PQC cryptographic algorithm and receive the public key of the PQC cryptographic algorithm.

[0138] If the smart password key does not support the PQC cryptographic algorithm, the key information of the PQC cryptographic algorithm is generated, and the private key of the PQC cryptographic algorithm is encrypted using the derived key of the smart password key's login password; the encrypted private key ciphertext and the public key of the PQC cryptographic algorithm are written into the secure storage area of ​​the smart password key.

[0139] Based on the public key of the PQC cryptographic algorithm, an application is made to the certificate issuing server for a first user signature certificate, and the obtained first user signature certificate is written into the secure storage area of ​​the smart password key.

[0140] Fig.11 Another signaling interaction diagram provided for an embodiment of the present application. Fig.11 The method flow of user identity authentication based on the authentication information provided by the smart key is demonstrated. The main steps involved are: First: Authentication based on SM2 cryptographic algorithm: The PQC terminal service initiates a login request to the certificate issuing server, and receives the first random number and the first protocol field returned by the certificate issuing server.

[0141] The PQC terminal service calls the smart password key to generate a second random number.

[0142] Generate authentication data according to the first random number, the second random number, and the user message field, send the authentication data carrying the second protocol field to the smart password key, calculate the signature by the smart password key, and receive the second signature information and the second user signature certificate returned by the smart password key.

[0143] The authentication data carrying the third protocol field, the second signature information, and the second user signature certificate are sent to the certificate issuing server for authentication.

[0144] The certificate issuing server verifies the second random number, verifies the user message field and the third protocol field, verifies the second signature information using the second user signature certificate, verifies the second user signature certificate using the root certificate of the SM2 cryptographic algorithm, and returns the second authentication result to the PQC terminal service.

[0145] Second: Authentication based on PQC cryptographic algorithm: Some steps are the same as the authentication process based on the SM2 password algorithm, such as logging into the smart password key and generating authentication data, which will not be repeated here.

[0146] The authentication data carrying the second protocol field is sent to the smart password key, and the smart password key performs signature calculation.

[0147] When the smart password key supports the PQC cryptographic algorithm, the smart password key uses the private key of the PQC cryptographic algorithm stored in the secure area to perform signature calculation on the authentication data and returns the first signature information to the PQC terminal service.

[0148] When the smart password key does not support the PQC cryptographic algorithm, the PQC terminal service reads the private key ciphertext of the PQC cryptographic algorithm, decrypts the private key ciphertext using the derived key of the login password, and performs signature calculation on the authentication data based on the decrypted private key of the PQC cryptographic algorithm to obtain the first signature information, and receives the first user signature certificate returned by the smart password key.

[0149] The authentication data carrying the third protocol field, the first signature information, and the first user signature certificate are sent to the certificate issuing server for authentication.

[0150] The certificate issuing server uses the first user signature certificate to verify the first signature information, uses the root certificate of the PQC cryptographic algorithm to verify the first user signature certificate, and returns the first authentication result to the PQC terminal service.

[0151] The following describes the apparatus, terminal device, storage medium, etc. used to execute the identity authentication method provided in this application. The specific implementation process and technical effects are described above and will not be repeated below.

[0152] Fig.12 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application, the terminal device may be a computing device with data processing capabilities.

[0153] The device may include: a processor 801 and a storage medium 802 .

[0154] The storage medium 802 is used to store programs, and the processor 801 calls the programs stored in the storage medium 802 to execute the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0155] Among them, the storage medium 802 stores program code, and when the program code is executed by the processor 801, the processor 801 executes various steps in the identity authentication method according to various exemplary embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0156] The processor 801 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and may implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0157] The storage medium 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The storage medium may include at least one type of storage medium, for example, a flash memory, a hard disk, a multimedia card, a card-type storage medium, a random access storage medium (Random Access Memory, RAM), a static random access storage medium (Static Random Access Memory, SRAM), a programmable read-only storage medium (Programmable Read Only Memory, PROM), a read-only storage medium (Read Only Memory, ROM), an electrically erasable programmable read-only storage medium (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic storage medium, a disk, an optical disk, and the like. The storage medium is any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The storage medium 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0158] Optionally, the present application also provides a program product, such as a computer-readable storage medium, including a program, which is used to execute the above method embodiment when executed by a processor.

[0159] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0160] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0162] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only storage medium (English: Read-Only Memory, referred to as: ROM), random access storage medium (English: Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

Claims

1. An identity authentication method, characterized in that: include: Log in to the smart password key according to the login password input by the user, obtain key information of the post-quantum cryptographic algorithm based on the smart password key, and obtain key information of the asymmetric cryptographic algorithm based on the smart password key; The key information includes: a public key and a private key; Applying for a first user signature certificate corresponding to the post-quantum cryptographic algorithm from a certificate issuing server according to the public key of the post-quantum cryptographic algorithm; and applying for a second user signature certificate corresponding to the asymmetric cryptographic algorithm from the certificate issuing server according to the public key of the asymmetric cryptographic algorithm; Writing the key information of the post-quantum cryptographic algorithm, the key information of the asymmetric cryptographic algorithm, the first user signature certificate, and the second user signature certificate as authentication information into the secure storage area of ​​the smart password key; Identity authentication is performed according to the authentication information stored in the secure storage area of ​​the smart password key.

2. The method according to claim 1, characterized in that The obtaining key information of the post-quantum cryptographic algorithm based on the smart cryptographic key includes: If the smart cryptographic key supports the post-quantum cryptographic algorithm, calling the post-quantum cryptographic algorithm program running in the smart cryptographic key to generate key information of the post-quantum cryptographic algorithm; If the smart password key does not support the post-quantum cryptographic algorithm, key information of the post-quantum cryptographic algorithm is generated, and the generated key information of the post-quantum cryptographic algorithm is encrypted according to the login password to obtain the processed key information of the post-quantum cryptographic algorithm.

3. The method according to claim 2, characterized in that The step of encrypting the key information of the post-quantum cryptographic algorithm generated according to the login password to obtain the processed key information of the post-quantum cryptographic algorithm includes: According to the login password, generating a derived key of the login password; Using the derived key to encrypt the private key in the key information of the post-quantum cryptographic algorithm to obtain the private key ciphertext of the post-quantum cryptographic algorithm; The processed key information of the post-quantum cryptographic algorithm is obtained according to the private key ciphertext of the post-quantum cryptographic algorithm and the public key in the key information of the post-quantum cryptographic algorithm.

4. The method according to claim 1, characterized in that: The obtaining key information of the asymmetric cryptographic algorithm based on the smart cryptographic key includes: The asymmetric cryptographic algorithm program running in the smart cryptographic key is called to generate key information of the asymmetric cryptographic algorithm.

5. The method according to claim 1, characterized in that applying for a first user signature certificate corresponding to the post-quantum cryptographic algorithm from a certificate issuing server according to the public key of the post-quantum cryptographic algorithm; And applying for a second user signature certificate corresponding to the asymmetric cryptographic algorithm from the certificate issuing server according to the public key of the asymmetric cryptographic algorithm, including: Initiate a certificate application to the certificate issuing server according to the public key of the post-quantum cryptographic algorithm, and receive a first user signature certificate corresponding to the post-quantum cryptographic algorithm returned by the certificate issuing server; A certificate application is initiated to the certificate issuing server according to the public key of the asymmetric cryptographic algorithm, and a second user signature certificate corresponding to the asymmetric cryptographic algorithm returned by the certificate issuing server is received.

6. The method according to any one of claims 1 to 5, characterized in that: The performing identity authentication according to the authentication information stored in the secure storage area of ​​the smart password key includes: Calling the smart password key, generating and receiving signature information of the authentication data returned by the smart password key and a user signature certificate; the signature information is generated by the smart password key according to the key information stored in the secure storage area of ​​the smart password key; Initiate an authentication request to the issuing server according to the signature information, the user signature certificate and the authentication data; receive the authentication result returned by the certificate issuing server, and determine the identity authentication result of the user according to the authentication result.

7. The method according to claim 6, characterized in that Before calling the smart password key and generating and receiving the signature information of the authentication data returned by the smart password key, the method includes: Initiate a login request to the certificate issuing server, and obtain a first message field returned by the certificate issuing server; the first message field includes a first random number; Calling the smart password key to generate a second message field; the second message field includes: a second random number; The authentication data is generated according to the first message field, the second message field and a user message field.

8. The method according to claim 6, characterized in that The calling of the smart password key, generating and receiving signature information of the authentication data returned by the smart password key, includes: The smart cryptographic key is called to generate first signature information of the authentication data according to the key information of the post-quantum cryptographic algorithm; and second signature information of the authentication data is generated according to the key information of the asymmetric cryptographic algorithm; the signature information of the authentication data includes the first signature information and the second signature information.

9. The method according to claim 8, characterized in that The calling of the smart cryptographic key to generate the first signature information of the authentication data according to the key information of the post-quantum cryptographic algorithm includes: If the smart cryptographic key supports the post-quantum cryptographic algorithm, the post-quantum cryptographic algorithm program running in the smart cryptographic key is called, and the smart cryptographic key performs signature calculation on the authentication data according to the private key of the post-quantum cryptographic algorithm stored in the secure storage area to generate first signature information of the authentication data.

10. The method according to claim 8, characterized in that The calling of the smart cryptographic key to generate the first signature information of the authentication data according to the key information of the post-quantum cryptographic algorithm includes: If the smart cryptographic key does not support the post-quantum cryptographic algorithm, reading the private key ciphertext of the post-quantum cryptographic algorithm; Decrypting the private key ciphertext of the post-quantum cryptographic algorithm according to the derived key of the login password; The authentication data is signature-calculated according to the private key of the post-quantum cryptographic algorithm obtained after decryption to generate first signature information of the authentication data.

11. The method according to claim 8, characterized in that The step of generating the second signature information of the authentication data according to the key information of the asymmetric cryptographic algorithm comprises: The asymmetric cryptographic algorithm program running in the smart cryptographic key is called, and the smart cryptographic key performs signature calculation on the authentication data according to the private key of the asymmetric cryptographic algorithm stored in the secure storage area to generate second signature information of the authentication data.

12. The method according to claim 8, characterized in that Initiating an authentication request to the issuing server according to the signature information, the user signature certificate and the authentication data; Receiving the authentication result returned by the certificate issuing server, and determining the identity authentication result of the user according to the authentication result, including: Initiate an authentication request to the certificate issuing server according to the first signature information, the second signature information, the first user signature certificate, the second user signature certificate and the authentication data; Receive the authentication result returned by the certificate issuing server, and determine the identity authentication result of the user according to the authentication result.

13. The method according to claim 12, characterized in that The receiving the authentication result returned by the certificate issuing server and determining the identity authentication result of the user according to the authentication result includes: Receiving a first authentication result corresponding to the post-quantum cryptographic algorithm and a second authentication result corresponding to the asymmetric cryptographic algorithm returned by the certificate issuing server; If both the first authentication result and the second authentication result are authenticated, the identity authentication result of the user is determined to be authenticated.

14. A terminal device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the terminal device is running, the processor and the storage medium communicate via the bus, and the processor executes the program instructions to implement the identity authentication method as described in any one of claims 1 to 13.

15. An identity authentication system, characterized in that: include: The terminal device, smart password key and certificate issuing server as described in claim 14; The terminal device is used to perform identity authentication based on the identity authentication method according to any one of claims 1 to 13; The smart password key is used to interact with the terminal device to obtain key information of the cryptographic algorithm, store and provide authentication information containing the key information, and perform signature calculation based on the key information; The certificate issuing server is used to interact with the terminal device to perform identity authentication.

16. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the identity authentication method according to any one of claims 1 to 13 is implemented.

Images