Identity verification method and device and electronic equipment

Abstract

The embodiment of the invention provides an identity verification method and device and electronic equipment, and the method comprises the steps: obtaining a first signature value of a first terminal, a second signature value of a second terminal and a digital certificate under the condition of receiving a login request initiated by the first terminal, the first signature value being obtained through signature of a first key segment, and the second signature value being obtained through signature of a second key segment; the second signature value is obtained through signature of a second key segment, and the first key segment and the second key segment are different segments of the target private key; performing aggregation processing on the first signature value and the second signature value to obtain a third signature value; verifying the third signature value through the digital certificate; and under the condition that verification is passed, it is determined that identity verification of the first terminal and the second terminal is successful, and the second terminal and the first terminal belong to authorized login terminals of the same account. Therefore, according to the embodiment of the invention, the problem that in the prior art, the terminal logs in the cloud desktop system, the identity authentication function is lacked, and great security is brought to the cloud desktop service and data security can be solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an identity authentication method, device and electronic device. Background Art

[0002] Cloud desktop is a virtual desktop solution based on cloud computing. It hosts the operating system, applications and user data of traditional computers on cloud servers. Users can access and use these virtual desktops through relevant devices by simply connecting to the Internet, realizing functions such as remote office, cross-device collaboration and data sharing. It can be seen that cloud desktop is a remote office service platform built based on autonomous and controllable network technology, which can provide users with stable, reliable, secure, trustworthy and sustainable cloud desktop services.

[0003] Among them, with the rapid development of network services, various business security requirements are increasing. However, the current terminal login cloud desktop system lacks identity authentication function, which brings great security risks to cloud desktop services and data security. Summary of the invention

[0004] The embodiments of the present application provide an identity authentication method, device and electronic device to solve the problem that a terminal in the prior art lacks an identity authentication function when logging into a cloud desktop system, which brings great security problems to cloud desktop services and data security.

[0005] In a first aspect, an embodiment of the present application provides an identity authentication method, which is applied to a server, and the method includes:

[0006] Upon receiving a login request initiated by a first terminal, obtaining a first signature value of the first terminal, a second signature value of the second terminal, and a digital certificate, wherein the first signature value is obtained by signing a first key fragment, the second signature value is obtained by signing a second key fragment, the digital certificate corresponds to a target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals of the same account;

[0007] Aggregate the first signature value and the second signature value to obtain a third signature value;

[0008] Verifying the third signature value by using the digital certificate;

[0009] When the third signature value passes the verification, it is determined that the identity authentication of the first terminal and the second terminal is successful.

[0010] In a second aspect, an embodiment of the present application provides an identity authentication method, which is applied to a first terminal, and the method includes:

[0011] Send a login request to the server;

[0012] Receiving a first random number sent by the server;

[0013] Signing the first random number using a first key fragment to obtain a first signature value;

[0014] Sending the first signature value to the server, so that the server performs identity authentication on the first terminal and the second terminal according to the first signature value and the received second signature value and digital certificate of the second terminal;

[0015] Among them, the second signature value is obtained by signing the second random number with a second key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0016] In a third aspect, an embodiment of the present application provides an identity authentication method, which is applied to a second terminal, and the method includes:

[0017] Get the second random number provided by the server;

[0018] Signing the second random number using a second key fragment to obtain a second signature value;

[0019] Sending the second signature value and the digital certificate to the server, so that the server authenticates the second terminal and the first terminal according to the second signature value and the digital certificate, and the first signature value of the first terminal;

[0020] Among them, the first signature value is obtained by signing the first random number with a first key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0021] In a fourth aspect, an embodiment of the present application provides an identity authentication device, which is applied to a server, and the device includes:

[0022] A first acquisition module is configured to, upon receiving a login request initiated by a first terminal, acquire a first signature value of the first terminal, a second signature value of the second terminal, and a digital certificate, wherein the first signature value is obtained by signing a first key fragment, the second signature value is obtained by signing a second key fragment, the digital certificate corresponds to a target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals of the same account;

[0023] A processing module, configured to aggregate the first signature value and the second signature value to obtain a third signature value;

[0024] A verification module, used to verify the third signature value through the digital certificate;

[0025] A determination module is used to determine that the identity authentication of the first terminal and the second terminal is successful when the third signature value passes the verification.

[0026] In a fifth aspect, an embodiment of the present application provides an identity authentication device, applied to a first terminal, the device comprising:

[0027] A first sending module, used for sending a login request to a server;

[0028] A first receiving module, used for receiving a first random number sent by the server;

[0029] A first signature module, used to sign the first random number using a first key fragment to obtain a first signature value;

[0030] The first sending module is further used to: send the first signature value to the server, so that the server performs identity authentication on the first terminal and the second terminal according to the first signature value, and the received second signature value and digital certificate of the second terminal;

[0031] Among them, the second signature value is obtained by signing the second random number with a second key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0032] In a sixth aspect, an embodiment of the present application provides an identity authentication device, applied to a second terminal, the device comprising:

[0033] A second acquisition module, used to acquire a second random number provided by the server;

[0034] A second signature module, used to sign the second random number using a second key fragment to obtain a second signature value;

[0035] a second sending module, configured to send the second signature value and the digital certificate to the server, so that the server performs identity authentication on the second terminal and the first terminal according to the second signature value and the digital certificate, and the first signature value of the first terminal;

[0036] Among them, the first signature value is obtained by signing the first random number with a first key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0037] In a seventh aspect, an embodiment of the present application provides an electronic device, including:

[0038] one or more processors; and

[0039] One or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, cause the electronic device to execute the identity authentication method described in the first aspect above, or execute the identity authentication method described in the second aspect above, or execute the identity authentication method described in the third aspect above.

[0040] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that enables a processor to execute the identity authentication method described in the first aspect above, or execute the identity authentication method described in the second aspect above, or execute the identity authentication method described in the third aspect above.

[0041] In an embodiment of the present application, upon receiving a login request initiated by a first terminal, the server is able to obtain a first signature value of the first terminal, a second signature value of the second terminal, and a digital certificate, thereby aggregating the first signature value and the second signature value to obtain a third signature value, verify the third signature value through the digital certificate, and when the third signature value passes the verification, determine that the identity authentication of the first terminal and the second terminal is successful; wherein the first signature value is obtained by signing a first key fragment, the second signature value is obtained by signing a second key fragment, the digital certificate corresponds to a target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals belonging to the same account.

[0042] It can be seen that in an embodiment of the present application, the target private key corresponding to the digital certificate can be split into a first key fragment and a second key fragment, so that the first terminal requesting login uses the first key fragment to obtain the first signature value, and the second terminal assisting in login authentication uses the second key fragment to obtain the second signature value. In this way, after the server obtains the first signature value, the second signature value and the digital certificate, it can aggregate the first signature value and the second signature value into a third signature value, thereby verifying the third signature value through the digital certificate.

[0043] Different terminals use different fragments of the same private key to obtain their own signature values. In this way, even if a key fragment is leaked or obtained by an attacker, the complete key cannot be obtained, thereby improving security. In addition, the server can authenticate the identity of each terminal by verifying the signature value after the aggregation of these signature values, which can simplify the authentication process and shorten the authentication time.

[0044] It can be seen from this that in an embodiment of the present application, when the first terminal requests to log in, it can use different key fragments of the same private key to obtain respective signature values ​​with the second terminal that assists in login authentication, so that the server can verify the signature value after the two signature values ​​are aggregated to achieve identity authentication of the first terminal and the second terminal. The entire identity authentication process is not only simple but also secure, thereby improving the business and data security in the system logged in by the first terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of the steps of an identity verification method of the present application;

[0046] Figure 2 is a flowchart of the steps of another identity verification method of the present application;

[0047] Figure 3 is a flowchart of the steps of another identity verification method of the present application;

[0048] Figure 4 It is one of the schematic diagrams of a specific implementation method of the identity authentication method of an embodiment of the present application;

[0049] Figure 5 This is a second schematic diagram of a specific implementation method of the identity authentication method of an embodiment of the present application;

[0050] Figure 6 This is the third schematic diagram of a specific implementation method of the identity authentication method of the embodiment of the present application;

[0051] Figure 7 It is a structural block diagram of an identity authentication device of the present application;

[0052] Figure 8 is a structural block diagram of another identity authentication device of the present application;

[0053] Fig. 9 It is a structural block diagram of another identity authentication device of the present application. DETAILED DESCRIPTION

[0054] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0055] In the prior art, the terminal logs into the cloud desktop system, lacking the identity authentication function, which greatly affects the cloud desktop business and data security. In the embodiment of the present application, the target private key corresponding to the digital certificate can be split into a first key fragment and a second key fragment, so that the first terminal requesting login uses the first key fragment to obtain the first signature value, and the second terminal assisting in login authentication uses the second key fragment to obtain the second signature value. In this way, after the server obtains the first signature value, the second signature value and the digital certificate, it can aggregate the first signature value and the second signature value into a third signature value, thereby verifying the third signature value through the digital certificate.

[0056] Different terminals use different fragments of the same private key to obtain their own signature values. In this way, even if a key fragment is leaked or obtained by an attacker, the complete key cannot be obtained, thereby improving security. In addition, the server can authenticate the identity of each terminal by verifying the signature value after the aggregation of these signature values, which can simplify the authentication process and shorten the authentication time.

[0057] It can be seen from this that in an embodiment of the present application, when the first terminal requests to log in, it can use different key fragments of the same private key to obtain respective signature values ​​with the second terminal that assists in login authentication, so that the server can verify the signature value after the two signature values ​​are aggregated to achieve identity authentication of the first terminal and the second terminal. The entire identity authentication process is not only simple but also secure, thereby improving the business and data security in the system logged in by the first terminal.

[0058] Among them, the identity authentication method of the embodiment of the present application can be applied to the visual network. In this case, the first terminal can be a visual network terminal, the second terminal can be an Internet terminal (such as a mobile phone), and the server can be a server of the visual network cloud desktop.

[0059] It can be understood that the application of the identity authentication method of the embodiment of the present application is not limited to the visual network.

[0060] The following is a detailed introduction to the identity authentication method of the embodiment of the present application.

[0061] First, as Figure 1 As shown, an embodiment of the present application provides an identity authentication method, which is applied to a server. The method may include the following steps 101 to 104:

[0062] Step 101: upon receiving a login request initiated by a first terminal, a first signature value of the first terminal, a second signature value and a digital certificate of a second terminal are obtained.

[0063] Among them, the first signature value is obtained by signing the first key fragment, the second signature value is obtained by signing the second key fragment, the digital certificate corresponds to the target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0064] Optionally, the first key fragment is stored on the first terminal (for example, a security chip may be provided on the first terminal, and the first key fragment may be stored in the security chip), so that when the first terminal requests login, the first signature value may be generated by the first key fragment.

[0065] Optionally, the second key fragment is stored in the second terminal, so that the second terminal can use the second key fragment to generate the second signature value.

[0066] It can be seen that in the embodiment of the present application, the first key fragment and the second key fragment are obtained by dividing the target private key into different fragments; that is, it can be understood that the first key fragment and the second key fragment are different fragments of the target private key. Optionally, a collaborative algorithm is used to divide the target private key into the first key fragment and the second key fragment.

[0067] In addition, the digital certificate includes a public key, which forms a key pair with the target private key.

[0068] In addition, the system that the first terminal requests to log in is related to the above-mentioned server; that is, it can be understood that: the first terminal requests to log in to the server or the cloud desktop related to the server.

[0069] Step 102: Aggregate the first signature value and the second signature value to obtain a third signature value.

[0070] Optionally, the first signature value and the second signature value are aggregated by an aggregation algorithm to obtain a third signature value.

[0071] It should be noted that the "collaborative algorithm" used to split the target private key is associated with the "aggregation algorithm" used to aggregate the first signature value and the second signature value. That is, it can be understood that: when the collaborative algorithm is used to split the target private key to obtain the first key fragment and the second key fragment, it is necessary to use an aggregation algorithm to aggregate the first signature value obtained by the first key fragment and the second signature value obtained by the second key fragment. In this way, the third signature value obtained can be verified using the digital certificate corresponding to the target private key.

[0072] Step 103: Verify the third signature value using the digital certificate.

[0073] As described above, the first signature value is obtained by signing the first key fragment, and the second signature value is obtained by signing the second key fragment, and the first key fragment and the second key fragment are different fragments of the same private key. In this case, the first signature value and the second signature value can be aggregated into a complete signature value, namely, the third signature value, so that the third signature value can be verified by the public key in the digital certificate.

[0074] Among them, if the first signature value is obtained by signing the first object with the first key fragment, and the second signature value is obtained by signing the second object with the second key fragment, then the third signature value obtained by aggregation includes the first object and the second object. Alternatively, it can also be understood that: the third signature value is obtained by signing the first object and the second object with the target private key. Among them, the public key in the digital certificate and the target private key constitute a key pair, and the object encrypted by the target private key can be decrypted by the public key corresponding to it. In this way, by decrypting the third signature value with the public key in the digital certificate, two objects can be obtained, for example, called the third object and the fourth object; among them, if the third object and the fourth object are respectively the same as the first object and the second object, it means that the third signature value has passed the verification.

[0075] Step 104: When the third signature value passes the verification, it is determined that the identity authentication of the first terminal and the second terminal is successful.

[0076] It should be noted that verifying the third signature value through the digital certificate can also be understood as: verifying the validity of the digital certificate through the third signature value.

[0077] It can be understood that the third signature value includes the first object used by the first terminal to obtain the first signature value, and the second object used by the second terminal to obtain the second signature value. If the third signature value passes the verification (that is, the digital certificate is valid), it can indicate that the identity authentication of the first terminal and the second terminal is successful; conversely, if the third signature value fails to pass the verification (that is, the digital certificate is invalid), the identity authentication of the first terminal and the second terminal is unsuccessful.

[0078] In addition, after the identity authentication of the first terminal and the second terminal is successful, the first terminal can display the display interface of the system requested to log in. For example, when the first terminal requests to log in to the cloud desktop, after the identity authentication of the first terminal and the second terminal is successful, the first terminal can display the interface of the cloud desktop.

[0079] It can be seen from the above steps 101 to 104 that in an embodiment of the present application, when a login request initiated by a first terminal is received, the server can obtain the first signature value of the first terminal, the second signature value and the digital certificate of the second terminal, thereby aggregating the first signature value and the second signature value to obtain a third signature value, verify the third signature value through the digital certificate, and when the third signature value passes the verification, determine that the identity authentication of the first terminal and the second terminal is successful; wherein the first signature value is obtained by signing the first key fragment, the second signature value is obtained by signing the second key fragment, the digital certificate corresponds to the target private key, and the first key fragment and the second key fragment are different fragments of the target private key.

[0080] It can be seen that in an embodiment of the present application, the target private key corresponding to the digital certificate can be split into a first key fragment and a second key fragment, so that the first terminal requesting login uses the first key fragment to obtain the first signature value, and the second terminal assisting in login authentication uses the second key fragment to obtain the second signature value. In this way, after the server obtains the first signature value, the second signature value and the digital certificate, it can aggregate the first signature value and the second signature value into a third signature value, thereby verifying the third signature value through the digital certificate.

[0081] Different terminals use different fragments of the same private key to obtain their own signature values. In this way, even if a key fragment is leaked or obtained by an attacker, the complete key cannot be obtained, thereby improving security. In addition, the server can authenticate the identity of each terminal by verifying the signature value after the aggregation of these signature values, which can simplify the authentication process and shorten the authentication time.

[0082] It can be seen from this that in an embodiment of the present application, when the first terminal requests to log in, it can use different key fragments of the same private key to obtain respective signature values ​​with the second terminal that assists in login authentication, so that the server can verify the signature value after the two signature values ​​are aggregated to achieve identity authentication of the first terminal and the second terminal. The entire identity authentication process is not only simple but also secure, thereby improving the business and data security in the system logged in by the first terminal.

[0083] Optionally, before the above step 101 of "obtaining the first signature value of the first terminal, the second signature value of the second terminal, and the digital certificate", the method further includes the following steps A-1 to A-2:

[0084] Step A-1: ​​Generate a first random number and a second random number;

[0085] Step A-2: Provide the first random number to the first terminal, and provide the second random number to the second terminal, so that the first terminal signs the first random number using the first key fragment to obtain the first signature value, and the second terminal signs the second random number using the second key fragment to obtain the second signature value.

[0086] From this, it can be seen that if the first terminal needs to request to log in to a system, it can send a login request to the server related to the system. After receiving the login request, the server can generate two random numbers and then provide them to the first terminal and the second terminal respectively, so that the two terminals can generate their own signature values ​​based on their own random numbers and their own key fragments.

[0087] It should be noted that the first terminal encrypts the first random number through the first key fragment to obtain the first signature value, and the second terminal encrypts the second random number through the second key fragment to obtain the second signature value. In this way, the above-mentioned third signature value obtained by aggregation includes the first random number and the second random number. Alternatively, it can also be understood that: the third signature value is obtained by encrypting the first random number and the second random number through the target private key. Among them, the public key in the digital certificate and the target private key constitute a key pair, and the content encrypted by the target private key can be decrypted by the public key corresponding to it. In this way, by encrypting the third signature value with the public key in the digital certificate, two random numbers can be obtained; among them, if these two random numbers are respectively the same as the first random number and the second random number, it means that the third signature value has passed the verification.

[0088] Optionally, in the above step A-2, providing the first random number to the first terminal includes:

[0089] Send the first random number to the first terminal.

[0090] It is understandable that when the server knows the address information of the first terminal, the server can directly send the first random number to the first terminal. For example, when the first terminal is a visual network terminal and the server is a server of the visual network cloud desktop, the first terminal and the server are both in the visual network, and both know the address information of each other, so they can directly transmit information based on the address information of each other.

[0091] Optionally, in the above step A-2, providing the second random number to the second terminal includes:

[0092] Generate a first graphic code according to the second random number;

[0093] The first graphic code is sent to the first terminal, so that the first terminal displays the first graphic code, thereby enabling the second terminal to scan the first graphic code to obtain the second random number.

[0094] It can be seen that the server can generate the first graphic code according to the second random number and send it to the first terminal. In this way, after the first terminal displays the first graphic code, the second terminal can scan the first graphic code to obtain the second random number. In this way, even if the server does not know the address information of the second terminal, the second random number can be provided to the second terminal.

[0095] For example, when the second terminal is an Internet terminal and the server is a server of the VisionLink cloud desktop, the second terminal and the server are in different networks, and neither knows the address information of the other party, so they cannot directly transmit information based on the address information of the other party. In this case, the server can provide the second random number to the second terminal in the above manner.

[0096] It is understandable that if the server knows the address information of the second terminal, the server can send the second random number to the second terminal. For example, optionally, before the above step A-1, it also includes: based on the login request initiated by the first terminal, determining a second terminal that is an authorized login terminal belonging to the same account as the first terminal.

[0097] It can be seen that if the server receives a login request initiated by the first terminal, it can determine a second terminal that is an authorized terminal belonging to the same account as the first terminal, and then the server can directly send a second random number to the second terminal based on the address information of the second terminal.

[0098] Optionally, in the above step A-2, providing the first random number to the first terminal and providing the second random number to the second terminal includes:

[0099] Based on the login request, acquiring device information of the first terminal;

[0100] Verifying the device information of the first terminal;

[0101] When the device information of the first terminal passes the verification, the first random number is provided to the first terminal, and the second random number is provided to the second terminal.

[0102] The device information of the first terminal may be carried in the login request. Thus, after receiving the login request, the server may obtain the device information of the first terminal from the login request and then verify the device information of the first terminal.

[0103] In addition, if the server stores the device information of the first terminal, it means that the device information of the first terminal has passed the verification; if the server does not store the device information of the first terminal, it means that the device information of the first terminal has not passed the verification.

[0104] In addition, the server provides the first random number to the first terminal and the second random number to the second terminal only when the device information of the first terminal passes the verification, which can improve the security of the identity authentication process.

[0105] Optionally, before receiving the login request from the first terminal, the method further includes the following steps B-1 to B-6:

[0106] Step B-1: receiving registration information sent by the first terminal, wherein the registration information includes a user identifier;

[0107] Step B-2: Generate a target private key and digital certificate corresponding to the user identifier;

[0108] Step B-3: splitting the target private key into the first key fragment and the second key fragment;

[0109] Step B-4: sending the address information of the server to the first terminal, so that the first terminal provides the address information to the second terminal;

[0110] Step B-5: receiving the user identification sent by the second terminal according to the address information;

[0111] Step B-6: providing the first terminal with the first key fragment corresponding to the user identifier, and providing the second terminal with the second key fragment and the digital certificate corresponding to the user identifier.

[0112] The user identifier may be an identifier of a user corresponding to the account logged in on the second terminal.

[0113] In addition, in step B-3, the server may use a collaborative algorithm to split the target private key into a first key fragment and a second key fragment.

[0114] In the above step B-4, the server can generate a second graphic code according to its address information, and then send the second graphic code to the first terminal, so that after the first terminal displays the second graphic code, the second terminal can scan the second graphic code to obtain the address information of the server. In this way, the server can provide the address information of the second terminal to the second terminal without knowing the address information of the second terminal.

[0115] As can be seen from the above, before the first terminal requests to log in, the application for the key and digital certificate can be realized through the above registration process (i.e., steps B-1 to B-6) on the server. In this registration process, after the server generates the first key fragment, the second key fragment and the digital certificate, when receiving the user identification sent by the second terminal, the server can know the user bound to the first terminal and the second terminal, so that the first key fragment corresponding to the user identification can be provided to the first terminal, and the second key fragment and digital certificate corresponding to the user identification can be provided to the second terminal. This avoids the erroneous transmission of the key and digital certificate, thereby affecting the subsequent identity authentication.

[0116] Optionally, the registration information further includes a user password; the above step B-6, providing the first key fragment corresponding to the user identifier to the first terminal, includes:

[0117] Encrypting the first key fragment corresponding to the user identifier by using the user password to obtain first encrypted information;

[0118] The first encrypted information is sent to the first terminal, so that the first terminal decrypts the first encrypted information by using the user password to obtain the first key fragment.

[0119] It can be seen from this that the registration information may include a user password, and the server can encrypt the first key fragment using the user password to obtain first encrypted information, thereby sending the first encrypted information to the first terminal; in this way, the first key fragment is encrypted during transmission, thereby improving the security of the first key fragment during transmission.

[0120] It should be noted that the first terminal stores a user password, and after receiving the first encrypted information, the first terminal can use the user password to decrypt the first encrypted information, thereby obtaining the first key fragment.

[0121] The following specifically describes three ways in which the server provides the second key fragment and the digital certificate to the second terminal:

[0122] Method 1: Optionally, the registration information also includes a user password; in the above step B-6, providing the second key fragment corresponding to the user identifier to the second terminal includes the following steps C-1 to C-2:

[0123] Step C-1: Encrypting the second key fragment corresponding to the user identifier by using the user password to obtain second encrypted information;

[0124] Step C-2: providing the second encrypted information to the second terminal, so that the second terminal decrypts the second encrypted information using the user password to obtain the second key fragment.

[0125] It can be seen that the registration information may include a user password, and the server may also encrypt the second key fragment by the user password to obtain the second encrypted information, thereby providing the second encrypted information and the digital certificate to the second terminal. In this way, the second key fragment is encrypted during transmission, thereby improving the security of the second key fragment during transmission.

[0126] It should be noted that the second terminal stores a user password, and after receiving the second encrypted information, it can use the user password to decrypt the second encrypted information, thereby obtaining the second key fragment.

[0127] Method 2: In combination with the above method 1, further providing the second terminal with the second encryption information and the digital certificate includes:

[0128] generating a third graphic code according to the second encrypted information and the digital certificate;

[0129] The third graphic code is sent to the first terminal so that the first terminal displays the third graphic code, thereby enabling the second terminal to scan the third graphic code to obtain the second encrypted information and the digital certificate.

[0130] It can be seen that the server can generate a third graphic code based on the second encrypted information and the digital certificate, and then send it to the first terminal. In this way, after the first terminal displays the third graphic code, the second terminal can scan the third graphic code to obtain the second encrypted information and the digital certificate. In this way, even if the server does not know the address information of the second terminal, the second encrypted information and the digital certificate can be provided to the second terminal.

[0131] It can be understood that if the server knows the address information of the second terminal, the server can send the second encryption information and the digital certificate to the second terminal.

[0132] Mode 3: Optionally, the registration information further includes a user password; in the above step B-6, providing the second terminal with the second key fragment corresponding to the user identifier includes:

[0133] generating a fourth graphic code according to the second key fragment corresponding to the user identifier and the digital certificate;

[0134] The fourth graphic code is sent to the first terminal, so that the first terminal displays the fourth graphic code, thereby enabling the second terminal to scan the fourth graphic code to obtain the second key fragment and the digital certificate.

[0135] It can be seen that the server can generate the fourth graphic code according to the second key fragment and the digital certificate, and then send it to the first terminal. In this way, after the first terminal displays the fourth graphic code, the second terminal can scan the fourth graphic code to obtain the second key fragment and the digital certificate. In this way, even if the server does not know the address information of the second terminal, the second key fragment and the digital certificate can be provided to the second terminal.

[0136] It should be noted that the first graphic code, the second graphic code, the third graphic code, and the fourth graphic code in this article can all be one of a one-dimensional code and a two-dimensional code.

[0137] Second, as Figure 2 As shown, an embodiment of the present application provides an identity authentication method, which is applied to a server. The method may include the following steps 201 to 204:

[0138] Step 201: Send a login request to the server.

[0139] The system that the first terminal requests to log in is related to the above-mentioned server; that is, it can be understood that: the first terminal requests to log in to the server or the cloud desktop related to the server.

[0140] Step 202: Receive a first random number sent by the server.

[0141] After receiving the login request, the server generates a first random number and a second random number, and provides the first random number to the first terminal and the second random number to the second terminal.

[0142] Step 203: Sign the first random number using the first key fragment to obtain a first signature value.

[0143] Optionally, the first key fragment is stored on the first terminal (for example, a security chip may be provided on the first terminal, and the first key fragment may be stored in the security chip), so that when the first terminal requests login, the first signature value may be generated by the first key fragment.

[0144] Step 204: Send the first signature value to the server, so that the server performs identity authentication on the first terminal and the second terminal according to the first signature value and the received second signature value and digital certificate of the second terminal.

[0145] Among them, the second signature value is obtained by signing the second random number with a second key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0146] It can be seen that in the embodiment of the present application, the first key fragment and the second key fragment are obtained by dividing the target private key into different fragments; that is, it can be understood that the first key fragment and the second key fragment are different fragments of the target private key.

[0147] In addition, the digital certificate includes a public key, which forms a key pair with the target private key.

[0148] It can be seen from steps 201 to 204 that in an embodiment of the present application, if the first terminal needs to request to log in to a certain system, it can send a login request to a server related to the system. After receiving the login request, the server can generate a first random number and a second random number, and then provide the first random number to the first terminal, so that the first terminal signs the first random number through the first key fragment to obtain a first signature value, and the first terminal returns the first signature value to the server; and the second terminal signs the second random number through the second key fragment to obtain a second signature value, and the second terminal returns the second signature value and the digital certificate (that is, the digital certificate corresponding to the target private key to which the second key fragment belongs) to the server; in this way, the server can aggregate the first signature value and the second signature value to obtain a third signature value, thereby verifying the third signature value through the digital certificate, and when the third signature value passes the verification, it is determined that the identity authentication of the first terminal and the second terminal is successful.

[0149] It can be seen that in an embodiment of the present application, the target private key corresponding to the digital certificate can be split into a first key fragment and a second key fragment, so that the first terminal requesting login uses the first key fragment to obtain the first signature value, and the second terminal assisting in login authentication uses the second key fragment to obtain the second signature value. In this way, after the server obtains the first signature value, the second signature value and the digital certificate, it can aggregate the first signature value and the second signature value into a third signature value, thereby verifying the third signature value through the digital certificate.

[0150] Different terminals use different fragments of the same private key to obtain their own signature values. In this way, even if a key fragment is leaked or obtained by an attacker, the complete key cannot be obtained, thereby improving security. In addition, the server can authenticate the identity of each terminal by verifying the signature value after the aggregation of these signature values, which can simplify the authentication process and shorten the authentication time.

[0151] It can be seen from this that in an embodiment of the present application, when the first terminal requests to log in, it can use different key fragments of the same private key to obtain respective signature values ​​with the second terminal that assists in login authentication, so that the server can verify the signature value after the two signature values ​​are aggregated to achieve identity authentication of the first terminal and the second terminal. The entire identity authentication process is not only simple but also secure, thereby improving the business and data security in the system logged in by the first terminal.

[0152] Optionally, the method further comprises:

[0153] Obtaining a second random number provided by the server;

[0154] The second random number is provided to the second terminal.

[0155] It can be seen that the server can provide the second random number to the first terminal so that the first terminal provides the second random number to the second terminal. In this way, even if the server does not know the address information of the second terminal, it can still provide the second random number to the second terminal.

[0156] Optionally, obtaining a second random number provided by the server includes:

[0157] receiving a first graphic code sent by the server, wherein the first graphic code is generated according to the second random number;

[0158] The providing the second random number to the second terminal includes:

[0159] The first graphic code is displayed so that the second terminal scans the first graphic code to obtain the second random number.

[0160] It can be seen that the server can generate the first graphic code according to the second random number and send it to the first terminal. In this way, after the first terminal displays the first graphic code, the second terminal can scan the first graphic code to obtain the second random number. In this way, even if the server does not know the address information of the second terminal, the second random number can be provided to the second terminal.

[0161] It can be understood that if the server knows the address information of the second terminal, the server can send the second random number to the second terminal.

[0162] Optionally, before sending the login request to the server, the method further includes the following steps D-1 to D-4:

[0163] Step D-1: Sending registration information to the server, wherein the registration information includes a user identifier;

[0164] Step D-2: receiving the address information of the server sent by the server;

[0165] Step D-3: providing the address information to the second terminal, so that the second terminal sends the user identifier to the server according to the address information;

[0166] Step D-4: Obtain the first key fragment corresponding to the user identifier provided by the server.

[0167] Among them, after receiving the registration information, the server generates a target private key and digital certificate corresponding to the user identifier included in the registration information, thereby dividing the target private key into a first key fragment and a second key fragment, and provides the server's address information to the first terminal, so that the first terminal provides the server's address information to the second terminal, so that the second terminal can send the user identifier to the server based on the address information; thereafter, after receiving the user identifier, the server provides the second key fragment and digital certificate corresponding to the user identifier to the second terminal, and provides the first key fragment corresponding to the user identifier to the first terminal.

[0168] Optionally, the server can generate a second graphic code according to its address information, and then send the second graphic code to the first terminal, so that after the first terminal displays the second graphic code, the second terminal can scan the second graphic code to obtain the address information of the server. In this way, the server can provide the address information of the second terminal to the second terminal without knowing the address information of the second terminal.

[0169] As can be seen from the above, before the first terminal requests to log in, the application for the key and digital certificate can be realized through the above registration process (i.e., steps D-1 to D-4) on the server. In this registration process, after the server generates the first key fragment, the second key fragment and the digital certificate, when receiving the user identification sent by the second terminal, the server can know the user bound to the first terminal and the second terminal, so that the first key fragment corresponding to the user identification can be provided to the first terminal, and the second key fragment and digital certificate corresponding to the user identification can be provided to the second terminal. This avoids the erroneous transmission of the key and digital certificate, thereby affecting the subsequent identity authentication.

[0170] Optionally, in the above step D-4, obtaining the first key fragment corresponding to the user identifier provided by the server includes:

[0171] Receiving first encrypted information corresponding to the user identifier sent by the server;

[0172] The first encrypted information is encrypted using a user password to obtain the first key fragment.

[0173] Therefore, it can be seen that the server can encrypt the first key fragment through the user password to obtain the first encrypted information, and then send the first encrypted information to the first terminal; in this way, the first key fragment is encrypted during transmission, thereby improving the security of the first key fragment during transmission.

[0174] Optionally, the method further comprises:

[0175] Acquire the second key fragment and the digital certificate corresponding to the user identifier provided by the server;

[0176] The second terminal is provided with the second key fragment and the digital certificate corresponding to the user identification.

[0177] It can be seen from this that the server can also provide the second key fragment and the digital certificate to the first terminal, so that the first terminal provides the second key fragment and the digital certificate to the second terminal. In this way, even if the server does not know the address information of the second terminal, it can still provide the second key fragment and the digital certificate to the second terminal.

[0178] Optionally, the acquiring the second key fragment and the digital certificate corresponding to the user identifier provided by the server, and providing the second key fragment and the digital certificate corresponding to the user identifier to the second terminal includes one of the following items F-1 to F-3:

[0179] Item F-1: receiving a third graphic code sent by the server, and displaying the third graphic code, so that the second terminal scans the third graphic code to obtain the second encrypted information and the digital certificate, and decrypts the second encrypted information using the user password to obtain the second key fragment;

[0180] Item F-2: receiving the second encrypted information and the digital certificate sent by the server, and sending the second encrypted information and the digital certificate to the second terminal, so that the second terminal decrypts the second encrypted information by using the user password to obtain the second key fragment;

[0181] Item F-3: receiving a fourth graphic code sent by the server, and displaying the fourth graphic code, so that the second terminal scans the fourth graphic code to obtain the second key fragment and the digital certificate.

[0182] For item F-1, the server can first encrypt the second key fragment with the user password to obtain the second encrypted information, and then generate the third graphic code based on the second encrypted information and the digital certificate, so as to send the third graphic code to the first terminal, and the first terminal will display the third graphic code; in this way, after the second terminal scans the third graphic code, it will obtain the second encrypted information and the digital certificate, and then decrypt the second encrypted information with the user password to obtain the second key fragment. This method can increase the security of the second key fragment during transmission, and can provide the second key fragment and digital certificate to the second terminal when the server does not know the address information of the second terminal.

[0183] For item F-2, the server can encrypt the second key fragment by the user password to obtain the second encrypted information, and then send the second encrypted information and the digital certificate to the first terminal, which is then sent to the second terminal. In this way, after receiving the second encrypted information, the second terminal can encrypt the second key fragment by the user password. In this way, the second key fragment is encrypted during the transmission process of the second key fragment, thereby improving security.

[0184] For item F-1, the server can generate a fourth graphic code based on the second key fragment and the digital certificate, and then send it to the first terminal. In this way, after the first terminal displays the fourth graphic code, the second terminal can scan the fourth graphic code to obtain the second key fragment and the digital certificate. In this way, even if the server does not know the address information of the second terminal, the second key fragment and the digital certificate can be provided to the second terminal.

[0185] Thirdly, Figure 3 As shown, an embodiment of the present application provides an identity authentication method, which is applied to a second terminal. The method may include the following steps 301 to 303:

[0186] Step 301: Obtain a second random number provided by a server.

[0187] After receiving the login request from the first terminal, the server generates a first random number and a second random number, and provides the first random number to the first terminal and the second random number to the second terminal; after receiving the first random number, the first terminal signs the first random number using the first key fragment to obtain a first signature value.

[0188] Step 302: Sign the second random number using a second key fragment to obtain a second signature value.

[0189] Optionally, the second key fragment is stored in the second terminal, so that the second terminal can use the second key fragment to generate the second signature value.

[0190] Step 303: Send the second signature value and the digital certificate to the server, so that the server performs identity authentication on the second terminal and the first terminal according to the second signature value and the digital certificate, and the first signature value of the first terminal.

[0191] Among them, the first signature value is obtained by signing the first random number with a first key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0192] It can be seen that in the embodiment of the present application, the first key fragment and the second key fragment are obtained by dividing the target private key into different fragments; that is, it can be understood that the first key fragment and the second key fragment are different fragments of the target private key.

[0193] In addition, the digital certificate includes a public key, which forms a key pair with the target private key.

[0194] It can be seen from steps 301 to 303 that in an embodiment of the present application, if the first terminal needs to request to log in to a certain system, it can send a login request to a server related to the system. After receiving the login request, the server can generate a first random number and a second random number, and then provide the first random number to the first terminal, so that the first terminal signs the first random number through the first key fragment to obtain a first signature value, and the first terminal returns the first signature value to the server; and the second terminal signs the second random number through the second key fragment to obtain a second signature value, and the second terminal returns the second signature value and the digital certificate (that is, the digital certificate corresponding to the target private key to which the second key fragment belongs) to the server; in this way, the server can aggregate the first signature value and the second signature value to obtain a third signature value, thereby verifying the third signature value through the digital certificate, and when the third signature value passes the verification, it is determined that the identity authentication of the first terminal and the second terminal is successful.

[0195] It can be seen that in an embodiment of the present application, the target private key corresponding to the digital certificate can be split into a first key fragment and a second key fragment, so that the first terminal requesting login uses the first key fragment to obtain the first signature value, and the second terminal assisting in login authentication uses the second key fragment to obtain the second signature value. In this way, after the server obtains the first signature value, the second signature value and the digital certificate, it can aggregate the first signature value and the second signature value into a third signature value, thereby verifying the third signature value through the digital certificate.

[0196] Different terminals use different fragments of the same private key to obtain their own signature values. In this way, even if a key fragment is leaked or obtained by an attacker, the complete key cannot be obtained, thereby improving security. In addition, the server can authenticate the identity of each terminal by verifying the signature value after the aggregation of these signature values, which can simplify the authentication process and shorten the authentication time.

[0197] It can be seen from this that in an embodiment of the present application, when the first terminal requests to log in, it can use different key fragments of the same private key to obtain respective signature values ​​with the second terminal that assists in login authentication, so that the server can verify the signature value after the two signature values ​​are aggregated to achieve identity authentication of the first terminal and the second terminal. The entire identity authentication process is not only simple but also secure, thereby improving the business and data security in the system logged in by the first terminal.

[0198] Optionally, in the above step 301, obtaining the second random number provided by the server includes:

[0199] Scan the first graphic code to obtain the second random number;

[0200] Wherein, the first graphic code is generated according to the second random number.

[0201] It can be seen that the server can generate the first graphic code according to the second random number and send it to the first terminal. In this way, after the first terminal displays the first graphic code, the second terminal can scan the first graphic code to obtain the second random number. In this way, even if the server does not know the address information of the second terminal, the second random number can be provided to the second terminal.

[0202] It can be understood that if the server knows the address information of the second terminal, the server can send the second random number to the second terminal.

[0203] Optionally, before obtaining the second random number provided by the server, the method further includes:

[0204] Acquire address information of the server provided by the first terminal;

[0205] The user identification is sent to the server according to the address information, so that the server provides the first key fragment corresponding to the user identification to the first terminal, and provides the second key fragment and the digital certificate corresponding to the user identification to the second terminal.

[0206] Among them, after the server receives the registration information of the first terminal, it generates a target private key and digital certificate corresponding to the user identifier included in the registration information, thereby dividing the target private key into a first key fragment and a second key fragment, and provides the server's address information to the first terminal, so that the first terminal provides the server's address information to the second terminal, so that the second terminal can send the user identifier to the server based on the address information; thereafter, after receiving the user identifier, the server provides the second key fragment and digital certificate corresponding to the user identifier to the second terminal, and provides the first key fragment corresponding to the user identifier to the first terminal.

[0207] Optionally, the server can generate a second graphic code according to its address information, and then send the second graphic code to the first terminal, so that after the first terminal displays the second graphic code, the second terminal can scan the second graphic code to obtain the address information of the server. In this way, the server can provide the address information of the second terminal to the second terminal without knowing the address information of the second terminal.

[0208] As can be seen from the above, before the first terminal requests to log in, the application for the key and digital certificate can be realized through the above registration process on the server. In this registration process, after the server generates the first key fragment, the second key fragment and the digital certificate, when receiving the user identification sent by the second terminal, the server can know the user bound to the first terminal and the second terminal, so that the first key fragment corresponding to the user identification can be provided to the first terminal, and the second key fragment and digital certificate corresponding to the user identification can be provided to the second terminal. This avoids the erroneous transmission of the key and digital certificate, thereby affecting the subsequent identity authentication.

[0209] Optionally, the method further comprises:

[0210] Scanning the third graphic code displayed by the first terminal to obtain second encrypted information and a digital certificate, and decrypting the second encrypted information using the user password to obtain a second key fragment;

[0211] or,

[0212] Scanning the fourth graphic code displayed by the first terminal to obtain a second key fragment and a digital certificate;

[0213] or,

[0214] The second encrypted information and the digital certificate sent by the first terminal are received, and the second encrypted information is decrypted using the user password to obtain a second key fragment.

[0215] It can be seen that the server can also first encrypt the second key fragment with the user password to obtain the second encrypted information, and then generate the third graphic code according to the second encrypted information and the digital certificate, so as to send the third graphic code to the first terminal, and the first terminal will display the third graphic code; in this way, after the second terminal scans the third graphic code, it will obtain the second encrypted information and the digital certificate, and then decrypt the second encrypted information with the user password to obtain the second key fragment. This method can increase the security of the second key fragment during transmission, and can provide the second key fragment and digital certificate to the second terminal when the server does not know the address information of the second terminal.

[0216] Alternatively, the server may also encrypt the second key fragment using the user password to obtain the second encrypted information, and then send the second encrypted information and the digital certificate to the first terminal, which is then sent to the second terminal. In this way, after receiving the second encrypted information, the second terminal may encrypt the second key fragment using the user password. In this way, the second key fragment is encrypted during the transmission of the second key fragment, thereby improving security.

[0217] or,

[0218] The server can generate a fourth graphic code based on the second key fragment and the digital certificate, and then send it to the first terminal. In this way, after the first terminal displays the fourth graphic code, the second terminal can scan the fourth graphic code to obtain the second key fragment and the digital certificate. In this way, even if the server does not know the address information of the second terminal, the second key fragment and the digital certificate can be provided to the second terminal.

[0219] In summary, when the identity authentication method of the embodiment of the present application is applied to the visual network, the specific implementation method is shown in Figures 4 to 6 , which can be described as follows:

[0220] Before the VisionNet terminal remotely logs in to the VisionNet cloud desktop system for identity authentication, it is necessary to first register as a user and apply for a key and digital certificate. Figure 5 As shown, the process is as follows:

[0221] (1) The video network terminal sends registration information to the video network cloud desktop system, where the registration information includes user identification, user password, and device information of the video network terminal (such as video network number information);

[0222] (2) After receiving the registration information, the VisionCloud Desktop System generates an SM2 signature public-private key pair and a digital certificate corresponding to the user ID, and uses a collaborative algorithm to split the signature private key into a first key fragment and a second key fragment;

[0223] (3) The Vision Cloud Desktop System returns the communication address QR code-1 to the Vision Network Terminal, displays the QR code-1, and prompts the user to scan the code to bind the mobile phone;

[0224] (4) Scan the QR code-1 displayed on the Vision Network terminal with a mobile phone to obtain the communication address, and then send the user identification to the Vision Network cloud desktop system according to the communication address;

[0225] (5) The Vision Cloud Desktop System encrypts the second key fragment using the user password to obtain second encrypted information, and generates a QR code-2 based on the second encrypted information and the digital certificate, thereby returning the QR code-2 to the Vision Network Terminal, prompting the user to scan the QR code-2;

[0226] (6) Scan QR code-2 with a mobile phone to obtain the second encrypted information and the digital certificate, and decrypt the second encrypted information with the user password to obtain the second key fragment, thereby storing the second key fragment and the digital certificate in the local soft password module of the mobile phone;

[0227] (7) The visual network cloud desktop system encrypts the first key fragment using the user password to obtain first encrypted information, and sends the first encrypted information to the visual network terminal;

[0228] (8) After receiving the first encrypted information, the visual networking terminal decrypts the first encrypted information using the user password to obtain a first key fragment, and stores the first key fragment in a built-in security chip of the visual networking terminal.

[0229] At this point, the user registration and key and certificate application process is completed. The specific identity authentication process when logging in is as follows: Figure 6 As shown, the details are as follows:

[0230] (1) The video connection terminal sends a remote login cloud desktop request to the video connection cloud desktop system, wherein the login request includes device information of the video connection terminal;

[0231] (2) The Vision Cloud Desktop System verifies the device information, and after the device information is verified, generates a first random number and a second random number, generates a QR code-3 based on the second random number, and returns the QR code-3 and the second random number to the Vision Network Terminal, prompting the user to scan the code for authentication;

[0232] (3) Scan QR code-3 with a mobile phone to obtain a second random number, and use the second key fragment to sign the second random number to obtain a second signature value, thereby returning the second signature value and the digital certificate to the VisionLink cloud desktop system;

[0233] (4) The video connection terminal uses the first key fragment to sign the first random number to obtain a first signature value, and returns the first signature value to the video connection cloud desktop system;

[0234] (6) After receiving the two signature value fragments, the Vision Cloud Desktop System uses an aggregation algorithm to synthesize the two signature values ​​into a complete signature value, and uses the received digital certificate to verify the user's signature value information and the validity of the certificate. If the verification is successful, the identity authentication of the Vision Network Terminal and the mobile phone is successful;

[0235] (7) After identity authentication is passed, the visual network terminal displays the corresponding desktop system and applications.

[0236] It can be seen that in this implementation, based on the fact that the visual Internet terminal is integrated with a security chip and a cloud desktop business application process, an identity authentication solution for the visual Internet terminal to access the visual cloud desktop system is proposed, that is, a solution of collaborative signing between the visual Internet terminal and the user's mobile phone is used to realize the identity authentication of the visual terminal's remote access to the visual cloud desktop system, which can effectively ensure the secure access to the visual cloud desktop system's business and data, and enhance the market competitiveness of visual Internet products and services.

[0237] In a fourth aspect, an embodiment of the present application provides an identity authentication device, which is applied to a server, such as Figure 7 As shown, the device may include the following modules:

[0238] A first acquisition module 701 is configured to, upon receiving a login request initiated by a first terminal, acquire a first signature value of the first terminal, a second signature value of the second terminal, and a digital certificate, wherein the first signature value is obtained by signing a first key fragment, the second signature value is obtained by signing a second key fragment, the digital certificate corresponds to a target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals of the same account;

[0239] A processing module 702 is used to aggregate the first signature value and the second signature value to obtain a third signature value;

[0240] A verification module 703, configured to verify the third signature value through the digital certificate;

[0241] The determination module 704 is configured to determine that the identity authentication of the first terminal and the second terminal is successful if the third signature value passes the verification.

[0242] Optionally, the device further comprises:

[0243] A first generating module, used to generate a first random number and a second random number;

[0244] The first providing module is used to provide the first random number to the first terminal, and provide the second random number to the second terminal, so that the first terminal signs the first random number by using the first key fragment to obtain the first signature value, and the second terminal signs the second random number by using the second key fragment to obtain the second signature value.

[0245] Optionally, the first providing module provides the second random number to the second terminal, specifically for:

[0246] Generate a first graphic code according to the second random number;

[0247] The first graphic code is sent to the first terminal, so that the first terminal displays the first graphic code, thereby enabling the second terminal to scan the first graphic code to obtain the second random number.

[0248] Optionally, the device further comprises:

[0249] A second receiving module, configured to receive registration information sent by the first terminal, wherein the registration information includes a user identifier;

[0250] A second generating module, used to generate a target private key and a digital certificate corresponding to the user identifier;

[0251] a splitting module, configured to split the target private key into the first key fragment and the second key fragment;

[0252] a third sending module, configured to send the address information of the server to the first terminal, so that the first terminal provides the address information to the second terminal;

[0253] The second receiving module is further configured to receive the user identification sent by the second terminal according to the address information;

[0254] The second providing module is configured to provide the first key fragment corresponding to the user identifier to the first terminal, and provide the second key fragment and the digital certificate corresponding to the user identifier to the second terminal.

[0255] In a fifth aspect, an embodiment of the present application provides an identity authentication device, which is applied to a first terminal, such as Figure 8 As shown, the device may include the following modules:

[0256] The first sending module 801 is used to send a login request to the server;

[0257] A first receiving module 802, configured to receive a first random number sent by the server;

[0258] A first signature module 803, configured to sign the first random number using a first key fragment to obtain a first signature value;

[0259] The first sending module 801 is further used to: send the first signature value to the server, so that the server performs identity authentication on the first terminal and the second terminal according to the first signature value, and the received second signature value and digital certificate of the second terminal;

[0260] Among them, the second signature value is obtained by signing the second random number with a second key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0261] Optionally, the device further comprises:

[0262] A third acquisition module, used to acquire a second random number provided by the server;

[0263] A third providing module is configured to provide the second random number to the second terminal.

[0264] Optionally, the first sending module 801 is further used to: send registration information to the server, wherein the registration information includes a user identifier;

[0265] The first receiving module 802 is further used to: receive the address information of the server sent by the server;

[0266] The device also includes:

[0267] a fourth providing module, configured to provide the address information to the second terminal, so that the second terminal sends the user identifier to the server according to the address information;

[0268] A fourth acquisition module is used to acquire the first key fragment corresponding to the user identifier provided by the server.

[0269] Optionally, the device further comprises:

[0270] A fifth acquisition module, configured to acquire the second key fragment and the digital certificate corresponding to the user identifier provided by the server;

[0271] A fifth providing module is used to provide the second terminal with the second key fragment and the digital certificate corresponding to the user identification.

[0272] In a sixth aspect, an embodiment of the present application provides an identity authentication device, which is applied to a second terminal, such as Fig. 9As shown, the device may include the following modules:

[0273] A second acquisition module 901 is used to acquire a second random number provided by the server;

[0274] A second signature module 902, configured to sign the second random number using a second key fragment to obtain a second signature value;

[0275] A second sending module 903 is used to send the second signature value and the digital certificate to the server, so that the server performs identity authentication on the second terminal and the first terminal according to the second signature value and the digital certificate and the first signature value of the first terminal;

[0276] Among them, the first signature value is obtained by signing the first random number with a first key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

[0277] Optionally, the second acquisition module 901 is further used to: acquire address information of the server provided by the first terminal;

[0278] The second sending module 903 is further used to: send a user identifier to the server according to the address information, so that the server provides the first key fragment corresponding to the user identifier to the first terminal, and provides the second key fragment and the digital certificate corresponding to the user identifier to the second terminal.

[0279] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0280] In the seventh aspect, an embodiment of the present application also provides an identity authentication system, including a server, a first terminal and a second terminal; the server is used to execute the identity authentication method described in the first aspect above, the first terminal is used to execute the identity authentication method described in the second aspect above, and the second terminal is used to execute the identity authentication method described in the third aspect above.

[0281] In an eighth aspect, an embodiment of the present application further provides an electronic device, including:

[0282] one or more processors; and

[0283] One or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, cause the electronic device to execute the identity authentication method described in the first aspect above, or execute the identity authentication method described in the second aspect above, or execute the identity authentication method described in the third aspect above.

[0284] In the ninth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that enables a processor to execute the identity authentication method described in the first aspect above, or execute the identity authentication method described in the second aspect above, or execute the identity authentication method described in the third aspect above.

[0285] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0286] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0287] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0288] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0289] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0290] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0291] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0292] The above is a detailed introduction to an identity authentication method, device and electronic device provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An identity authentication method, characterized in that: The method comprises: Upon receiving a login request initiated by a first terminal, obtaining a first signature value of the first terminal, a second signature value of the second terminal, and a digital certificate, wherein the first signature value is obtained by signing a first key fragment, the second signature value is obtained by signing a second key fragment, the digital certificate corresponds to a target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals of the same account; Aggregate the first signature value and the second signature value to obtain a third signature value; Verifying the third signature value by using the digital certificate; When the third signature value passes the verification, it is determined that the identity authentication of the first terminal and the second terminal is successful.

2. The method according to claim 1, characterized in that Before obtaining the first signature value of the first terminal, the second signature value of the second terminal, and the digital certificate, the method further includes: Generate a first random number and a second random number; The first random number is provided to the first terminal, and the second random number is provided to the second terminal, so that the first terminal signs the first random number by using the first key fragment to obtain the first signature value, and the second terminal signs the second random number by using the second key fragment to obtain the second signature value.

3. The method according to claim 1 or 2, characterized in that: Before receiving the login request from the first terminal, the method further includes: receiving registration information sent by the first terminal, wherein the registration information includes a user identifier; Generate a target private key and a digital certificate corresponding to the user identification; Splitting the target private key into the first key fragment and the second key fragment; Sending address information of the server to the first terminal, so that the first terminal provides the address information to the second terminal; receiving the user identification sent by the second terminal according to the address information; The first key fragment corresponding to the user identifier is provided to the first terminal, and the second key fragment and the digital certificate corresponding to the user identifier are provided to the second terminal.

4. An identity authentication method, characterized in that: Applied to a first terminal, the method includes: Send a login request to the server; Receiving a first random number sent by the server; Signing the first random number using a first key fragment to obtain a first signature value; Sending the first signature value to the server, so that the server performs identity authentication on the first terminal and the second terminal according to the first signature value and the received second signature value and digital certificate of the second terminal; Among them, the second signature value is obtained by signing the second random number with a second key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

5. An identity authentication method, characterized in that: Applied to the second terminal, the method includes: Get the second random number provided by the server; Signing the second random number using a second key fragment to obtain a second signature value; Sending the second signature value and the digital certificate to the server, so that the server authenticates the second terminal and the first terminal according to the second signature value and the digital certificate, and the first signature value of the first terminal; Among them, the first signature value is obtained by signing the first random number with a first key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

6. An identity verification device, characterized in that: Applied to a server, the device comprises: A first acquisition module is configured to, upon receiving a login request initiated by a first terminal, acquire a first signature value of the first terminal, a second signature value of the second terminal, and a digital certificate, wherein the first signature value is obtained by signing a first key fragment, the second signature value is obtained by signing a second key fragment, the digital certificate corresponds to a target private key, the first key fragment and the second key fragment are different fragments of the target private key, and the second terminal and the first terminal are authorized login terminals of the same account; A processing module, configured to aggregate the first signature value and the second signature value to obtain a third signature value; A verification module, used to verify the third signature value through the digital certificate; A determination module is used to determine that the identity authentication of the first terminal and the second terminal is successful when the third signature value passes the verification.

7. An identity verification device, characterized in that: Applied to a first terminal, the device includes: A first sending module, used for sending a login request to a server; A first receiving module, used for receiving a first random number sent by the server; A first signature module, used to sign the first random number using a first key fragment to obtain a first signature value; The first sending module is further used to: send the first signature value to the server, so that the server performs identity authentication on the first terminal and the second terminal according to the first signature value, and the received second signature value and digital certificate of the second terminal; Among them, the second signature value is obtained by signing the second random number with a second key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

8. An identity verification device, characterized in that: Applied to a second terminal, the device includes: A second acquisition module, used to acquire a second random number provided by the server; A second signature module, used to sign the second random number using a second key fragment to obtain a second signature value; a second sending module, configured to send the second signature value and the digital certificate to the server, so that the server performs identity authentication on the second terminal and the first terminal according to the second signature value and the digital certificate, and the first signature value of the first terminal; Among them, the first signature value is obtained by signing the first random number with a first key fragment, the first key fragment and the second key fragment are different fragments of the target private key, the digital certificate corresponds to the target private key, and the second terminal and the first terminal are authorized login terminals of the same account.

9. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, cause the electronic device to execute the identity authentication method as described in any one of claims 1 to 3, or execute the identity authentication method as described in claim 4, or execute the identity authentication method as described in claim 5.

10. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the identity authentication method as described in any one of claims 1 to 3, or execute the identity authentication method as described in claim 4, or execute the identity authentication method as described in claim 5.

Images