Identity authentication method, server side, and client side

Abstract

This application relates to the field of computers, and particularly to an identity authentication method, a server side, and a client side. The method includes: receiving a first authentication message sent by the client; wherein, the first authentication message is generated based on a first encrypted message, an identity identifier ID input by the user, and a first timestamp of the client at present. The first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and a first random challenge number based on a first secret key generated from a password input by the user; determining whether the identity of the client is authenticated successfully based on the first authentication information. The present invention adopts double authentication factors of a timestamp and a random challenge number, effectively improving the security of client authentication and avoiding the illegal use and loss of security videos. In addition, encryption is performed using an encryption algorithm, which also ensures the security during the data transmission process.

Description

Technical Field

[0001] The present application relates to the field of computers, and particularly to an identity authentication method, a server side, and a client side. Background Art

[0002] In the current security video security management system, in each link from login to obtaining security videos, a static authentication method of "username + password" is mostly used to determine the legitimacy of the user's identity. This identity management mode cannot guarantee the legitimacy and uniqueness of the user, and it is easy to cause the illegal use and loss of security videos. Summary of the Invention

[0003] Based on this, it is necessary to provide an identity authentication method, a server side, and a client side for the above technical problems.

[0004] In a first aspect, an embodiment of the present invention provides an identity authentication method, which is applied to a server side, and the server side communicates with a client side. The method includes:

[0005] Receiving a first authentication message sent by the client side; wherein, the first authentication message is generated based on a first encrypted message, an identity identifier ID input by a user, and a first timestamp of the client side at present. The first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and a first random challenge number based on a first secret key generated from a password input by the user.

[0006] Determining whether the identity of the client side is authenticated successfully based on the first authentication information.

[0007] In an embodiment, the determining whether the identity of the client side is authenticated successfully based on the first authentication information includes:

[0008] If the time interval between the time when the server side receives the first authentication information and the time of the first timestamp is less than a set time, and the identity identifier ID exists in the user list of the database of the server side, then based on the first secret key, decrypting the first authentication information to obtain the decrypted identity identifier ID, the first random challenge number, and the first timestamp;

[0009] If the decrypted identity identifier ID and the first timestamp are respectively the same as the identity identifier ID and the first timestamp before encryption, it is determined that the identity authentication of the client side is successful.

[0010] In an embodiment, the method further includes:

[0011] When it is determined that the identity authentication of the client has passed, a second authentication message for determining whether the server is legal is generated based on the current second timestamp of the server and the second encrypted message, and the second authentication message is sent to the client; wherein, the second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on the second secret key generated from the decryption result of the first secret key and the second random challenge number.

[0012] In one embodiment, the method further includes:

[0013] When the server is legal, a feedback message sent by the client is received, wherein the feedback message is generated based on a third encrypted message and the current third timestamp of the client, and the third encrypted message is generated by using an encryption algorithm to encrypt the third timestamp and the decryption result of the second random challenge number based on the third secret key generated from the first secret key and the decryption result of the second random challenge number.

[0014] An identity authentication result is determined based on the feedback message and sent to the client.

[0015] In a second aspect, an embodiment of the present invention provides an identity authentication method applied to a client, where the client communicates with a server, and the method includes:

[0016] A first authentication message is generated based on a first encrypted message, an identity identifier ID input by a user, and the current first timestamp of the client, wherein the first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and the first random challenge number based on the first secret key generated from the password input by the user.

[0017] The first authentication message is sent to the server to determine whether the identity of the client is authenticated based on the first authentication information.

[0018] In one embodiment, the method further includes:

[0019] Based on the second authentication message sent by the server, it is determined whether the server is legal, wherein

[0020] the second authentication message is generated based on the current second timestamp of the server and the second encrypted message when it is determined that the identity authentication of the client has passed, and the second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on the second secret key generated from the decryption result of the first secret key and the second random challenge number.

[0021] When the server side is legal, send a feedback message to the server side.

[0022] In one embodiment, determining whether the server side is legal based on the second authentication message sent by the server side includes:

[0023] If the time interval between the time when the client receives the second authentication information and the time of the second timestamp is less than the set time, then based on the second secret key, decrypt the second authentication information to obtain the decrypted second random challenge number, the second timestamp, and the first random challenge number decrypted again;

[0024] If the decrypted second timestamp and the first random challenge number decrypted again are the same as the second timestamp and the first random challenge number before encryption respectively, determine that the server side is legal.

[0025] In one embodiment, the method further includes:

[0026] Receive the identity authentication result of the server side, where the identity authentication result is determined based on the feedback message, and the feedback message is generated based on the third encryption message and the current third timestamp of the client, and the third encryption message is generated based on the third secret key generated by decrypting the first secret key and the second random challenge number, and encrypting the third timestamp and the decryption result of the second random challenge number using an encryption algorithm.

[0027] In a third aspect, an embodiment of the present invention proposes a server side, including:

[0028] A first data transmission module, configured to receive the first authentication message sent by the client; where the first authentication message is generated based on a first encryption message, an identity identifier ID input by a user, and a current first timestamp of the client, and the first encryption message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and the first random challenge number based on a first secret key generated by a password input by the user;

[0029] A first authentication module, configured to determine whether the identity of the client passes authentication based on the first authentication information.

[0030] In a fourth aspect, an embodiment of the present invention proposes a client, including:

[0031] A first generation module, configured to generate a first authentication message based on a first encryption message, an identity identifier ID input by a user, and a current first timestamp of the client, where the first encryption message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and the first random challenge number based on a first secret key generated by a password input by the user;

[0032] The second data transmission module is configured to send the first authentication message to the server side to determine whether the identity of the client is authenticated based on the first authentication information.

[0033] In the above embodiment, by adopting the dual authentication factors of timestamp and random challenge number, the security of client authentication is effectively improved, and the illegal use and loss of security videos are avoided. In addition, the use of an encryption algorithm for encryption also ensures the security during the data transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a diagram of the application environment of the identity authentication method in an embodiment of the present invention;

[0035] Figure 2 It is a flowchart of the identity authentication method in an embodiment of the present invention;

[0036] Figure 3 It is a flowchart of the method for determining whether the identity of the client is authenticated in an embodiment of the present invention;

[0037] Figure 4 It is a flowchart of the identity authentication method in another embodiment of the present invention;

[0038] Figure 5 It is a flowchart of the identity authentication method in yet another embodiment of the present invention;

[0039] Figure 6 It is a flowchart of the identity authentication method in an embodiment of the present invention;

[0040] Figure 7 It is a flowchart of the identity authentication method in another embodiment of the present invention;

[0041] Figure 8 It is a flowchart of the two-way authentication method in an embodiment of the present invention;

[0042] Figure 9 It is a schematic structural diagram of the server side in an embodiment of the present invention;

[0043] Figure 10 It is a schematic structural diagram of the client in an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0044] In order to make the objectives, technical solutions and advantages of the present application more clear and understandable, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] Figure 1 It is a schematic structural diagram of the identity authentication system, as Figure 1As shown in the figure, the identity authentication system includes a server side 101 and at least one client side 102, and the server side 101 communicates with the client side 102. The server side 101 and the client side 102 can communicate through a local area network, or other communication methods can be used to achieve communication.

[0046] In an embodiment, as Figure 2 shown, an identity authentication method is proposed, and this method can be applied to a server side as Figure 1 shown, including the following steps:

[0047] [[ID=]]S201: Receive a first authentication message sent by the client.

[0048] Among them, the first authentication message is generated based on a first encrypted message, an identity identifier ID input by the user, and a first timestamp of the client at present. The first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and a first random challenge number based on a first secret key generated from the password input by the user.

[0049] It should be noted that the password can be a static password or a dynamic password. Considering that the static password is easy to be forgotten, guessed or even brute-forced, the dynamic password is preferably adopted in this embodiment.

[0050] S202: Determine whether the identity of the client is authenticated successfully based on the first authentication information.

[0051] In this embodiment, the double authentication factors of timestamp and random challenge number are adopted, which effectively improves the security of client authentication and avoids the illegal use and loss of security videos. In addition, the encryption algorithm is used for encryption, which also guarantees the security during the data transmission process.

[0052] The user inputs an identity identifier ID and a password pw. The generation method of the first authentication information is: extract the first timestamp T1 of the current client, calculate the discrete column value K1 = h(pw) for the password pw, and generate a first random challenge number Rc. Use K1 as the first symmetric secret key and use the encryption algorithm ID||Rc||T1 to obtain the first authentication information {ID, K1(ID||Rc||T1), T1}, and send this first authentication information to the server side.

[0053] In an embodiment, as Figure 3 shown, determining whether the identity of the client is authenticated successfully based on the first authentication information includes the following steps:

[0054] S301: If the time interval between the time when the server receives the first authentication information and the first timestamp is less than the set time, and the identity ID exists in the user list of the server's database, then based on the first secret key, decrypt the first authentication information to obtain the decrypted identity ID, the first random challenge number, and the first timestamp;

[0055] S302: If the decrypted identity ID and the first timestamp are the same as the identity ID and the first timestamp before encryption respectively, then determine that the identity authentication of the client passes.

[0056] In step S301, the time interval between the time when the server receives the first authentication information and the first timestamp and the identity ID are used for preliminary authentication. In the case of failed preliminary authentication, step S302 is not executed. In the case of passed preliminary authentication, step S302 is executed to perform re - authentication using the decrypted identity ID, the first random challenge number, and the first timestamp, ensuring the security and accuracy of the client identity authentication.

[0057] The client identity authentication method specifically includes the following steps:

[0058] Step 1: Check the time interval. If T1* - T1 ≤ ΔT, where T1* represents the time when the server receives the first authentication information {ID, K1(ID||Rc||T1), T1}, then execute Step 2; otherwise, the authentication fails.

[0059] Step 2: Search the server's database and query whether the identity ID exists in the user list of the authentication data. If it does not exist, the authentication fails. If it appears more than three times, lock the user; otherwise, execute Step 3.

[0060] Step 3: If the identity ID exists, take out the password hash value h(pw) corresponding to the identity ID as the secret key of the current encryption algorithm, and decrypt K1(ID||Rc||T1) to obtain ID′, Rc′ and T1′.

[0061] Step 4: Verify whether the unencrypted ID and the decrypted ID′ are the same. If they are different, the authentication fails; if they are the same, execute Step 5.

[0062] Step 5: Verify whether the unencrypted timestamp T1 and the decrypted timestamp T1′ are the same. If they are different, the authentication fails; if they are the same, the identity authentication of the client passes.

[0063] In another embodiment, the server sends a second authentication message to the client to determine whether the server is legal, thereby implementing two - way authentication between the client and the server.

[0064] In this embodiment, asFigure 4 As shown, the identity authentication method further includes the following steps:

[0065] S303: When it is determined that the identity authentication of the client has passed, generate a second authentication message for determining whether the server is legal based on the current second timestamp of the server and the second encrypted message, and send the second authentication message to the client.

[0066] Among them, the second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on the second secret key generated from the decryption result of the first secret key and the second random challenge number.

[0067] Specifically, the server extracts the current second timestamp T2, generates a second random challenge number Rs, calculates the second secret key K2 = h(h(pw) || Rc′), and uses the symmetric encryption algorithm to encrypt Rc′ || Rs || T2 with K2 as the symmetric secret key; the server sends the second authentication message {K2(Rc′ || Rs || T2), T2} to the client.

[0068] In another embodiment, as Figure 5 shown, the method further includes:

[0069] S304: When the server is legal, receive the feedback message sent by the client.

[0070] Among them, the feedback message is generated based on the third encrypted message and the current third timestamp of the client. The third encrypted message is generated by using an encryption algorithm to encrypt the third timestamp and the decryption result of the second random challenge number based on the third secret key generated from the first secret key and the decryption result of the second random challenge number;

[0071] Specifically, the client extracts the current third timestamp T3, calculates the third secret key K3 = h(h(pw) || Rs′), and uses the symmetric encryption algorithm to encrypt Rs′ || T3 with K3 as the symmetric secret key. The client sends the feedback message {K3(Rs′ || T3), T3} to the server.

[0072] S305: Determine and generate an identity authentication result based on the feedback message and send it to the client.

[0073] When the server receives the feedback message {K3(Rs′ || T3), T3} replied by the client at time T3 * , perform the following steps for verification:

[0074] Step 1: Check the validity of the time interval. If T3* - T3 ≤ ΔT, the server accepts the feedback message replied by the client; otherwise, it rejects the reply message.

[0075] Step 2: Calculate the third secret key K3 = h(h(pw) || Rs) through h(pw) and the Rs of the second random challenge number, and decrypt the message K3(Rs′ || T3) with K3 to obtain the second random challenge number Rs″ after re-decryption and the decrypted third timestamp T′3;

[0076] Step 3: Verify whether the unencrypted third timestamp T3 is the same as the decrypted third timestamp T′3; if they are different, the authentication fails; if they are the same, proceed to Step 4;

[0077] Step 4: Verify whether the second random challenge number Rs″ after re-decryption is the same as the second random challenge number Rs; if they are the same, the server passes the authentication;

[0078] Step 5: The server calculates the fourth secret key K4 = h(h(pw) || Rc || Rs) as the session key between the client and the server, and sends the current identity authentication result {K4(Rc || Rs || result)} to the client;

[0079] where result is the authentication result, result = 1 indicates successful authentication, and result = 0 indicates failed authentication.

[0080] In one embodiment, as Figure 6 shown, an identity authentication method is proposed, and this method can be applied to a client as Figure 1 shown, including the following steps:

[0081] S601: Generate a first authentication message based on the first encrypted message, the identity identifier ID input by the user, and the first timestamp of the client.

[0082] Among them, the first encrypted message is generated by encrypting the identity identifier ID, the first timestamp, and the first random challenge number using an encryption algorithm based on the first secret key generated from the password input by the user.

[0083] The generation method of the first authentication message has been described in the above embodiment, so it will not be elaborated here.

[0084] S602: Send the first authentication message to the server to determine whether the identity of the client is authenticated successfully based on the first authentication information.

[0085] The identity authentication method of the client has been described in the above embodiment, so it will not be elaborated here.

[0086] In this embodiment, dual authentication factors of a timestamp and a random challenge number are adopted, effectively improving the security of client authentication and avoiding the illegal use and leakage of security videos. In addition, an encryption algorithm is used for encryption, which also ensures the security during the data transmission process.

[0087] In another embodiment, as Figure 7 shown, the method further includes:

[0088] S603: Based on the second authentication message sent by the server side, determine whether the server side is legal.

[0089] Wherein, the second authentication message is generated based on the current second timestamp and the second encrypted message of the server side in the case that the identity authentication of the client is passed. The second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on the second secret key generated from the decryption result of the first secret key and the second random challenge number.

[0090] S604: When the server side is legal, send a feedback message to the server side.

[0091] Wherein, determining whether the server side is legal based on the second authentication message sent by the server side is: if the time interval between the time when the client receives the second authentication information and the second timestamp is less than the set time, then based on the second secret key, decrypt the second authentication information to obtain the decrypted second random challenge number, the second timestamp, and the first random challenge number decrypted again; if the decrypted second timestamp and the first random challenge number decrypted again are respectively the same as the second timestamp and the first random challenge number before encryption, then determine that the server side is legal.

[0092] Specifically, the method for determining whether the server side is legal specifically includes the following steps:

[0093] When the client receives the second authentication information {K2(Rc′||Rs||T2), T2} replied by the server side at time T2 * moment, perform the following steps:

[0094] Step 1: Check the validity of the time interval. If T2* - T2 ≤ ΔT, then the client receives the second authentication information replied by the server side; otherwise, reject the replied message.

[0095] Step 2: The client calculates K2 = h(h(pw)Rc) using the login password pw and the second random challenge number Rc, and decrypts the second authentication information {K2(Rc′||Rs||T2), T2} with the second secret key K2 to obtain the first random challenge number Rc″ decrypted again, the decrypted second random challenge number Rs′, and the decrypted second timestamp T′2.

[0096] Step 3: Verify whether the encrypted timestamp T2 and the decrypted timestamp T'2 are the same; if they are different, the server identity is illegal; if they are the same, execute Step 4;

[0097] Step 4: Verify whether the re-decrypted first random challenge number Rc″ matches the first random challenge number Rc; if they match, the server identity is legal, otherwise it is illegal.

[0098] The method for generating the feedback message has been described in the above embodiments, so it will not be elaborated here.

[0099] In one embodiment, the method further includes: receiving the identity authentication result from the server side.

[0100] Wherein, the identity authentication result is determined based on the feedback message, the feedback message is generated based on the third encrypted message and the current third timestamp of the client, the third encrypted message is generated based on the third secret key generated by decrypting the first secret key and the second random challenge number, and is generated by encrypting the decryption result of the third timestamp and the second random challenge number using an encryption algorithm.

[0101] In the case where the identity authentication result is passed, the client can log in to the security video security management system and can obtain security videos, etc.

[0102] As Figure 8 shown, the overall steps of the mutual authentication method between the client and the server side are:

[0103] S801: The client generates a first authentication message based on the first encrypted message, the identity identifier ID input by the user, and the current first timestamp of the client;

[0104] S802: The server side receives the first authentication message sent by the client and determines whether the identity of the client is authenticated based on the first authentication information;

[0105] S803: In the case where it is determined that the identity of the client is authenticated, generate a second authentication message for determining whether the server side is legal based on the current second timestamp of the server side and the second encrypted message, and send the second authentication message to the client;

[0106] S804: The client determines whether the server side is legal based on the second authentication message sent by the server side, and in the case where the server side is legal, send a feedback message to the server side;

[0107] S805: The server side determines the identity authentication result based on the feedback message and sends it to the client;

[0108] S806: The client receives the identity authentication result from the server, and logs in to the security video security management system when the identity authentication result is passed.

[0109] In one embodiment, as Figure 9 shown, a server side is proposed, including:

[0110] A first data transmission module 901, configured to receive a first authentication message sent by the client; wherein, the first authentication message is generated based on a first encrypted message, an identity identifier ID input by the user, and a first timestamp of the client at present, and the first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and a first random challenge number based on a first secret key generated from the password input by the user;

[0111] A first authentication module 902, configured to determine whether the identity of the client is authenticated successfully based on the first authentication information.

[0112] In one embodiment, the method for the first authentication module to determine whether the identity of the client is authenticated successfully based on the first authentication information is:

[0113] If the time interval between the time when the server side receives the first authentication information and the time of the first timestamp is less than a set time, and the identity identifier ID exists in the user list of the database of the server side, then based on the first secret key, decrypt the first authentication information to obtain the decrypted identity identifier ID, the first random challenge number, and the first timestamp;

[0114] If the decrypted identity identifier ID and the first timestamp are respectively the same as the identity identifier ID and the first timestamp before encryption, it is determined that the identity authentication of the client is passed.

[0115] In one embodiment, the first generation module is further configured to, when it is determined that the identity authentication of the client is passed, generate a second authentication message for determining whether the server side is legal based on a second timestamp of the server side at present and a second encrypted message, and send the second authentication message to the client; wherein, the second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on a second secret key generated from the decryption result of the first secret key and the second random challenge number.

[0116] In one embodiment, the first data transmission module is further configured to receive a feedback message sent by the client when the server side is legal, wherein the feedback message is generated based on a third encrypted message and a third timestamp of the client at present, and the third encrypted message is generated by using an encryption algorithm to encrypt the third timestamp and the decryption result of the second random challenge number based on a third secret key generated from the first secret key and the decryption result of the second random challenge number;

[0117] The first authentication module is further configured to determine an identity authentication result based on the feedback message and send it to the client.

[0118] For the specific limitations of the server side, reference can be made to the limitations on the identity authentication method in the foregoing text, which will not be elaborated here. Each module in the above server side can be implemented in whole or in part by software, hardware, and their combination. The above-mentioned modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0119] In one embodiment, as Figure 10 shown, a client is proposed, including:

[0120] A first generation module 1001, configured to generate a first authentication message based on the first encrypted message, the identity identifier ID input by the user, and the first timestamp of the client currently. Among them, the first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and the first random challenge number based on the first secret key generated from the password input by the user.

[0121] A second data transmission module 1002, configured to send the first authentication message to the server side to determine whether the identity of the client is authenticated based on the first authentication information.

[0122] In one embodiment, it further includes:

[0123] A second authentication module, configured to determine whether the server side is legal based on the second authentication message sent by the server side. Among them, the second authentication message is generated based on the second timestamp of the server side currently and the second encrypted message in the case that the identity authentication of the client is passed. The second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on the second secret key generated from the decryption result of the first secret key and the second random challenge number.

[0124] The second data transmission module sends a feedback message to the server side when the server side is legal.

[0125] In one embodiment, the second authentication module determines whether the server side is legal based on the second authentication message sent by the server side, including:

[0126] If the time interval between the time when the client receives the second authentication information and the time of the second timestamp is less than the set time, then based on the second secret key, decrypt the second authentication information to obtain the decrypted second random challenge number, the second timestamp, and the first random challenge number decrypted again.

[0127] If the decrypted second timestamp and the first random challenge number after re - decryption are the same as the second timestamp and the first random challenge number before encryption respectively, it is determined that the server - side is legal.

[0128] In one embodiment, the second data transmission module is further configured to receive the identity authentication result of the server - side, where the identity authentication result is determined based on a feedback message, the feedback message is generated based on a third encrypted message and the current third timestamp of the client, the third encrypted message is generated based on a third secret key generated from the decryption result of the first secret key and the second random challenge number, and is generated by encrypting the decryption result of the third timestamp and the second random challenge number using an encryption algorithm.

[0129] For the specific limitations of the client, reference can be made to the limitations on the identity authentication method in the above text, which will not be elaborated here. Each module in the above - mentioned client can be implemented in whole or in part by software, hardware, and their combination. The above - mentioned modules can be embedded in the processor of the computer device in hardware form or be independent of it, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above - mentioned modules.

[0130] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above - mentioned embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non - volatile computer - readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above - mentioned methods. Among them, any reference to the memory, storage, database, or other media used in the embodiments provided in the present application can include at least one of non - volatile and volatile memories. The non - volatile memory can include read - only memory (ROM), magnetic tape, floppy disk, flash memory, or optical memory, etc. The volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0131] The technical features of the above - mentioned embodiments can be combined arbitrarily. For the sake of concise description, not all possible combinations of the technical features in the above - mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered to be within the scope described in this specification.

[0132] The above embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all fall within the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the appended claims.

Claims

1. An identity authentication method, applied to a server side, where the server side communicates with a client side, and is characterized in that The method includes: Receiving a first authentication message sent by the client; wherein, the first authentication message is generated based on a first encrypted message, an identity identifier ID input by the user, and a first timestamp of the client at present. The first encrypted message is generated by using an encryption algorithm to encrypt the identity identifier ID, the first timestamp, and a first random challenge number based on a first secret key generated from a password input by the user. The generation method of the first authentication message is that the client obtains the first timestamp T1, calculates a discrete column value K1 = h(pw) for the password pw, and generates the first random challenge number Rc. Using K1 as the first symmetric secret key, the first authentication message {ID, K1(ID||Rc||T1), T1} is obtained by using the encryption algorithm ID||Rc||T1. Based on the first authentication message, determining whether the identity of the client is authenticated; wherein, the first timestamp and the random challenge number are used as dual authentication factors to authenticate the identity of the client.

2. The method according to claim 1, wherein The determining whether the identity of the client is authenticated based on the first authentication message includes: If the time interval between the time when the server receives the first authentication message and the time of the first timestamp is less than a set time, and the identity identifier ID exists in the user list of the server's database, then based on the first secret key, decrypt the first authentication message to obtain the decrypted identity identifier ID, the first random challenge number, and the first timestamp. If the decrypted identity identifier ID and the first timestamp are respectively the same as the identity identifier ID and the first timestamp before encryption, it is determined that the identity authentication of the client is passed.

3. The method according to claim 1, wherein The method further includes: When it is determined that the identity authentication of the client is passed, generating a second authentication message for determining whether the server is legal based on a second timestamp of the server at present and a second encrypted message, and sending the second authentication message to the client; wherein, the second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, the second random challenge number, and the decryption result of the second random challenge number based on a second secret key generated from the decryption result of the first secret key and the second random challenge number.

4. The method according to claim 3, characterized in that, The method further includes: When the server is legal, receiving a feedback message sent by the client, wherein the feedback message is generated based on a third encrypted message and a third timestamp of the client at present. The third encrypted message is generated by using an encryption algorithm to encrypt the third timestamp and the decryption result of the second random challenge number based on a third secret key generated from the first secret key and the decryption result of the second random challenge number. Determining an identity authentication result based on the feedback message and sending it to the client.

5. An identity authentication method, applied to a client, where the client communicates with a server, characterized in that, The method includes: Generate a first authentication message based on a first encrypted message, an identity ID input by a user, and a first timestamp of the client currently. The first encrypted message is generated by using an encryption algorithm to encrypt the identity ID, the first timestamp, and a first random challenge number based on a first secret key generated from a password input by the user. The generation method of the first authentication message is to obtain the first timestamp T1, calculate a discrete column value K1 = h(pw) for the password pw, and generate the first random challenge number Rc. Using K1 as the first symmetric secret key, use the encryption algorithm ID||Rc||T1 to obtain the first authentication message {ID, K1(ID||Rc||T1), T1}. Send the first authentication message to the server side to determine whether the identity of the client is authenticated based on the first authentication message. Among them, the first timestamp and the random challenge number are used as dual authentication factors to authenticate the identity of the client.

6. The method according to claim 5, wherein The method further includes: Based on the second authentication message sent by the server side, determine whether the server side is legal. Among them, The second authentication message is generated based on a second timestamp of the server side currently and a second encrypted message in the case that the identity authentication of the client is passed. The second encrypted message is generated by using an encryption algorithm to encrypt the second timestamp, a second random challenge number, and the decryption result of the second random challenge number based on a second secret key generated from the first secret key and the decryption result of the second random challenge number. In the case that the server side is legal, send a feedback message to the server side.

7. The method according to claim 6, wherein The determining whether the server side is legal based on the second authentication message sent by the server side includes: If the time interval between the time when the client receives the second authentication information and the time of the second timestamp is less than a set time, then based on the second secret key, decrypt the second authentication information to obtain the decrypted second random challenge number, the second timestamp, and the first random challenge number decrypted again; If the decrypted second timestamp and the first random challenge number decrypted again are the same as the second timestamp and the first random challenge number before encryption respectively, determine that the server side is legal.

8. The method according to claim 6, characterized in that, The method further includes: Receive the identity authentication result of the server side. Among them, the identity authentication result is determined based on the feedback message. The feedback message is generated based on a third encrypted message and a third timestamp of the client currently. The third encrypted message is generated by using an encryption algorithm to encrypt the third timestamp and the decryption result of the second random challenge number based on a third secret key generated from the first secret key and the decryption result of the second random challenge number.

9. A server side, characterized in that, Include: The first data transmission module is used to receive the first authentication message sent by the client; wherein, the first authentication message is generated based on the first encrypted message, the identity ID input by the user, and the first timestamp of the client at present. The first encrypted message is generated by using the first secret key generated from the password input by the user to encrypt the identity ID, the first timestamp, and the first random challenge number by using an encryption algorithm. The generation method of the first authentication message is that the client obtains the first timestamp T1, calculates the discrete column value K1 = h(pw) for the password pw, and generates the first random challenge number Rc. Using the encryption algorithm ID||Rc||T1 with K1 as the first symmetric secret key, the first authentication message {ID, K1(ID||Rc||T1), T1} is obtained. The first authentication module is used to determine whether the identity of the client is authenticated based on the first authentication message; wherein, the first timestamp and the random challenge number are used as double authentication factors to authenticate the identity of the client.

10. A client, characterized in that, Comprising: The first generation module is used to generate the first authentication message based on the first encrypted message, the identity ID input by the user, and the first timestamp of the client at present. The first encrypted message is generated by using the first secret key generated from the password input by the user to encrypt the identity ID, the first timestamp, and the first random challenge number by using an encryption algorithm. The generation method of the first authentication message is to obtain the first timestamp T1, calculate the discrete column value K1 = h(pw) for the password pw, and generate the first random challenge number Rc. Using the encryption algorithm ID||Rc||T1 with K1 as the first symmetric secret key, the first authentication message {ID, K1(ID||Rc||T1), T1} is obtained. The second data transmission module is used to send the first authentication message to the server side to determine whether the identity of the client is authenticated based on the first authentication message; wherein, the first timestamp and the random challenge number are used as double authentication factors to authenticate the identity of the client.

Images