Multi-device assisted authentication method and system

Abstract

The present disclosure provides a method and system for multi-device assisted authentication. The method includes: receiving a user's identity key allocation request and identity key sharing request, allocating and saving the identity key and sending the identity key to the user and the sharee. The method further includes inviting the user and the sharee to assist in confirmation when receiving a transaction request from the user, and performing authentication by comparing tokens.

Description

Technical Field

[0001] The present disclosure relates to the field of identity verification, and more particularly, to assisted identity verification. Background Art

[0002] With the popularity of mobile devices (such as smartphones), mobile interactions, whether business, payment, or identity verification, are moving towards convenient interaction, fast speed, and simple operation. Looking at the payment method alone, in the payment scenario, it has evolved from the long password in the past to the short password and then to today's biometric payment (fingerprint, face, 2D face). Good experience and security have always been a process of mutual balance. Although there are sufficiently safe biometric products at this stage (for example, fingerprint / face verification based on the Internet Financial Identity Authentication Alliance (IFAA), biometric face scanning, etc.), these products still have certain security risks (for example, the problem of similar faces).

[0003] Therefore, it is hoped to provide a multi-device assisted authentication method, which completes the assisted authentication by requesting the authentication assistance parties authorized by the user to confirm at the same time when the user initiates a service request. In this way, an identity authentication solution based on multi-device assisted interaction can solve security risks such as face recognition and improve the security of identity authentication and user experience. Summary of the invention

[0004] This disclosure is provided to introduce some concepts in a simplified form that will be further described in the following detailed description. This disclosure is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0005] In response to the above problems, according to one aspect of the present disclosure, a method for multi-device assisted authentication is provided, the method comprising: receiving a user's identity key allocation request and identity key sharing request; allocating an identity key and saving the identity key on a server; sending the identity key to the user and the sharee; receiving a transaction request from the user, and inviting the user and the sharee to send a confirmation based on the transaction request; verifying the identity keys of the user and the sharee in response to the confirmation of the user and the sharee; and returning an authentication result based on the verification of the identity keys of the user and the sharee.

[0006] In the technical solution of the disclosed embodiment, assisted authentication is achieved by assigning identity keys to users and sharing the assigned identity keys with sharees authorized by the users, and inviting the users and sharees to confirm their identities when the users make transaction requests. This solves the security risks of authentication based on an assisted interactive identity authentication solution with multiple devices, thereby improving the security of authentication and user experience.

[0007] According to a further embodiment of the present disclosure, the assigned identity keys are stored in an encrypted manner on the blockchain.

[0008] According to a further embodiment of the present disclosure, the allocated identity key is bound together with the user identifier and device identifier of the user and the user identifier and device identifier of the sharee to form a contract.

[0009] According to a further embodiment of the present disclosure, inviting the user and the sharee to send confirmation based on the transaction request further includes: based on the transaction request, obtaining a corresponding identity key from the blockchain according to a user identifier and a device identifier of the user; and inviting the user and the sharee bound to the obtained identity key to send confirmation.

[0010] According to a further embodiment of the present disclosure, verifying the identity keys of the user and the sharee further includes: respectively calculating and comparing the token of the user and the token of the sharee; based on the same comparison result, obtaining the token calculated on the server side; and further comparing the token of the user and the token obtained from the server side.

[0011] According to a further embodiment of the present disclosure, the token calculated at the server end is calculated based on the identity key obtained from the blockchain at the server end.

[0012] According to a further embodiment of the present disclosure, the token is calculated based on the identity key and the current timestamp using a time-based one-time password TOTP algorithm.

[0013] According to a further embodiment of the present disclosure, the method further comprises: in response to receiving a transaction request from a user, performing password verification, SMS verification or biometric verification before inviting the user and the sharee to send a confirmation.

[0014] According to another aspect of the present disclosure, a system for multi-device assisted authentication is provided, the system comprising: a key allocation module, receiving a user's identity key allocation request and identity key sharing request; allocating identity keys and storing the identity keys on a server; sending the identity keys to the user and the sharee; an assistance confirmation module, receiving a user's transaction request, and inviting the user and the sharee to send confirmation based on the transaction request; and an identity authentication module, verifying the identity keys of the user and the sharee in response to the confirmation of the user and the sharee; and returning an authentication result based on the verification of the identity keys of the user and the sharee.

[0015] In the technical solution of the disclosed embodiment, by utilizing the above-mentioned multi-device assisted authentication system, when the user makes a service request, the authentication assistance party authorized by the user can be requested to confirm at the same time to complete the assisted authentication, thereby improving the security of identity authentication and improving the user experience.

[0016] According to a further embodiment of the present disclosure, the key distribution module stores the distributed identity key on the blockchain in an encrypted manner.

[0017] According to a further embodiment of the present disclosure, the key distribution module binds the distributed identity key with the user identifier and device identifier of the user and the user identifier and device identifier of the sharee to form a contract.

[0018] According to a further embodiment of the present disclosure, inviting the user and the sharee to send confirmation based on the transaction request further includes: based on the transaction request, obtaining a corresponding identity key from the blockchain according to a user identifier and a device identifier of the user; and inviting the user and the sharee bound to the obtained identity key to send confirmation.

[0019] According to a further embodiment of the present disclosure, verifying the identity keys of the user and the sharee further includes: respectively calculating and comparing the token of the user and the token of the sharee; based on the same comparison result, obtaining the token calculated on the server side; and further comparing the token of the user and the token obtained from the server side.

[0020] According to a further embodiment of the present disclosure, the token calculated at the server end is calculated based on the identity key obtained from the blockchain at the server end.

[0021] According to a further embodiment of the present disclosure, the token is calculated based on the identity key and the current timestamp using a time-based one-time password TOTP algorithm.

[0022] According to a further embodiment of the present disclosure, the assistance confirmation module further: in response to receiving a transaction request from a user, performs password verification, SMS verification or biometric verification before inviting the user and the sharee to send confirmation.

[0023] According to yet another aspect of the present disclosure, a computer-readable storage medium storing instructions is provided. When the instructions are executed, the machine is caused to perform the method described in any one of the aforementioned aspects.

[0024] These and other features and advantages will become apparent by reading the following detailed description and by reference to the associated drawings.It is to be understood that the foregoing general description and the following detailed description are illustrative only and are not restrictive of the aspects of what is claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to understand in detail the manner in which the above features of the present disclosure are used, the above briefly summarized contents may be described in more detail with reference to various embodiments, some of which are shown in the accompanying drawings. However, it should be noted that the accompanying drawings only show certain typical aspects of the present disclosure and should not be considered to limit its scope, as the description may allow for other equally effective aspects.

[0026] Figure 1 It is a schematic architecture diagram of a system for multi-device assisted authentication according to an embodiment of the present disclosure.

[0027] Figure 2 It is a schematic flowchart of a registration authorization process based on an identity key according to an embodiment of the present disclosure.

[0028] Figure 3 It is a schematic flowchart of an identity verification process based on an identity key according to an embodiment of the present disclosure.

[0029] Figure 4 It is a schematic diagram of calculating a dynamic token by using a time-based one-time password TOTP algorithm according to an embodiment of the present disclosure.

[0030] Figure 5 It is a schematic flow chart of a method for multi-device assisted authentication according to an embodiment of the present disclosure.

[0031] Figure 6 It is a schematic architecture diagram of a system for multi-device assisted authentication according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] The present disclosure is described in detail below in conjunction with the accompanying drawings, and the features of the present disclosure will be further revealed in the following specific description.

[0033] As more and more operations can be completed quickly on mobile phones, since face-to-face communication is not possible, higher requirements are placed on identity verification, which not only ensures that the person is operating, but also prevents problems such as similar faces. It can be seen that the current identity verification method still has security risks.

[0034] In addition, although there are some assisted authentication methods, the existing assisted authentication methods are, for example, after the password is lost, friends help send verification codes to complete identity confirmation. However, this method has limited application scenarios and is initiated after the fact. Therefore, there are certain problems in user experience and security. In order to solve the above problems, the present disclosure provides a multi-device assisted authentication method and system, as further referenced below Figure 1-6 as described.

[0035] Figure 1 1 is a schematic diagram of a multi-device assisted authentication system 100 according to an embodiment of the present disclosure. The system 100 may include at least a key distribution module 101, an assistance confirmation module 102 and an identity authentication module 103.

[0036] The key distribution module 101 can receive the user's identity key distribution request and identity key sharing request, distribute the identity key and save the identity key on the server, and send the identity key to the user and the user's authorized sharee. In one embodiment, the key distribution module 101 can bind the distributed identity key with the user information and the user's authorized sharee information. Specifically, when distributing the identity key, the key distribution module 101 can bind the identity key with the user's user identifier and device identifier and the user identifier and device identifier of the user's authorized sharee to form a contract. In one embodiment, the key distribution module 101 can store the distributed identity key in an encrypted manner on the blockchain, thereby achieving the key's immutability, publicity, and traceability. The specific identity key registration authorization process will be referred to below. Figure 2 Describe in detail.

[0037] The assistance confirmation module 102 can receive the transaction request of the user, and invite the user and the user's authorized sharee to send confirmation based on the transaction request. In one embodiment, in the case where the user's identity key is stored on the blockchain, the assistance confirmation module 102 can receive the user's transaction request, and based on the transaction request, obtain the corresponding identity key from the blockchain according to the user identifier and device identifier of the user, and invite the user and the sharee bound to the obtained identity key to send identity confirmation. In one embodiment, before inviting the user and the sharee to confirm their identity, the assistance confirmation module 102 can also perform identity verification output by normal business processes, including but not limited to password verification, SMS verification or biometric verification. In this way, the identity key can be synchronously output for identity authentication during the business process, and operations with potential safety hazards can be blocked in time. In addition, during the business process, the user holding the identity key can intervene in this operation in time. Only when all confirmations are completed can the business be promoted, which greatly improves the security of identity verification while improving the user experience.

[0038] The identity authentication module 103 can verify the identity keys of the user and the sharee in response to the confirmation of the user and the sharee authorized by the user. In one embodiment, the identity authentication module 103 can respectively calculate the user's token and the sharee's token and compare them, obtain the token calculated on the server side based on the same comparison result, further compare the user's token and the token obtained from the server side, and return the authentication result based on the result of the further comparison. In one embodiment, the token is calculated based on the obtained identity key and the current timestamp using a time-based one-time password TOTP algorithm, as described below Figure 4 Further detailed description. In one embodiment, when the user's identity key is stored on the blockchain, the identity authentication module 103 can obtain a token calculated on the server side when the comparison result of the user's token and the token of the person being shared is the same, wherein the token is calculated based on the identity key obtained from the blockchain at the server side. Thus, by using the TOTP algorithm to compare the tokens of the user and the person being shared, and the tokens of the client and the server, assisted authentication can be completed, further improving authentication security.

[0039] Those skilled in the art will appreciate that the system and its modules of the present disclosure may be implemented in hardware or software, and the modules may be combined or combined in any suitable manner. In addition, the system of the present disclosure may be implemented on a smart device, which may include but is not limited to a smart phone, a mobile phone, a smart watch, a wearable device, etc.

[0040] Figure 2 The following is a schematic flow chart of a registration authorization process 200 based on an identity key according to an embodiment of the present disclosure. In the present disclosure, multi-device assisted authentication means that multiple devices need to participate at the same time. Since the device itself does not have the characteristics of an identity, it is necessary to first guide the user to register the identity and authorize the sharee. The registration authorization process 200 is as follows:

[0041] S1: Within the app, users can first register their personal virtual identity key through strong authentication (payment password or real-person face recognition).

[0042] At the identity authentication application, in response to step S1, the following operations are performed:

[0043] S1.1: In response to a user request to register an identity key, a unique key secretKey is allocated to the identity key;

[0044] S1.2: Bind the relationship between the identity key and the current user ID (uid) + device ID (deviceId);

[0045] S1.3: forming a contract with the identity key and the binding relationship; and

[0046] S1.4: Store in an encrypted form on the blockchain to ensure that the key cannot be tampered with and is traceable.

[0047] S2: The user (i.e., the user with the identity key) can also request key sharing, that is, to distribute the identity key to his or her family or trusted friends (i.e., the sharee or identity verification assistant) in a sharing manner.

[0048] At the identity authentication application, in response to step S2, the following operations are performed:

[0049] S2.1: In response to a user requesting key sharing, receiving a user ID (uid) of a key sharing party;

[0050] S2.2: In response to receiving the user ID (uid) of the sharee, push the message to the application app of the sharee.

[0051] S3: The application of the sharee subsequently receives a push message about the key sharing.

[0052] S4: The person being shared with confirms receipt of the key and becomes an authentication assisting party.

[0053] At the identity authentication application, in response to step S4, the following operations are performed:

[0054] S4.1: In response to the sharee's confirmation of receiving the key, the sharee's user ID (uid) + device ID (deviceId) and key id are received;

[0055] S4.2: Generate a contract for the authorization information of the sharee (i.e., bind the identity key to the uid+deviceId of the sharee to form a contract);

[0056] S4.3: Encrypt the authorization information and upload it to the chain (i.e., record the authorization information in the form of a contract on the blockchain to which the current key belongs).

[0057] Consider the following two scenarios. Scenario 1: The mother can assign the key to the father to prevent the child from performing operations such as game recharge when the mother is not paying attention. Even if the child uses the mobile phone to face the mother to complete facial verification, face scan or fingerprint verification, the payment cannot be completed without the father's confirmation. Scenario 2: The elderly can have their children help register the key in advance and then share it with their children to prevent the elderly from being induced to perform identity verification operations and unconsciously obtain identity information or even transfer funds.

[0058] Therefore, when conducting business scenarios such as commodity purchases, transfers, and registrations, in addition to verifying the authentication methods output by normal business processes, including passwords, text messages, and biometric authentication, you only need to output the identity key to complete the assisted authentication, which can greatly reduce the security risks of authentication, improve the security of authentication, and improve the user experience. In addition, by using blockchain to store identity keys, the keys are made tamper-proof, public, and traceable.

[0059] Figure 3 FIG. 3 is a schematic flow chart of an identity verification process 300 based on an identity key according to an embodiment of the present disclosure. Figure 2 As can be seen in the figure, the user has completed the identity key registration and the sharer authorization through the registration and authorization process 200. The identity key assigned to the user and the user information and the sharer information have been bound together and encrypted and stored on the blockchain. The identity verification process 300 for the user to apply for a recharge transaction is as follows:

[0060] S1: User applies for a recharge transaction.

[0061] S1.1: At the cashier counter, in response to a recharge transaction application initiated by a user, identity verification is performed.

[0062] S2: In the identity verification application, in response to the identity verification, fingerprint verification is completed (of course, it can also be password verification, SMS verification, face verification, etc.).

[0063] S3: Get the user ID (uid) + device ID (deviceId) of the current user.

[0064] S3.1: Query the corresponding identity key information from the blockchain based on the current user’s uid+deviceId.

[0065] S4: At the identity authentication application, the user's identity key is identified and the business needs to be output.

[0066] S5: In the identity authentication application, obtain the information of the key owner (ie, the current user and the person being shared), and perform confirmation push based on the obtained information (ie, the key owner's uid+deviceId).

[0067] S6: Push a confirmation to the user to invite the user to send a confirmation.

[0068] S7: Send a confirmation push to the person being shared to invite the person being shared to send a confirmation.

[0069] S8: User sends confirmation.

[0070] S8.1: In response to the user sending a confirmation, a token calculation is performed using the TOTP algorithm based on the key secretKey.

[0071] S9: The share recipient sends a confirmation.

[0072] S9.1: In response to the confirmation sent by the sharee, the token is calculated using the TOTP algorithm based on the key secretKey;

[0073] S9.2: Compare the tokens of the user and the shared party to see if they are the same;

[0074] S9.3: If the comparison results are the same, further compare with the token calculated at the TOTP application server.

[0075] S9.3.1: At the TOTP application server, obtain the identity key secretKey from the blockchain based on the user's uid+deviceId;

[0076] S9.3.2: Use the TOTP algorithm to calculate the token based on the obtained identity key secretKey;

[0077] S9.3.3: Compare the token of the service request (i.e., the token calculated in steps S8.1 and S9.1) with the current token to see if they are the same;

[0078] S9.3.4: Return the authentication result to the identity authentication application, wherein if the comparison results of the tokens are the same, return the authentication success result to the identity authentication application.

[0079] S9.4: Return to the cashier to complete identity verification and proceed to the next business process.

[0080] Therefore, in the case where the normal authentication link is bypassed due to, for example, a similar face problem, during the process of the operator verifying the key, it will be directly intercepted due to the mismatch of the user ID + device ID to which the key belongs. In addition, in the case of inducing the person himself to operate or an acquaintance to operate (as described in the two scenarios above), since the output of the identity key is an operation that requires confirmation from everyone holding the key before it can proceed, this means that during the authentication process, the current device and the device authorized to own the key will simultaneously receive a confirmation push for the use of the key. Only when both have completed the confirmation operation can it be considered that the identity authentication has passed (such as the need for the father's assistance in confirmation in scenario 1 above, or the need for the children's remote assistance in confirmation in scenario 2 to complete the authentication), which significantly reduces the potential safety hazards of authentication and improves the security of authentication. Here, the authentication process of a user initiating a recharge transaction is explained only as an example, but those skilled in the art will understand that the present disclosure is not limited to the authentication process of a recharge transaction, but also includes the authentication process of any other normal transaction request.

[0081] Figure 4The figure is a schematic diagram of calculating a dynamic token using a time-based one-time password (TOTP) algorithm according to an embodiment of the present disclosure. With the TOTP algorithm, as long as the client (prover) and the server (verifier) ​​keep the clocks consistent and both parties pre-set a shared key, the value calculated in the same time segment is the same. TOTP is calculated using the following formula:

[0082] TOTP=Truncate(HMAC-SHA-1(K,T))

[0083] Among them, T is determined by the current time CurrentUnixTime, the initial time (T0), and the step size (X), that is, T = (CurrentUnixtime-T0) / X, where CurrentUnixtime is the current Unix time, T0 is the initialization time for starting step counting, and X is the step size.

[0084] It is based on this principle that Figure 4 As shown, the user identity and the shared key are bound first, and then in the authentication process, the client and the server each use the TOTP algorithm to calculate a dynamic token (for example, a 6-digit check code) based on the obtained shared key (for example, the identity key in the present disclosure) and the current timestamp through the same hash algorithm. As long as the dynamic tokens are consistent, the authentication can be passed. TOTP calculation can be performed when the terminal is online or offline, which is very flexible.

[0085] Figure 5 5 is a schematic flow chart of a method 500 for multi-device assisted authentication according to an embodiment of the present disclosure. The method 500 starts at step 501, where the key distribution module 101 may receive an identity key distribution request and an identity key sharing request from a user.

[0086] In step 502, the key distribution module 101 may distribute an identity key and save the identity key on the server. In one embodiment, the key distribution module 101 may store the distributed identity key in an encrypted manner on the blockchain to achieve the key's immutability, publicity, and traceability. In one embodiment, the key distribution module 101 may bind the distributed identity key with the user's user identifier and device identifier and the user identifier and device identifier of the sharee to form a contract. Preferably, the key distribution module 101 may encrypt and chain the identity key after binding the identity key with the user's and the sharee's information to form a contract.

[0087] In step 503 , the key distribution module 101 may send the identity key to the user and the sharee.

[0088] In step 504, the assistance confirmation module 102 may receive a transaction request from a user, and based on the transaction request, invite the user and the sharer to send a confirmation. In one embodiment, the assistance confirmation module may receive a transaction request from a user, and based on the transaction request, obtain a corresponding identity key from the blockchain according to the user identifier and the device identifier of the user, and invite the user and the sharee bound to the obtained identity key to send a confirmation. In one embodiment, the assistance confirmation module may, in response to receiving the transaction request from the user, perform conventional password verification, SMS verification, or biometric verification before inviting the user and the sharee to send a confirmation.

[0089] In step 505, the identity authentication module 103 may verify the identity keys of the user and the sharee in response to the confirmation of the user and the sharee. In one embodiment, the identity authentication module 103 may respectively calculate the user's token and the sharee's token and compare them. The token may be calculated based on the identity key and the current timestamp using a time-based one-time password (TOTP) algorithm, such as Figure 4 As described in . Then, the identity verification module 103 may obtain the token calculated on the server side based on the same comparison result. In one embodiment, the token calculated on the server side is calculated based on the identity key obtained from the blockchain on the server side. Then, the identity verification module 103 may further compare the user's token with the token obtained from the server side.

[0090] In step 506, the identity authentication module 103 may return the authentication result based on the verification of the identity keys of the user and the sharee. In one embodiment, the identity authentication module 103 may return the result of successful authentication based on the same result of token comparison, and continue to advance the normal business process. In another embodiment, the identity authentication module 103 may return the result of failed authentication based on the different result of token comparison, and intercept the next step.

[0091] Therefore, by requesting the user's authorized authentication assistant to confirm at the same time when the user initiates a transaction request, assisted authentication is completed, thereby solving security risks such as face recognition based on a multi-device assisted interactive identity authentication solution and improving the security of identity authentication.

[0092] Figure 6 FIG. 6 is a schematic diagram of a multi-device assisted authentication system 600 according to an embodiment of the present disclosure. Figure 6As shown in , the system 600 may include a memory 601 and at least one processor 602. The memory 701 may include RAM, ROM, or a combination thereof. The memory 601 may store computer executable instructions, which, when executed by at least one processor 602, cause the at least one processor 602 to perform various functions described herein, including: receiving a user's identity key allocation request and an identity key sharing request; allocating an identity key and saving the identity key on the server side; sending the identity key to the user and the sharee; receiving a transaction request from the user, and inviting the user and the sharee to send a confirmation based on the transaction request; in response to the confirmation of the user and the sharee, respectively calculating the user's token and the sharee's token and comparing them; based on the same comparison result, obtaining the token calculated on the server side; further comparing the user's token and the token obtained from the server side; and returning the authentication result based on the result of the further comparison. In some cases, the memory 701 may particularly include a BIOS, which may control basic hardware or software operations, such as interaction with peripheral components or devices. Processor 602 may include an intelligent hardware device (eg, a general purpose processor, DSP, CPU, microcontroller, ASIC, FPGA, programmable logic device, discrete gate or transistor logic components, discrete hardware components, or any combination thereof).

[0093] The various illustrative blocks and modules described in conjunction with the disclosure herein may be implemented or executed with a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).

[0094] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored on or transmitted by a computer-readable medium as one or more instructions or codes. Other examples and implementations fall within the scope of the present disclosure and the appended claims. For example, due to the nature of software, the functions described herein may be implemented using software executed by a processor, hardware, firmware, hardwiring, or any combination thereof. Features that implement the functions may also be physically located in various locations, including being distributed so that parts of the functions are implemented at different physical locations.

[0095] What has been described above includes examples of various aspects of the claimed subject matter. Of course, it is not possible to describe every conceivable combination of components or methods for the purpose of describing the claimed subject matter, but one of ordinary skill in the art will recognize that many further combinations and permutations of the claimed subject matter are possible. Thus, the disclosed subject matter is intended to encompass all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims.

Claims

1. A method for multi-device assisted authentication, the method comprising: Receive a user's identity key allocation request and identity key sharing request; Allocating an identity key and storing the identity key on the server; Sending the identity key to the user and the sharee, wherein the assigned identity key is bound to the user identifier and device identifier of the user and the user identifier and device identifier of the sharee to form a contract; Receive a transaction request from a user, and invite the user and the sharee to send a confirmation based on the transaction request; In response to confirmation by the user and the sharee, verifying the identity keys of the user and the sharee; as well as The authentication result is returned based on the verification of the identity keys of the user and the sharee.

2. The method of claim 1, wherein the assigned identity key is stored in an encrypted manner on the blockchain.

3. The method of claim 2, inviting the user and the sharee to send confirmation based on the transaction request further comprises: Based on the transaction request, obtaining a corresponding identity key from the blockchain according to a user identifier and a device identifier of the user; as well as Invite the user and the sharee bound to the acquired identity key to send confirmation.

4. The method of claim 1, wherein verifying the identity keys of the user and the sharee further comprises: Calculate and compare the token of the user and the token of the person being shared with respectively; Based on the same comparison result, obtaining a token calculated on the server; as well as The user's token is further compared with the token obtained from the server.

5. The method of claim 4, wherein the token calculated at the server end is calculated based on an identity key obtained from the blockchain at the server end.

6. The method of claim 4, wherein the token is calculated based on the identity key and the current timestamp using a time-based one-time password (TOTP) algorithm.

7. The method of claim 1, further comprising: In response to receiving a transaction request from a user, password verification, SMS verification or biometric verification is performed before inviting the user and the sharee to send a confirmation.

8. A system for multi-device assisted authentication, the system comprising: Key distribution module, Receive a user's identity key allocation request and identity key sharing request; Allocating an identity key and storing the identity key on the server; Sending the identity key to the user and the sharee, wherein the assigned identity key is bound to the user identifier and device identifier of the user and the user identifier and device identifier of the sharee to form a contract; Assist in confirming the module, Receive a transaction request from a user, and invite the user and the sharee to send a confirmation based on the transaction request; as well as Authentication module, In response to confirmation by the user and the sharee, verifying the identity keys of the user and the sharee; as well as The authentication result is returned based on the verification of the identity keys of the user and the sharee.

9. The system of claim 8, wherein the key distribution module stores the distributed identity key in an encrypted manner on the blockchain.

10. The system of claim 9, wherein inviting the user and the sharee to send confirmation based on the transaction request further comprises: Based on the transaction request, obtaining a corresponding identity key from the blockchain according to a user identifier and a device identifier of the user; as well as Invite the user and the sharee bound to the acquired identity key to send confirmation.

11. The system of claim 8, wherein verifying the identity keys of the user and the sharee further comprises: Calculate and compare the token of the user and the token of the person being shared with respectively; Based on the same comparison result, obtaining a token calculated on the server; as well as The user's token is further compared with the token obtained from the server.

12. The system of claim 11, wherein the token calculated at the server end is calculated based on an identity key obtained from a blockchain at the server end.

13. The system of claim 11, wherein the token is calculated based on the identity key and a current timestamp using a time-based one-time password (TOTP) algorithm.

14. The system of claim 8, wherein the assistance confirmation module further: In response to receiving a transaction request from a user, password verification, SMS verification or biometric verification is performed before inviting the user and the sharee to send a confirmation.

15. A computer-readable storage medium storing instructions, which, when executed, causes a machine to perform the method according to any one of claims 1 to 7.

Images