An identity authentication method and device, an electronic device, and a storage medium

Abstract

Embodiments of the present application provide an identity authentication method and device, electronic equipment and readable storage medium, the method comprises: obtaining the identity check request initiated by the client to be authenticated user; the identity check request carries key information; the key information is split into a plurality of first key fragments and sent to a plurality of second servers for checking; the identity check result of the identity check request is determined according to the key check result returned by each second server; the key check result is determined according to the user authentication point coordinate, the reference authentication point coordinate and the node authentication point coordinate; the user authentication point coordinate is composed of the first key fragment; the reference authentication point coordinate and the node authentication point coordinate are pre-allocated by the second server as an authentication node. By using the above method, the authentication of multiple authentication servers is required to pass the final identity check, which enhances the security of identity check.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an authentication method, an authentication method apparatus, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Authentication is the process of determining whether someone or something is truly as it claims to be. User authentication, in this context, refers to the system requiring verification of a user's identity information when accessing system resources; only those with valid identity can continue accessing the system. Common forms of user authentication include username / password login and fingerprint attendance. An authentication server is an application that facilitates the authentication of entities attempting to access the network. Such entities can be users or other servers. An authentication server might belong to a dedicated computer, an Ethernet switch, an access point, or a network access server. When a potential subscriber accesses an authentication server, the username and password are likely the only required identification data.

[0003] Server authentication methods typically involve interacting with a single authentication server using fixed usernames, passwords, and other authentication information to obtain a verification result and determine the legitimacy of the user's identity. A single authentication server stores all user authentication information. The biggest drawback of this method is that if the authentication server is compromised, the security of the entire system will be directly affected. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide an authentication method and a corresponding authentication device, an electronic device, and a computer-readable storage medium that overcome or at least partially solve the above problems.

[0005] This invention discloses an identity authentication method applied to a first server, the method comprising:

[0006] Obtain the identity verification request initiated by the user to be authenticated on the client; the identity verification request carries key information;

[0007] The key information is split into several first key fragments and then sent to multiple second servers for verification.

[0008] The identity verification result for the identity verification request is determined based on the key verification results returned by each of the second servers; the key verification result is determined based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates; the user authentication point coordinates are composed of the first key fragments; the baseline authentication point coordinates and the node authentication point coordinates are pre-allocated by the second server as an authentication node.

[0009] Optionally, determining the identity verification result for the identity verification request based on the key verification results returned by each of the second servers includes:

[0010] If all the key verification results indicate successful verification, then the identity verification result is determined to be successful; otherwise, the identity verification result is determined to be unsuccessful.

[0011] Optionally, the method further includes:

[0012] Obtain the authentication parameter initialization request for the authentication node, and draw a circle in the preset coordinate system to allocate authentication parameters according to the authentication parameter initialization request;

[0013] The coordinates of the center point and the coordinates of the circumference point of the circle are combined into multiple distributed authentication parameter groups and sent to multiple second servers. Each second server stores the coordinates of the center point as the reference authentication point coordinates and the coordinates of the circumference point as the node authentication point coordinates in its own database, thus completing the initialization of the authentication parameters for the second server as an authentication node.

[0014] Optionally, the method further includes:

[0015] Obtain the client's identity request and assign a newly created user identifier to the new user who initiated the identity request;

[0016] Obtain the newly created first key fragment returned by each of the second servers for the newly created user identifier; the newly created first key fragment is determined based on the newly created user authentication point; the newly created user authentication point is selected by the second server on the straight line between the node authentication point and the base authentication point after obtaining the newly created user identifier;

[0017] The newly created first key fragments are concatenated into complete newly created key information, and the newly created user identifier and the newly created key information are used as the identity request result for the identity application request.

[0018] This invention also discloses another authentication method applied to a second server, the method comprising:

[0019] Obtain the first key fragment of the first server and determine the user authentication point coordinates for the user to be authenticated, which are composed of the first key fragment; the first key fragment is obtained by splitting the key information carried in the identity verification request initiated by the user to be authenticated.

[0020] Obtain the coordinates of the baseline authentication point pre-allocated by the second server as the authentication node, as well as the coordinates of the node authentication point;

[0021] The first server is fed back the key verification result for the first key fragment based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates, so that the first server can determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers.

[0022] Optionally, the step of feeding back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the reference authentication point coordinates, and the node authentication point coordinates includes:

[0023] Determine a straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line;

[0024] If yes, then send a key verification result indicating successful verification to the first server; otherwise, send a key verification result indicating failed verification to the first server.

[0025] Optionally, determining whether the user authentication point corresponding to the user authentication point coordinates lies on the straight line includes:

[0026] The first slope value between the two points is calculated using the coordinates of the node authentication point and the coordinates of the user authentication point.

[0027] The second slope value between the two points is calculated using the coordinates of the node authentication point and the coordinates of the benchmark authentication point;

[0028] If the first slope value is the same as the second slope value, then the user authentication point is located on the straight line; otherwise, the user authentication point is not located on the straight line.

[0029] Optionally, the second server stores a mapping relationship between user identifiers and second key fragments, the identity verification request carries the user identifier, and determining the user authentication point coordinates for the user to be authenticated, composed of the first key fragments, includes:

[0030] If a second key fragment corresponding to the user identifier is found from the mapping relationship, the key value corresponding to the first key fragment is used as the horizontal coordinate of the user authentication point, and the key value corresponding to the second key fragment is used as the vertical coordinate of the user authentication point, thus forming the user authentication point coordinates for the user to be authenticated.

[0031] Optionally, the method further includes:

[0032] Obtain the distributed authentication parameter group of the first server; the distributed authentication parameter group includes the coordinates of the center point and the coordinates of the circumference point belonging to the same circle; the circle is drawn in a preset coordinate system according to the authentication parameter initialization request;

[0033] The coordinates of the center point are stored in the database as the reference authentication point coordinates, and the coordinates of the circumference point are stored as the node authentication point coordinates, in order to complete the initialization of the authentication parameters of the second server as the authentication node.

[0034] Optionally, the method further includes:

[0035] Obtain the newly created user identifier from the first server; the newly created user identifier is assigned by the first server to the new user who initiated the identity request.

[0036] Select a newly created user authentication point on the straight line where the node authentication point and the baseline authentication point are located;

[0037] The newly created first key fragment is fed back to the first server based on the newly created user authentication point, so that the first server can concatenate the newly created first key fragments returned by each of the second servers into complete newly created key information, and then use the newly created user identifier and the newly created key information as the identity request result for the identity application request.

[0038] Optionally, the step of feeding back a newly created first key fragment for the newly created user identifier to the first server based on the newly created user authentication point includes:

[0039] The x-coordinate of the newly created user authentication point is used as the key value corresponding to the newly created first key fragment and fed back to the first server.

[0040] Optionally, the method further includes:

[0041] The ordinate of the newly created user authentication point is used as the key value corresponding to the newly created second key segment, and the mapping relationship between the newly created user identifier and the newly created second key segment is established and stored in its own database.

[0042] This invention also discloses an identity authentication device applied to a first server, the device comprising:

[0043] The first acquisition module is used to acquire an identity verification request initiated by a user to be authenticated on the client; the identity verification request carries key information.

[0044] The splitting and sending module is used to split the key information into several first key fragments and send them to multiple second servers for verification.

[0045] The determination module is used to determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers; the key verification result is determined based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates; the user authentication point coordinates are composed of the first key fragments; the baseline authentication point coordinates and the node authentication point coordinates are pre-allocated by the second server as an authentication node.

[0046] Optionally, the determining module includes:

[0047] The first determining submodule is used to determine that the identity verification result is successful if all the key verification results indicate successful verification; otherwise, it is determined that the identity verification result is unsuccessful verification.

[0048] Optionally, the device further includes:

[0049] The acquisition and drawing module is used to acquire the authentication parameter initialization request for the authentication node, and draw a circle for allocating authentication parameters in a preset coordinate system according to the authentication parameter initialization request.

[0050] The combination and sending module is used to combine the center point coordinates and circumference point coordinates of the circle into multiple distributed authentication parameter groups and send them to multiple second servers, so that each second server stores the center point coordinates as the reference authentication point coordinates and the circumference point coordinates as the node authentication point coordinates in its own database, thereby completing the authentication parameter initialization of the second server as an authentication node.

[0051] Optionally, the device further includes:

[0052] The acquisition and allocation module is used to acquire the client's identity application request and allocate a newly created user identifier to the new user who initiates the identity application request;

[0053] The second acquisition module is used to acquire the newly created first key fragment returned by each of the second servers for the newly created user identifier; the newly created first key fragment is determined based on the newly created user authentication point; the newly created user authentication point is selected by the second server on the straight line between the node authentication point and the reference authentication point after acquiring the newly created user identifier;

[0054] The splicing and determination module is used to splice the newly created first key fragments into complete newly created key information, and to use the newly created user identifier and the newly created key information as the identity request result for the identity application request.

[0055] This invention also discloses another identity authentication device applied to a second server, the device comprising:

[0056] The acquisition and determination module is used to acquire the first key fragment of the first server and determine the user authentication point coordinates for the user to be authenticated, which are composed of the first key fragment; the first key fragment is obtained by splitting the key information carried in the identity verification request initiated by the user to be authenticated.

[0057] The third acquisition module is used to acquire the coordinates of the baseline authentication point and the node authentication point pre-allocated by the second server as the authentication node;

[0058] The first feedback module is used to feed back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the reference authentication point coordinates, and the node authentication point coordinates, so that the first server can determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers.

[0059] Optionally, the first feedback module includes:

[0060] The second determining submodule is used to determine the straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and to determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line.

[0061] The first feedback submodule is used to send a key verification result indicating successful verification to the first server if the verification is successful; otherwise, it sends a key verification result indicating failed verification to the first server.

[0062] Optionally, the second determining submodule includes:

[0063] The first calculation unit is used to calculate the first slope value between the two points using the coordinates of the node authentication point and the coordinates of the user authentication point;

[0064] The second calculation unit is used to calculate the second slope value between the two points using the coordinates of the node authentication point and the coordinates of the reference authentication point;

[0065] The determining unit is configured to determine if the user authentication point is located on the straight line if the first slope value is the same as the second slope value; otherwise, the user authentication point is not located on the straight line.

[0066] Optionally, the second server stores a mapping relationship between user identifiers and second key fragments, the identity verification request carries the user identifier, and the acquisition and determination module includes:

[0067] A submodule is configured to, if a second key fragment corresponding to the user identifier is found from the mapping relationship, use the key value corresponding to the first key fragment as the horizontal coordinate of the user authentication point and the key value corresponding to the second key fragment as the vertical coordinate of the user authentication point, thereby constructing the user authentication point coordinates for the user to be authenticated.

[0068] Optionally, the device further includes:

[0069] The fourth acquisition module is used to acquire the distributed authentication parameter group of the first server; the distributed authentication parameter group includes the coordinates of the center point and the coordinates of the circumference point belonging to the same circle; the circle is drawn in a preset coordinate system according to the authentication parameter initialization request;

[0070] The authentication parameter initialization module is used to store the coordinates of the center point as the reference authentication point coordinates and the coordinates of the circumference point as the node authentication point coordinates in its own database, so as to complete the authentication parameter initialization of the second server as the authentication node.

[0071] Optionally, the device further includes:

[0072] The fifth acquisition module is used to acquire the newly created user identifier of the first server; the newly created user identifier is obtained based on the first server's allocation to the new user who initiated the identity application request;

[0073] The selection module is used to select a newly created user authentication point on the straight line where the node authentication point and the baseline authentication point are located;

[0074] The second feedback module is used to feed back a newly created first key fragment for the newly created user identifier to the first server based on the newly created user authentication point, so that the first server can concatenate the newly created first key fragments returned by each of the second servers into complete newly created key information, and then use the newly created user identifier and the newly created key information as the identity request result for the identity application request.

[0075] Optionally, the second feedback module includes:

[0076] The second feedback submodule is used to feed back the x-coordinate of the newly created user authentication point as the key value corresponding to the newly created first key fragment to the first server.

[0077] Optionally, the device further includes:

[0078] The mapping relationship establishment module is used to use the ordinate of the newly created user authentication point as the key value corresponding to the newly created second key segment, and to establish and store the mapping relationship between the newly created user identifier and the newly created second key segment in its own database.

[0079] This invention also discloses an identity authentication system, which includes a client, a first server, and a second server;

[0080] The client is used to obtain an identity verification request initiated by the user to be authenticated; the identity verification request carries key information;

[0081] The first server is used to split the key information into several first key fragments and send them to multiple second servers for verification;

[0082] The second server is used to determine the user authentication point coordinates for the user to be authenticated, which are composed of the first key fragments. After obtaining the baseline authentication point coordinates and node authentication point coordinates pre-allocated by the second server as an authentication node, the second server feeds back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the baseline authentication point coordinates and the node authentication point coordinates.

[0083] The first server is used to determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers;

[0084] The client is used to obtain the identity verification result from the first server.

[0085] This invention also discloses an electronic device, including: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of an authentication method as described above.

[0086] This invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of an authentication method as described above.

[0087] The embodiments of the present invention have the following advantages:

[0088] In this embodiment of the invention, the first server can split the key information in the identity verification request into several first key fragments and send them to multiple second servers for verification. The second servers determine the key verification result for the first key fragments based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates. The first server can determine the identity verification result for the identity verification request based on the key verification results returned by each second server. By adopting the above method, a method for multiple servers to jointly verify the legitimacy of user identity is provided. The baseline authentication point coordinates and node authentication point coordinates can be pre-allocated to the second servers acting as authentication nodes. After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby determining the legitimacy of the user identity. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of identity verification. The authentication parameters generated by this method have the characteristics of distributed storage, so the security of the entire system will not be affected by the leakage of authentication information from a single authentication server. Attached Figure Description

[0089] Figure 1 This is a flowchart of the steps of an identity authentication method provided in an embodiment of the present invention;

[0090] Figure 2 This is a schematic diagram of a process for initializing authentication parameters according to an embodiment of the present invention;

[0091] Figure 3 This is a flowchart of another identity authentication method provided in an embodiment of the present invention;

[0092] Figure 4 This is a schematic diagram of a user identity authentication process according to an embodiment of the present invention;

[0093] Figure 5 This is a schematic diagram of a user identity application process according to an embodiment of the present invention;

[0094] Figure 6 This is a schematic diagram of the structure of an identity authentication system provided in an embodiment of the present invention;

[0095] Figure 7 This is a schematic diagram illustrating an application scenario of an identity authentication method provided in an embodiment of the present invention;

[0096] Figure 8 This is a structural block diagram of an identity authentication device provided in an embodiment of the present invention;

[0097] Figure 9 This is a structural block diagram of another identity authentication device provided in an embodiment of the present invention. Detailed Implementation

[0098] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art are within the scope of protection of the present invention.

[0099] Server authentication methods typically involve interacting with a single authentication server using fixed usernames, passwords, and other authentication information to obtain a verification result and determine the legitimacy of the user's identity. A single authentication server stores all user authentication information. The biggest drawback of this method is that if the authentication server is compromised, the security of the entire system will be directly affected.

[0100] To address the vulnerability of a single server storing authentication information and prevent the entire authentication system from being compromised if one server is compromised, this invention aims to provide an authentication method, an authentication device, an electronic device, and a computer-readable storage medium that overcome or at least partially solve the aforementioned problems.

[0101] One of the core concepts of this invention is to provide a method for multiple servers to jointly verify the legitimacy of a user's identity. This method pre-allocates baseline authentication point coordinates and node authentication point coordinates for the second server (acting as an authentication node). After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby confirming the user's legitimacy. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of the identity verification process. Furthermore, the authentication parameters generated by this method have distributed storage characteristics, preventing the leakage of authentication information from a single authentication server from affecting the security of the entire system.

[0102] Reference Figure 1 The diagram illustrates a flowchart of an identity authentication method provided by an embodiment of the present invention, applied to a first server, and specifically includes the following steps:

[0103] Step 101: Obtain the identity verification request initiated by the user to be authenticated on the client.

[0104] The identity verification request includes key information.

[0105] The first server can be a portal server, which has an interaction channel with the user client. The identity verification request is used to request verification of the user's identity.

[0106] In this embodiment of the invention, the user to be authenticated can input identity authentication information on the client to generate a corresponding identity verification request. The client can then send this identity verification request to a first server for identity verification. The first server can obtain the identity verification request. The identity verification request may also carry the user identifier to be authenticated.

[0107] Step 102: The key information is split into several first key fragments and then sent to multiple second servers for verification.

[0108] The second server can be an authentication server acting as an authentication node. There can be multiple second servers. This authentication method can be applied to a business system composed of a cluster of servers, consisting of a portal server and multiple authentication servers. The portal server and authentication servers are deployed together in an intranet environment, and only the interaction channel between the portal server and the user client is maintained. In this authentication method, the client does not communicate directly with each authentication server, but instead communicates with the portal server to indirectly complete the authentication process with each authentication server. This greatly protects the communication security of the authentication servers.

[0109] The first server can split the key information carried in the identity verification request into several first key fragments (distinguished from second key fragments), and send each of the first key fragments to multiple second servers for verification. It can be understood that, in this embodiment of the invention, distributed key verification is performed by multiple second servers.

[0110] In one example, the key information input by the user can be a key string XU1-XU2...-XUN. The first server can decompose the key string into N first key fragments, namely XU1, XU2, ..., XUN, and then send the N first key fragments to N second servers through an encrypted network.

[0111] Step 103: Determine the identity verification result for the identity verification request based on the key verification results returned by each second server.

[0112] The key verification result is determined based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates; the user authentication point coordinates are composed of the first key fragments; the baseline authentication point coordinates and the node authentication point coordinates are pre-allocated by the second server as the authentication node.

[0113] For any second server, after obtaining the first key fragment, the coordinates of the user authentication point for the user to be authenticated, composed of the first key fragment, can be determined.

[0114] The second server, acting as an authentication node, is pre-assigned with baseline authentication point coordinates and node authentication point coordinates, which can be obtained. It should be noted that the baseline authentication point coordinates are the same on each second server, but the node authentication point coordinates are different on each second server; that is, the node authentication point coordinates are unique for each individual second server.

[0115] Then, based on the positional relationship between the three coordinate points—the baseline authentication point coordinates, the node authentication point coordinates, and the user authentication point coordinates—the key verification result for the first key fragment can be determined, and the key verification result can be fed back to the first server.

[0116] The first server determines the identity verification result for the identity verification request based on the key verification results returned by each of the second servers.

[0117] In an optional embodiment of the present invention, step 103, which determines the identity verification result for the identity verification request based on the key verification results returned by each second server, may specifically include the following sub-steps:

[0118] In sub-step S11, if all key verification results indicate successful verification, then the identity verification result is determined to be successful; otherwise, the identity verification result is determined to be unsuccessful.

[0119] If all returned key verification results indicate successful verification, the identity verification result is successful, and the user to be authenticated can be determined to be a legitimate user; if any returned key verification result indicates failed verification, the identity verification result is failed, and the user to be authenticated can be determined to be an illegitimate user.

[0120] In an optional embodiment of the present invention, the method may further include the following steps:

[0121] Obtain the authentication parameter initialization request for the authentication node, and draw a circle in the preset coordinate system to allocate authentication parameters according to the authentication parameter initialization request; combine the center point coordinates and circumference point coordinates of the circle into multiple distributed authentication parameter groups and send them to multiple second servers, so that each second server stores the center point coordinates as the reference authentication point coordinates and the circumference point coordinates as the node authentication point coordinates in its own database, thus completing the authentication parameter initialization of the second server as the authentication node.

[0122] Before user authentication, the authentication parameters for each authentication node need to be initialized. Specifically, after the first server receives the authentication parameter initialization request for the authentication node, it can draw a circle in a preset coordinate system to allocate the authentication parameters. It can then select several unique points on the circumference of this circle. The coordinates of the circle's center point and the selected circumference points can be combined to form multiple distributed authentication parameter sets, which are then sent to multiple second servers. These distributed authentication parameter sets can include the coordinates of the center point and the coordinates of the circumference points.

[0123] After obtaining the distributed authentication parameter set, the second server stores the coordinates of the center point as the base authentication point coordinates and the coordinates of the circumference points as the node authentication point coordinates in its own database, thereby completing the authentication parameter initialization for the second server as an authentication node. Note that the circumference point coordinates assigned to each second server are different.

[0124] To enable those skilled in the art to better understand the embodiments of the present invention, the specific process of initializing authentication parameters in this authentication method is illustrated below with an example, referring to... Figure 2 The diagram shown is a flowchart illustrating the initialization of authentication parameters according to an embodiment of the present invention. The specific process may include:

[0125] 1. Select the center point coordinates as O(OX, OY) and the radius parameter as R. R can be as large as possible to ensure the security of the authentication method. The portal server can draw a circle with coordinates O(OX, OY) as the center and R as the radius. N unique coordinate points can be randomly selected on the circumference ((X1, Y1), (X2, Y2)...(XN, YN), where N is the number of authentication servers). The center point coordinates can be encrypted and stored on the portal server for subsequent authentication operations with the user.

[0126] 2. The portal server sends the coordinates of each of the N circumferential points, along with the coordinates of the center point O (OX, OY), to the N authentication servers via encrypted transmission.

[0127] 3. After receiving their respective authentication parameter sets, the N authentication servers encrypt and store the coordinates of the circumference point and the center point in their respective databases as authentication parameters.

[0128] In an optional embodiment of the present invention, the method may further include the following steps:

[0129] The system retrieves the client's identity request and assigns a newly created user identifier to the new user initiating the identity request; it retrieves the newly created first key fragments returned by each second server for the newly created user identifier; the newly created first key fragments are determined based on the newly created user authentication point; the newly created user authentication point is selected by the second server on the straight line between the node authentication point and the baseline authentication point after obtaining the newly created user identifier; it concatenates the newly created first key fragments into complete newly created key information, and uses the newly created user identifier and the newly created key information as the identity request result for the identity request.

[0130] After initializing the authentication parameters for each authentication node, user authentication can be performed, as well as the submission of legitimate user identity requests. Specifically, a new user can initiate an identity request on the client and then send this request to the first server to request the allocation of a legitimate identity. Upon receiving the identity request, the first server can assign a newly created user identifier to the new user who initiated the request, and then send this newly created user identifier to multiple second servers, which are responsible for allocating authentication key information.

[0131] For any second server, after obtaining the newly created user identifier, it determines the straight line between the node authentication point and the baseline authentication point based on the coordinates of the baseline authentication point and the node authentication point stored in its own database. Then, it randomly selects a coordinate point on this straight line as the newly created user authentication point corresponding to the newly created user identifier. The second server can then determine the newly created first key fragment to be allocated to the newly created user identifier based on this newly created user authentication point, and then send the newly created first key fragment to the first server for further processing.

[0132] After the first database obtains the newly created first key fragments returned by each second server, it can concatenate the newly created first key fragments into complete newly created key information, and then send the newly created user identifier and newly created key information back to the user client as the identity request result for the identity application request.

[0133] In summary, this invention provides a method for jointly verifying the legitimacy of a user's identity using multiple servers. This method pre-allocates baseline authentication point coordinates and node authentication point coordinates for the second server (acting as an authentication node). After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby confirming the user's legitimacy. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of the identity verification process. Furthermore, the authentication parameters generated by this method have distributed storage characteristics, preventing the leakage of authentication information from a single authentication server from affecting the security of the entire system.

[0134] The above embodiments describe an authentication method provided by this application from the perspective of a first server. The following embodiments describe an authentication method provided by this application from the perspective of a second server. It should be noted that, to avoid repetition, the various embodiments and features in each embodiment can be referred to each other. Furthermore, unless there is conflict, the various embodiments and features in each embodiment can be combined with each other.

[0135] Reference Figure 3 The diagram illustrates a flowchart of another authentication method provided by an embodiment of the present invention, applied to a second server, and specifically includes the following steps:

[0136] Step 301: Obtain the first key fragment of the first server and determine the coordinates of the user authentication point for the user to be authenticated, which is composed of the first key fragment.

[0137] The first key fragment is obtained by splitting the key information carried in the identity verification request initiated by the user to be authenticated.

[0138] The user to be authenticated can input authentication information on the client to generate a corresponding authentication request, which the client can then send to the first server. The first server can split the key information carried in the authentication request into several first key fragments, and send each first key fragment to multiple second servers for verification. After obtaining the first key fragments, the second servers can determine the user authentication point coordinates for the user to be authenticated, which are composed of these first key fragments.

[0139] In an optional embodiment of the present invention, the second server stores a mapping relationship between user identifiers and second key fragments. The identity verification request carries the user identifier. Step 301 determines the user authentication point coordinates for the user to be authenticated, which consists of the first key fragments. This may specifically include the following sub-steps:

[0140] Sub-step S21: If the second key fragment corresponding to the user identifier is found from the mapping relationship, the key value corresponding to the first key fragment is used as the horizontal coordinate of the user authentication point, and the key value corresponding to the second key fragment is used as the vertical coordinate of the user authentication point, thus forming the user authentication point coordinates for the user to be authenticated.

[0141] If the second key fragment corresponding to the user identifier of the user to be authenticated is found from the stored mapping relationship between user identifier and second key fragment, the key value corresponding to the first key fragment can be used as the horizontal coordinate of the user authentication point, and the key value corresponding to the second key fragment can be used as the vertical coordinate of the user authentication point, thus forming the user authentication point coordinates for the user to be authenticated.

[0142] If the second server fails to find the second key fragment corresponding to the user identifier of the user to be authenticated from the stored mapping relationship between user identifier and second key fragment, it can directly determine that the user to be authenticated is an illegitimate user and directly send back the key verification result indicating verification failure to the first server.

[0143] Step 302: Obtain the coordinates of the baseline authentication point and the node authentication point pre-assigned by the second server as the authentication node.

[0144] The second server, acting as an authentication node, is pre-allocated with the coordinates of the baseline authentication point and the coordinates of the node authentication point.

[0145] Step 303: Based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates, the key verification result for the first key fragment is fed back to the first server, so that the first server can determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers.

[0146] In an optional embodiment of the present invention, step 303, which involves feeding back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the reference authentication point coordinates, and the node authentication point coordinates, may specifically include the following sub-steps:

[0147] Sub-step S31: Determine the straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line.

[0148] Sub-step S32: If yes, then send a key verification result indicating successful verification to the first server; otherwise, send a key verification result indicating failed verification to the first server.

[0149] After determining the user authentication point coordinates of the user to be authenticated, the base authentication point corresponding to the base authentication point coordinates, the node authentication point corresponding to the node authentication point coordinates, and the user authentication point corresponding to the user authentication point coordinates can be calculated to determine whether these three coordinate points are on the same straight line. If they are on the same straight line, it means that the first key fragment has been successfully verified on the second server, and a key verification result indicating successful verification can be sent back to the first server; if they are not on the same straight line, it means that the first key fragment has failed verification on the second server, and a key verification result indicating failure can be sent back to the first server.

[0150] In an optional embodiment of the present invention, the sub-step S31, which determines whether the user authentication point corresponding to the user authentication point coordinates lies on a straight line, may specifically include the following sub-steps:

[0151] The first slope value between the two points is calculated using the coordinates of the node authentication point and the user authentication point; the second slope value between the two points is calculated using the coordinates of the node authentication point and the reference authentication point; if the first slope value is the same as the second slope value, then the user authentication point is located on the straight line; otherwise, the user authentication point is not located on the straight line.

[0152] In this embodiment of the invention, it can be specifically determined whether the three coordinate points are on the same straight line by comparing the slope values ​​between each pair of coordinate points.

[0153] To enable those skilled in the art to better understand the embodiments of the present invention, the specific process of user identity authentication in this authentication method is described below through an example, with reference to... Figure 4 The diagram shown illustrates a user authentication process according to an embodiment of the present invention. The specific process may include:

[0154] 1. The user to be authenticated enters the UserID and key string (XU1-XU2...-XUN) from the client to request the portal server to verify their identity.

[0155] 2. After receiving the identity verification request, the portal server will decompose the key string provided by the user into N first key fragments. The first key fragment is actually the X coordinate data that makes up the user authentication point, for example, XU(N). Then, the user identifier and the N first key fragments are sent to the N authentication servers through an encrypted network.

[0156] 3. After receiving the user's UserID and the first key fragment, each authentication server will query the second key fragment stored in its own database based on the UserID. The second key fragment is actually the Y coordinate data that makes up the user authentication point, for example, YU(N).

[0157] 4. If the authentication server N does not find the YU(N) information corresponding to the UserID, it considers the user to be an illegitimate user and directly returns the key verification result of verification failure to the portal server.

[0158] 5. If the authentication server returns a key verification result indicating a verification failure to the portal server, the portal server returns an identity verification result indicating a verification failure / authentication failure to the user client.

[0159] 6. If authentication server N finds the YU(N) information corresponding to UserID, it can obtain the complete user authentication point U(XU(N), YU(N)) based on the XU(N) carried in the identity verification request and the found YU(N). At this time, the authentication server uses its own node authentication point coordinates (XN, YN) and the user's user authentication point coordinates (XU(N), YU(N)) to calculate the slope K1 of the line connecting the two points. The calculation formula is as follows:

[0160]

[0161] 7. The authentication server calculates the slope K2 of the line connecting its own node authentication point coordinates (XN, YN) and the reference authentication point coordinates (OX, OY). The reference authentication point coordinates are actually the center point coordinates O(OX, OY). The calculation formula is as follows:

[0162]

[0163] 8. The authentication server compares the values ​​of K1 and K2. If they are the same, it means that the user's authentication point (XU(N), YU(N)) is on the line connecting the authentication point of the authentication server node to the base authentication point, and the user can be considered to have successfully verified on that authentication server; otherwise, the verification is considered to have failed. The authentication server transmits the UserID and key verification result back to the portal server via an encrypted connection. The portal server waits for the key verification results returned by all authentication servers. Only after all authentication servers have returned successfully verified key verification results will the portal server return a successfully verified identity verification result to the user client. If any authentication server returns a failed key verification result, the portal server will return a failed identity verification result to the user client.

[0164] 9. Wait for all authentication servers to return the key verification results indicating successful verification.

[0165] 10. If all authentication servers return a successful key verification result to the portal server, the portal server returns a successful identity verification result to the user client.

[0166] Before performing user authentication, the authentication parameters of each authentication node need to be initialized. In an optional embodiment of the present invention, the method may further include the following steps:

[0167] Obtain the distributed authentication parameter group of the first server; the distributed authentication parameter group includes the coordinates of the center point and the coordinates of the circumference point belonging to the same circle; the circle is drawn in a preset coordinate system according to the authentication parameter initialization request; store the center point coordinates as the reference authentication point coordinates and the circumference point coordinates as the node authentication point coordinates in its own database to complete the authentication parameter initialization of the second server as the authentication node.

[0168] After initializing the authentication parameters for each authentication node, user authentication can be performed, and legitimate user identity requests can also be made. In an optional embodiment of the present invention, the method may further include the following steps:

[0169] Obtain the newly created user identifier from the first server; the newly created user identifier is assigned by the first server to the new user who initiated the identity request; select the newly created user authentication point on the straight line where the node authentication point and the baseline authentication point are located; based on the newly created user authentication point, send back the newly created first key fragment for the newly created user identifier to the first server, so that the first server can splice the newly created first key fragments returned by each second server into complete newly created key information, and use the newly created user identifier and the newly created key information as the identity request result for the identity request.

[0170] In an optional embodiment of the present invention, the above steps, in which the newly created first key fragment for the newly created user identifier is fed back to the first server based on the newly created user authentication point, may specifically include the following sub-steps:

[0171] The x-coordinate of the newly created user authentication point is used as the key value corresponding to the newly created first key fragment and fed back to the first server.

[0172] After obtaining the newly created user identifier from the first server, the second server determines the straight line between the node authentication point and the benchmark authentication point based on the coordinates of the benchmark authentication point and the node authentication point stored in its own database. Then, it randomly selects a coordinate point on the straight line as the newly created user authentication point corresponding to the newly created user identifier. After that, the horizontal coordinate of the newly created user authentication point can be used as the key value corresponding to the newly created first key fragment. Then, the newly created first key fragment is fed back to the first server.

[0173] The first server can concatenate the newly created first keys returned by each of the second servers into complete newly created key information, where the newly created key information is actually the horizontal coordinate data string of each newly created user authentication point.

[0174] In an optional embodiment of the present invention, the method may further include the following steps:

[0175] The ordinate of the newly created user authentication point is used as the key value corresponding to the newly created second key segment, and the mapping relationship between the newly created user identifier and the newly created second key segment is established and stored in its own database.

[0176] The second server can also use the ordinate of the newly created user authentication point as the key value corresponding to the newly created second key fragment, and then establish and store the mapping relationship between the newly created user identifier and the newly created second key fragment in its own database.

[0177] To enable those skilled in the art to better understand the embodiments of the present invention, the following example illustrates the specific process of user identity application in this authentication method, with reference to... Figure 5 The diagram shown illustrates a user identity application process according to an embodiment of the present invention. The specific process may include:

[0178] 1. Users initiate an identity application request to the portal server through the client.

[0179] 2. The portal server will create a new, unique user identifier (UserID) and send it to N authentication servers, then wait for the authentication servers to assign authentication key information to the user.

[0180] 3. The authentication server N will read the node authentication point coordinates (XN, YN) and the baseline authentication point coordinates (OX, OY) stored in its own database, and randomly select a coordinate point U (XU(N), YU(N)) on the line ON connecting the two points as the newly created user authentication point.

[0181] 4. The N authentication servers will each send the X coordinate XU(N) of the newly created user authentication point back to the portal server as the key value corresponding to the newly created first key fragment.

[0182] 5. The N authentication servers then store the Y-coordinates (YU1, YU2...YUN) and UserIDs of the N newly created user authentication points in their respective databases. Each authentication server will maintain the mapping relationship between the newly created user identifier and the newly created second key fragment (i.e., the Y-coordinate of the newly created user authentication point), as shown in Table 1.

[0183]

[0184]

[0185] Table 1

[0186] 6. After receiving the X-coordinates of the newly created user authentication points from all N authentication servers, the portal server concatenates the X-coordinates to obtain the complete newly created key information, i.e., a string of XU1-XU2...-XUN. This string, along with the newly created user identifier (UserID), is then sent back to the user client. The user receives the final newly created user identifier (UserID) and the newly created key information (XU1-XU2...-XUN), which can be used to complete subsequent user authentication steps.

[0187] In summary, this invention provides a method for jointly verifying the legitimacy of a user's identity using multiple servers. This method pre-allocates baseline authentication point coordinates and node authentication point coordinates for the second server (acting as an authentication node). After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby confirming the user's legitimacy. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of the identity verification process. Furthermore, the authentication parameters generated by this method have distributed storage characteristics, preventing the leakage of authentication information from a single authentication server from affecting the security of the entire system.

[0188] This invention utilizes the circular property to distribute the verification parameters of each authentication server on a circle. Furthermore, it assigns user authentication point parameters to users along a straight line from the node authentication point of each authentication server to the base authentication point. Finally, the X-coordinates of the user authentication points are used as a sequence to distribute key information to the user. Each authentication server retains the Y-coordinate parameters of the user authentication points. During authentication, the slope of the line is calculated to determine whether the user authentication point lies on the straight line from the base authentication point to the node authentication point to complete authentication. A user must pass authentication from all authentication servers simultaneously to complete identity verification.

[0189] In this authentication method, the client does not communicate directly with each authentication server. Instead, it communicates with the portal server and then indirectly completes the authentication process with each authentication server, which greatly protects the communication security of the authentication servers. This authentication method does not rely on any existing authentication technologies and algorithms. Based on the characteristics of circles and the slope of straight lines, it employs an independent mathematical calculation system to complete the authentication. The authentication parameters generated by this method are generated by the portal server and have distributed storage characteristics. The authentication parameters are simple and have low computational load. The user authentication information stored by a single authentication server is only a part of the authentication information and cannot be directly used for user authentication. Each authentication server does not completely store the key, so the authentication security will not be affected by the leakage of authentication information from a single authentication server. The user information stored in the authentication server is not the result of calculation and comparison. The authentication server parameter points (node ​​authentication points) are generated on the circumference, which is difficult to guess when the radius is large enough. This invention employs a technical solution that uses an algorithm to allocate authentication point parameters on the circumference and compare the slope of straight lines to complete the authentication.

[0190] Reference Figure 6 The diagram illustrates the structure of an identity authentication system 600 provided by an embodiment of the present invention. Specifically, the identity authentication system 600 may include the following parts:

[0191] Client 6001 is used to obtain the identity verification request initiated by the user to be authenticated; the identity verification request carries key information.

[0192] The first server 6002 is used to split the key information into several first key fragments and send them to multiple second servers for verification.

[0193] The second server 6003 is used to determine the user authentication point coordinates for the user to be authenticated, which are composed of the first key fragments. After obtaining the baseline authentication point coordinates and node authentication point coordinates pre-allocated by the second server as an authentication node, it feeds back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the baseline authentication point coordinates and the node authentication point coordinates.

[0194] The first server 6002 is used to determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers.

[0195] Client 6001 is used to obtain the identity verification result from the first server.

[0196] Reference Figure 7The diagram illustrates an application scenario of an identity authentication method provided by an embodiment of the present invention. The client communicates with multiple authentication servers through a portal server. The portal server and authentication servers are jointly deployed in an intranet environment, maintaining only the interaction channel between the portal server and the client. The portal server acts as an intermediary between the client and the authentication servers. After communicating with the portal server, the client indirectly completes the distributed authentication process with each authentication server, protecting the communication security of the authentication servers. The client can be any electronic device, such as a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The client can also be various application software that can be installed on the aforementioned devices. The portal server and authentication servers can be a server cluster or part of a cloud computing resource pool. This method can be applied to the authentication and login system of any information system that supports cluster server deployment.

[0197] It should be noted that, in order to avoid repetition, the system implementation examples here are only briefly described. The specific implementation process of the system can be referred to the process described from the perspective of the first server or the second server.

[0198] In summary, this invention provides a method for jointly verifying the legitimacy of a user's identity using multiple servers. This method pre-allocates baseline authentication point coordinates and node authentication point coordinates for the second server (acting as an authentication node). After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby confirming the user's legitimacy. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of the identity verification process. Furthermore, the authentication parameters generated by this method have distributed storage characteristics, preventing the leakage of authentication information from a single authentication server from affecting the security of the entire system.

[0199] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0200] Reference Figure 8 The diagram illustrates a structural block diagram of an identity authentication device provided by an embodiment of the present invention, which is applied to a first server and may specifically include the following modules:

[0201] The first acquisition module 801 is used to acquire an identity verification request initiated by a user to be authenticated on the client; the identity verification request carries key information.

[0202] The splitting and sending module 802 is used to split the key information into several first key fragments and send them to multiple second servers for verification.

[0203] The determining module 803 is used to determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers; the key verification result is determined based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates; the user authentication point coordinates are composed of the first key fragments; the baseline authentication point coordinates and the node authentication point coordinates are pre-allocated by the second server as an authentication node.

[0204] In this embodiment of the invention, the determining module includes:

[0205] The first determining submodule is used to determine that the identity verification result is successful if all the key verification results indicate successful verification; otherwise, it is determined that the identity verification result is unsuccessful verification.

[0206] In this embodiment of the invention, the device further includes:

[0207] The acquisition and drawing module is used to acquire the authentication parameter initialization request for the authentication node, and draw a circle for allocating authentication parameters in a preset coordinate system according to the authentication parameter initialization request.

[0208] The combination and sending module is used to combine the center point coordinates and circumference point coordinates of the circle into multiple distributed authentication parameter groups and send them to multiple second servers, so that each second server stores the center point coordinates as the reference authentication point coordinates and the circumference point coordinates as the node authentication point coordinates in its own database, thereby completing the authentication parameter initialization of the second server as an authentication node.

[0209] In this embodiment of the invention, the device further includes:

[0210] The acquisition and allocation module is used to acquire the client's identity application request and allocate a newly created user identifier to the new user who initiates the identity application request;

[0211] The second acquisition module is used to acquire the newly created first key fragment returned by each of the second servers for the newly created user identifier; the newly created first key fragment is determined based on the newly created user authentication point; the newly created user authentication point is selected by the second server on the straight line between the node authentication point and the reference authentication point after acquiring the newly created user identifier;

[0212] The splicing and determination module is used to splice the newly created first key fragments into complete newly created key information, and to use the newly created user identifier and the newly created key information as the identity request result for the identity application request.

[0213] In summary, this invention provides a method for jointly verifying the legitimacy of a user's identity using multiple servers. This method pre-allocates baseline authentication point coordinates and node authentication point coordinates for the second server (acting as an authentication node). After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby confirming the user's legitimacy. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of the identity verification process. Furthermore, the authentication parameters generated by this method have distributed storage characteristics, preventing the leakage of authentication information from a single authentication server from affecting the security of the entire system.

[0214] Reference Figure 9 The diagram illustrates a structural block diagram of another identity authentication device provided in an embodiment of the present invention, which is applied to a second server and may specifically include the following modules:

[0215] The acquisition and determination module 901 is used to acquire the first key fragment of the first server and determine the user authentication point coordinates for the user to be authenticated, which are composed of the first key fragment; the first key fragment is obtained by splitting the key information carried in the identity verification request initiated by the user to be authenticated.

[0216] The third acquisition module 902 is used to acquire the coordinates of the baseline authentication point and the node authentication point pre-allocated by the second server as the authentication node;

[0217] The first feedback module 903 is used to feed back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the reference authentication point coordinates, and the node authentication point coordinates, so that the first server can determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers.

[0218] In this embodiment of the invention, the first feedback module includes:

[0219] The second determining submodule is used to determine the straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and to determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line.

[0220] The first feedback submodule is used to send a key verification result indicating successful verification to the first server if the verification is successful; otherwise, it sends a key verification result indicating failed verification to the first server.

[0221] In this embodiment of the invention, the second determining submodule includes:

[0222] The first calculation unit is used to calculate the first slope value between the two points using the coordinates of the node authentication point and the coordinates of the user authentication point;

[0223] The second calculation unit is used to calculate the second slope value between the two points using the coordinates of the node authentication point and the coordinates of the reference authentication point;

[0224] The determining unit is configured to determine if the user authentication point is located on the straight line if the first slope value is the same as the second slope value; otherwise, the user authentication point is not located on the straight line.

[0225] In this embodiment of the invention, the second server stores a mapping relationship between user identifiers and second key fragments, the identity verification request carries the user identifier, and the acquisition and determination module includes:

[0226] A submodule is configured to, if a second key fragment corresponding to the user identifier is found from the mapping relationship, use the key value corresponding to the first key fragment as the horizontal coordinate of the user authentication point and the key value corresponding to the second key fragment as the vertical coordinate of the user authentication point, thereby constructing the user authentication point coordinates for the user to be authenticated.

[0227] In this embodiment of the invention, the device further includes:

[0228] The fourth acquisition module is used to acquire the distributed authentication parameter group of the first server; the distributed authentication parameter group includes the coordinates of the center point and the coordinates of the circumference point belonging to the same circle; the circle is drawn in a preset coordinate system according to the authentication parameter initialization request;

[0229] The authentication parameter initialization module is used to store the coordinates of the center point as the reference authentication point coordinates and the coordinates of the circumference point as the node authentication point coordinates in its own database, so as to complete the authentication parameter initialization of the second server as the authentication node.

[0230] In this embodiment of the invention, the device further includes:

[0231] The fifth acquisition module is used to acquire the newly created user identifier of the first server; the newly created user identifier is obtained based on the first server's allocation to the new user who initiated the identity application request;

[0232] The selection module is used to select a newly created user authentication point on the straight line where the node authentication point and the baseline authentication point are located;

[0233] The second feedback module is used to feed back a newly created first key fragment for the newly created user identifier to the first server based on the newly created user authentication point, so that the first server can concatenate the newly created first key fragments returned by each of the second servers into complete newly created key information, and then use the newly created user identifier and the newly created key information as the identity request result for the identity application request.

[0234] In this embodiment of the invention, the second feedback module includes:

[0235] The second feedback submodule is used to feed back the x-coordinate of the newly created user authentication point as the key value corresponding to the newly created first key fragment to the first server.

[0236] In this embodiment of the invention, the device further includes:

[0237] The mapping relationship establishment module is used to use the ordinate of the newly created user authentication point as the key value corresponding to the newly created second key segment, and to establish and store the mapping relationship between the newly created user identifier and the newly created second key segment in its own database.

[0238] In summary, this invention provides a method for jointly verifying the legitimacy of a user's identity using multiple servers. This method pre-allocates baseline authentication point coordinates and node authentication point coordinates for the second server (acting as an authentication node). After determining the user authentication point coordinates corresponding to the user to be authenticated, the key verification result is determined based on the positional relationship of these three coordinate points, thereby confirming the user's legitimacy. This method requires authentication from multiple authentication servers to pass the final identity verification, thus enhancing the security of the identity verification process. Furthermore, the authentication parameters generated by this method have distributed storage characteristics, preventing the leakage of authentication information from a single authentication server from affecting the security of the entire system.

[0239] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0240] This invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described identity authentication method embodiment and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0241] This invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described identity authentication method embodiment and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0242] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0243] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0244] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0245] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0246] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0247] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0248] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0249] The present invention has provided a detailed description of an identity authentication method, an identity authentication device, an electronic device, and a computer-readable storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An identity authentication method, characterized in that, Applied to a first server, the method includes: Obtain the identity verification request initiated by the user to be authenticated on the client; the identity verification request carries key information; the key information is the newly created key information in the identity request result; The key information is split into several first key fragments and then sent to multiple second servers for verification. The identity verification result for the identity verification request is determined based on the key verification results returned by each of the second servers; the key verification result is determined based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates; the user authentication point coordinates are composed of the first key fragments; the baseline authentication point coordinates and the node authentication point coordinates are pre-allocated by the second server as an authentication node; The method further includes: Obtain the client's identity request and assign a newly created user identifier to the new user who initiated the identity request; Obtain the newly created first key fragment returned by each of the second servers for the newly created user identifier; the newly created first key fragment is determined based on the newly created user authentication point; the newly created user authentication point is selected by the second server on the straight line between the node authentication point and the base authentication point after obtaining the newly created user identifier; The newly created first key fragments are concatenated into complete newly created key information, and the newly created user identifier and the newly created key information are used as the identity request result for the identity application request.

2. The method according to claim 1, characterized in that, Determining the identity verification result for the identity verification request based on the key verification results returned by each of the second servers includes: If all the key verification results indicate successful verification, then the identity verification result is determined to be successful; otherwise, the identity verification result is determined to be unsuccessful.

3. The method according to claim 1, characterized in that, The method further includes: Obtain the authentication parameter initialization request for the authentication node, and draw a circle in the preset coordinate system to allocate authentication parameters according to the authentication parameter initialization request; The coordinates of the center point and the coordinates of the circumference point of the circle are combined into multiple distributed authentication parameter groups and sent to multiple second servers. Each second server stores the coordinates of the center point as the reference authentication point coordinates and the coordinates of the circumference point as the node authentication point coordinates in its own database, thus completing the initialization of the authentication parameters for the second server as an authentication node.

4. An identity authentication method, characterized in that, Applied to a second server, the method includes: The first key fragment is obtained from the first server, and the coordinates of the user authentication point for the user to be authenticated, which is composed of the first key fragment, are determined. The first key fragment is obtained by the first server after splitting the key information carried in the identity verification request initiated by the user to be authenticated. Obtain the coordinates of the baseline authentication point pre-allocated by the second server as the authentication node, as well as the coordinates of the node authentication point; The first server is fed back the key verification result for the first key fragment based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates, so that the first server can determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers. The step of feeding back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates includes: Determine a straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line; If yes, then send a key verification result indicating successful verification to the first server; otherwise, send a key verification result indicating failed verification to the first server.

5. The method according to claim 4, characterized in that, Determining whether the user authentication point corresponding to the user authentication point coordinates lies on the straight line includes: The first slope value between the two points is calculated using the coordinates of the node authentication point and the coordinates of the user authentication point. The second slope value between the two points is calculated using the coordinates of the node authentication point and the coordinates of the benchmark authentication point; If the first slope value is the same as the second slope value, then the user authentication point is located on the straight line; otherwise, the user authentication point is not located on the straight line.

6. The method according to claim 5, characterized in that, The second server stores a mapping relationship between user identifiers and second key fragments. The identity verification request carries the user identifier. Determining the user authentication point coordinates for the user to be authenticated, composed of the first key fragments, includes: If a second key fragment corresponding to the user identifier is found from the mapping relationship, the key value corresponding to the first key fragment is used as the horizontal coordinate of the user authentication point, and the key value corresponding to the second key fragment is used as the vertical coordinate of the user authentication point, thus forming the user authentication point coordinates for the user to be authenticated.

7. The method according to claim 4, characterized in that, The method further includes: Obtain the distributed authentication parameter group of the first server; the distributed authentication parameter group includes the coordinates of the center point and the coordinates of the circumference point belonging to the same circle; the circle is drawn in a preset coordinate system according to the authentication parameter initialization request; The coordinates of the center point are stored in the database as the reference authentication point coordinates, and the coordinates of the circumference point are stored as the node authentication point coordinates, in order to complete the initialization of the authentication parameters of the second server as the authentication node.

8. The method according to claim 4, characterized in that, The method further includes: Obtain the newly created user identifier from the first server; the newly created user identifier is assigned by the first server to the new user who initiated the identity request. Select a newly created user authentication point on the straight line where the node authentication point and the baseline authentication point are located; The newly created first key fragment is fed back to the first server based on the newly created user authentication point, so that the first server splices the newly created first key fragments returned by each of the second servers into complete newly created key information, and then uses the newly created user identifier and the newly created key information as the identity request result for the identity application request, and the key information is the newly created key information in the identity request result.

9. The method according to claim 8, characterized in that, The step of feeding back the newly created first key fragment for the newly created user identifier to the first server based on the newly created user authentication point includes: The x-coordinate of the newly created user authentication point is used as the key value corresponding to the newly created first key fragment and fed back to the first server.

10. The method according to claim 9, characterized in that, The method further includes: The ordinate of the newly created user authentication point is used as the key value corresponding to the newly created second key segment, and the mapping relationship between the newly created user identifier and the newly created second key segment is established and stored in its own database.

11. An identity authentication device, characterized in that, Applied to a first server, the device includes: The first acquisition module is used to acquire an identity verification request initiated by a user to be authenticated on the client; the identity verification request carries key information; the key information is the newly created key information in the identity request result; The splitting and sending module is used to split the key information into several first key fragments and send them to multiple second servers for verification. The determining module is used to determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers; the key verification result is determined based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates; the user authentication point coordinates are composed of the first key fragments; the baseline authentication point coordinates and the node authentication point coordinates are pre-allocated by the second server as an authentication node; The device further includes: The acquisition and allocation module is used to acquire the client's identity application request and allocate a newly created user identifier to the new user who initiates the identity application request; The second acquisition module is used to acquire the newly created first key fragment returned by each of the second servers for the newly created user identifier; the newly created first key fragment is determined based on the newly created user authentication point; the newly created user authentication point is selected by the second server on the straight line between the node authentication point and the reference authentication point after acquiring the newly created user identifier; The splicing and determination module is used to splice the newly created first key fragments into complete newly created key information, and to use the newly created user identifier and the newly created key information as the identity request result for the identity application request.

12. An identity authentication device, characterized in that, Applied to a second server, the device includes: The acquisition and determination module is used to acquire a first key fragment from a first server and determine the coordinates of a user authentication point for the user to be authenticated, which is composed of the first key fragment; the first key fragment is obtained by the first server after splitting the key information carried in the identity verification request initiated by the user to be authenticated. The third acquisition module is used to acquire the coordinates of the baseline authentication point and the node authentication point pre-allocated by the second server as the authentication node; The first feedback module is used to feed back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the baseline authentication point coordinates and the node authentication point coordinates, so that the first server can determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers. The first feedback module includes: The second determining submodule is used to determine the straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and to determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line. The first feedback submodule is used to send a key verification result indicating successful verification to the first server if the verification is successful; otherwise, it sends a key verification result indicating failed verification to the first server.

13. An identity authentication system, characterized in that, The identity authentication system includes a client, a first server, and a second server; The first server is used to obtain the identity verification request initiated by the client user to be authenticated; the identity verification request carries key information; The first server is used to split the key information into several first key fragments and send them to multiple second servers for verification; The second server is used to determine the user authentication point coordinates for the user to be authenticated, which are composed of the first key fragments. After obtaining the baseline authentication point coordinates and node authentication point coordinates pre-allocated by the second server as an authentication node, the second server feeds back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the baseline authentication point coordinates and the node authentication point coordinates. The second server is used to feed back the key verification result for the first key fragment to the first server based on the user authentication point coordinates, the baseline authentication point coordinates, and the node authentication point coordinates, including: Determine a straight line passing through the reference authentication point corresponding to the coordinates of the reference authentication point and the node authentication point corresponding to the coordinates of the node authentication point, and determine whether the user authentication point corresponding to the coordinates of the user authentication point is located on the straight line; If yes, then send a key verification result indicating successful verification to the first server; otherwise, send a key verification result indicating failed verification to the first server. The first server is used to determine the identity verification result for the identity verification request based on the key verification results returned by each of the second servers; The client is used to obtain the identity verification result from the first server.

14. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of an authentication method as described in any one of claims 1-3 or 4-10.

15. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of an authentication method as described in any one of claims 1-3 or 4-10.

Images