Identity authentication method and device based on 5G message

Abstract

The present application proposes an identity authentication method and device based on 5G messages, which relates to the field of communication technology. Among them, the method applied to the authentication platform includes: in response to receiving an identity authentication request, determining the identification information of the object to be authenticated according to the identity authentication request, and determining the terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated; generating information to be verified according to the identity authentication request; sending the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information; obtaining the verification instruction information sent by the terminal device, and performing identity authentication of the object to be authenticated according to the verification instruction information. This solution can simplify the user operation of the identity authentication process, and can also avoid information leakage and ensure the security of the operation.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a 5G message-based identity authentication method and device. Background Art

[0002] With the development of Internet technology, various application platforms have emerged to provide convenience for people's lives. Usually, when using application platforms, in order to avoid the risk of non-personal operation, user identity authentication is required.

[0003] In the related art, identity authentication methods include static passwords, SMS verification codes and single-point authentication methods. However, all of the above three identity authentication methods have certain security risks, and the authentication process is relatively cumbersome. Summary of the invention

[0004] In order to solve the above problems, the present application provides an identity authentication method and device based on 5G messages.

[0005] According to a first aspect of the present application, a 5G message-based identity authentication method is provided, which is applied to an authentication platform and includes:

[0006] In response to receiving an identity authentication request, determining identification information of an object to be authenticated according to the identity authentication request, and determining a terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated;

[0007] Generate information to be verified according to the identity authentication request;

[0008] Sending the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information;

[0009] Acquire the verification instruction information sent by the terminal device, and perform identity authentication of the object to be authenticated according to the verification instruction information.

[0010] According to a second aspect of the present application, a 5G message-based identity authentication method is provided, which is applied to a terminal device and includes:

[0011] Receive 5G messages;

[0012] Determine the information to be verified according to the 5G message; wherein the information to be verified is information generated by the authentication platform according to the received identity authentication request;

[0013] Encrypting the information to be verified to generate verification instruction information;

[0014] The verification instruction information is sent to the authentication platform; wherein the verification instruction information is used by the authentication platform to perform identity authentication on the authentication object.

[0015] According to a third aspect of the present application, an identity authentication system is provided, comprising:

[0016] An authentication platform, used to implement the method described in the first aspect above;

[0017] Terminal device, used to implement the method described in the second aspect above.

[0018] According to a fourth aspect of the present application, a 5G message-based identity authentication device is provided, which is applied to an authentication platform, and includes:

[0019] A first determination module is used to determine, in response to receiving an identity authentication request, identification information of an object to be authenticated according to the identity authentication request, and to determine a terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated;

[0020] A first generating module, used to generate information to be verified according to the identity authentication request;

[0021] A first sending module, used to send the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information;

[0022] The authentication module is used to obtain the authentication instruction information sent by the terminal device and perform identity authentication of the object to be authenticated according to the authentication instruction information.

[0023] According to a fifth aspect of the present application, a 5G message-based identity authentication device is provided, which is applied to a terminal device, and includes:

[0024] A first receiving module, used for receiving a 5G message;

[0025] A second determination module is used to determine the information to be verified according to the 5G message; wherein the information to be verified is information generated by the authentication platform according to the received identity authentication request;

[0026] An encryption module, used for encrypting the information to be verified to generate verification instruction information;

[0027] The second sending module is used to send the verification instruction information to the authentication platform; wherein the verification instruction information is used by the authentication platform to perform identity authentication on the authentication object.

[0028] According to the sixth aspect of the present application, an electronic device is provided, comprising: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to execute the instructions to implement the method described in the first aspect above, and / or to implement the method described in the second aspect above.

[0029] According to the seventh aspect of the present application, a computer-readable storage medium is provided. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in the first aspect above, and / or execute the method described in the second aspect above.

[0030] According to the technical solution of the present application, after receiving an identity authentication request, the identification information of the object to be authenticated is determined according to the identity authentication request, and the terminal device associated with the object to be authenticated is determined according to the identification information of the object to be authenticated, and the information to be verified is generated according to the identity authentication request, and the information to be verified is sent to the terminal device in the form of a 5G message, and the verification instruction information obtained by encrypting the information to be verified by the terminal device is obtained, so as to perform identity authentication on the object to be authenticated according to the verification instruction information. This solution can realize identity authentication based on 5G messages without the need for users to perform cumbersome operations, which can not only simplify user operations in the identity authentication process, but also avoid information leakage. In addition, the verification instruction information of the data transmitted during the authentication process is encrypted, which ensures the confidentiality of information during the identity authentication interaction process, thereby further improving the security of the operation.

[0031] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0033] Figure 1 A flowchart of a 5G message-based identity authentication method provided in an embodiment of the present application;

[0034] Figure 2 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application;

[0035] Figure 3 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application;

[0036] Figure 4 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application;

[0037] Figure 5 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application;

[0038] Figure 6 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application;

[0039] Figure 7 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application;

[0040] Figure 8 A structural diagram of an identity authentication system provided for this application;

[0041] Fig. 9 A structural block diagram of a 5G message-based identity authentication device provided in an embodiment of the present application;

[0042] Fig.10 A structural block diagram of another identity authentication device based on 5G messages provided in an embodiment of the present application

[0043] Fig.11 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0045] It should be noted that, with the development of Internet technology, various application platforms have emerged to provide convenience for people's lives. Usually, when using application platforms, in order to avoid the risk of non-personal operation, it is necessary to authenticate the user's identity.

[0046] In the relevant technology, identity authentication methods include static passwords, SMS verification codes and single-point authentication methods. Among them, identity authentication based on user static passwords is the most traditional and widely used authentication method. In an application system that uses a static password method, the user presets a password in the system in advance, fills in the password when logging in and submits it to the system. The system confirms the user's identity by verifying the password. However, the traditional static password authentication method has obvious limitations. The security of the password depends on the strength of the password, regular updates, and the user's reasonable password management method. At present, weak passwords and long-term non-update problems are widespread. At the same time, if the user's password is not kept properly, or a browser password plug-in is used, it will bring great security risks to user identity authentication.

[0047] Single-point authentication based on third-party platforms is common in large-scale Internet platforms, usually accompanied by mutual traffic diversion and content sharing, and is mainly used in Internet application platforms that form an ecosystem. The application system usually guides users to complete identity authentication on the third-party platform, and authorizes the authentication results of the third-party platform to the application system, thereby indirectly completing user identity authentication. However, since single-point authentication relies on a third-party platform to complete identity verification, all authentication behaviors are left on the third-party platform, and the leakage of user operation behavior data cannot be avoided.

[0048] Identity authentication based on dynamic SMS verification codes is widely used in various Internet applications and is showing a trend of continuous growth. When a user logs in, the application system directly or indirectly sends a one-time verification code to the user through the operator's SMS. The user fills in the password and submits it to the system. The system confirms the user's identity by verifying the verification code password filled in by the user. Usually, the SMS verification code is presented as plain text on the terminal, which poses a risk of being stolen, and the user needs to manually fill it in, which is relatively cumbersome.

[0049] In order to solve the above problems, the present application provides an identity authentication method and device based on 5G messages.

[0050] Figure 1 This is a flow chart of a 5G message-based identity authentication method provided in an embodiment of the present application. It should be noted that the 5G message-based identity authentication method in an embodiment of the present application is applied to an authentication platform, for example, the authentication platform can be a server for implementing identity authentication. Figure 1 As shown, the identity authentication method based on 5G messages in the embodiment of the present application may include the following steps:

[0051] Step 101, in response to receiving an identity authentication request, determining identification information of an object to be authenticated according to the identity authentication request, and determining a terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated.

[0052] The identity authentication request received by the authentication platform may be sent by the application platform, where the application platform may refer to the server of the Internet application. As an example scenario, if application A is installed in the terminal device, when the user logs in to application A through the terminal device, the terminal device sends the user's request to log in to application A to the server of application A, and the server of application A generates an identity authentication request and sends the identity authentication request to the authentication platform.

[0053] As an example, the identity authentication request may carry identification information of the object to be authenticated, identification information of the application platform, etc. The object to be authenticated may be a user to be authenticated, and the identification information of the object to be authenticated may be a mobile phone number of the object to be authenticated, or a unique identifier for distinguishing the object to be authenticated.

[0054] In some embodiments of the present application, the terminal device associated with the object to be authenticated may be a terminal device held by the object to be authenticated, for example, a mobile terminal device such as a mobile phone or a tablet computer of the object to be authenticated.

[0055] As a possible implementation method, the implementation method of determining the terminal device associated with the object to be authenticated based on the identification information of the object to be authenticated may include: the authentication platform pre-stores the correspondence between the identification information of the object to be authenticated and the terminal device associated with the object to be authenticated. For example, the authentication platform pre-stores the correspondence between the identification information of the object to be authenticated and the mobile phone number of the associated terminal device. Based on the identification information of the object to be authenticated, the mobile phone number of the terminal device associated with the object to be authenticated can be determined, thereby determining the terminal device associated with the object to be authenticated.

[0056] Step 102: Generate information to be verified according to the identity authentication request.

[0057] In some embodiments of the present application, the information to be verified has a one-to-one relationship with the identity authentication request, that is, a unique piece of information to be verified can be generated based on one identity authentication request. The information to be verified can be information that at least includes the identification information of the application platform, the request time, and the identification information of the object to be authenticated. According to the identity authentication request, the implementation method of generating the information to be verified may include: determining the identification information and request time of the application platform according to the identity authentication request; generating the information to be verified according to the identification information of the application platform, the request time, and the identification information of the object to be authenticated.

[0058] Step 103, sending the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information.

[0059] That is to say, the authentication platform can encapsulate the information to be verified into a 5G message, and send the encapsulated 5G message to the 5G message platform, which will then be sent to the terminal device by the 5G message platform, so that the object to be authenticated can receive the 5G message through the terminal device and implement the identity authentication operation by triggering the 5G message.

[0060] As a possible implementation method, the authentication platform can construct 5G message data according to the request format of the 5G message platform. For example, according to the RCC.07 standard, a rich media card is used, and the content includes information to be verified. The card contains two suggested reply objects. The two suggested reply object names respectively guide the user to click to confirm the identity authentication and cancel the identity authentication; the authentication platform carries the constructed 5G message card data and the identification information of the terminal device and encapsulates it into a 5G message request, and sends the 5G message request to the 5G message platform, so that the 5G message platform can send the 5G message to the corresponding terminal device.

[0061] In some embodiments of the present application, after receiving the 5G message, the terminal device determines the information to be verified based on the 5G message, and encrypts the information to be verified to generate verification instruction information.

[0062] Step 104, obtaining the verification instruction information sent by the terminal device, and performing identity authentication of the object to be authenticated according to the verification instruction information.

[0063] As an example, the verification instruction information can be sent directly from the terminal device to the authentication platform based on the communication connection between the terminal device and the authentication platform. As another example, the verification instruction information can be sent from the terminal device to the authentication platform in the form of a 5G message, that is, the terminal device sends the verification instruction information to the 5G message platform, and the 5G message platform sends the corresponding 5G message to the authentication platform.

[0064] In some embodiments of the present application, performing identity authentication of the object to be authenticated according to the verification instruction information may include: verifying whether the verification instruction information is obtained by directly encrypting the information to be authenticated by the corresponding terminal device and has not been tampered with.

[0065] In some other embodiments of the present application, the verification instruction information may further include the verification initiation time, and the identity authentication of the object to be authenticated according to the verification instruction information may include checking whether the identity authentication has timed out.

[0066] As a possible implementation method, the terminal device stores a private key corresponding to the object to be authenticated, and the authentication platform stores a corresponding public key. The terminal device encrypts the information to be authenticated by using the private key corresponding to the object to be authenticated to obtain verification instruction information; the authentication platform decrypts the verification instruction information by using the corresponding public key to determine whether the decrypted result is the information to be authenticated; if the decrypted result is the information to be authenticated, then the identity authentication result of the object to be authenticated is determined to be successful authentication, otherwise it is determined to be a failed authentication.

[0067] As another possible implementation method, before initiating an identity authentication request, the terminal device associated with the object to be authenticated needs to be registered on the authentication platform. During the registration stage, the authentication platform stores the registration information of the object to be authenticated, the identification information of the object to be authenticated, and the information of the terminal device, and communicates with the terminal device storage so that the terminal device generates a private key of the object to be authenticated based on the communication content; the authentication platform is provided with an authentication platform public key and an authentication platform private key; the terminal device encrypts the information to be authenticated in a preset manner based on the authentication platform public key and the private key of the object to be authenticated to obtain verification instruction information; the authentication platform encrypts the information to be authenticated in another preset manner based on the authentication platform public key and the authentication platform private key, and determines whether the verification instruction information can be obtained to realize identity authentication of the object to be authenticated.

[0068] In some embodiments of the present application, the authentication platform can send the identity authentication result of the authentication object to the corresponding identity authentication request initiator. For example, the identity authentication request is sent by the application platform to the authentication platform. After the identity authentication, the authentication platform sends the identity authentication result to the application platform.

[0069] It should be noted that if the information to be verified contains information such as the application platform identification information, the identification information of the object to be verified, the time when the authentication request was initiated, etc., then the information to be verified corresponding to different identity authentication requests is different, that is, the information to be verified is unique, so the verification instruction information is also unique, and the verification instruction information cannot decipher the content of the transmission during the transmission process, so the security of information in the identity authentication process can be greatly improved.

[0070] It can be understood that the identity authentication method based on 5G messages in the embodiment of the present application uses 5G messages to interact with the terminal device, allowing the user to directly trigger the 5G message to implement the operation of the identity authentication process, simplifying the operation of the identity authentication process, and avoiding the huge and complicated password management system of static password authentication. At the same time, this method does not introduce a third-party authentication system, so the problem of information leakage can be avoided. The interaction between the terminal device and the authentication platform can be displayed through 5G messages, so that the content can be hidden, making up for the risk of verification code leakage in the SMS authentication method and improving security. In addition, the verification instruction information is encrypted information, which can further improve the security of the information transmission process.

[0071] According to the identity authentication method based on 5G messages of the embodiment of the present application, after receiving the identity authentication request, the identification information of the object to be authenticated is determined according to the identity authentication request, and the terminal device associated with the object to be authenticated is determined according to the identification information of the object to be authenticated, and the information to be verified is generated according to the identity authentication request, and the information to be verified is sent to the terminal device in the form of a 5G message, and the verification instruction information obtained by encrypting the information to be verified by the terminal device is obtained, so as to perform identity authentication on the object to be authenticated according to the verification instruction information. This scheme can realize identity authentication based on 5G messages without the need for users to perform cumbersome operations, which can not only simplify user operations in the identity authentication process, but also avoid information leakage. In addition, the verification instruction information of the data transmitted during the authentication process is encrypted, which ensures the confidentiality of the information during the identity authentication interaction process, thereby further improving the security of the operation.

[0072] Next, a specific implementation method for performing identity authentication of the object to be authenticated according to the verification instruction information will be introduced.

[0073] Figure 2 This is a flow chart of another 5G message-based identity authentication method provided in an embodiment of the present application. Figure 2 As shown, based on the above embodiments, Figure 1 The implementation method of performing identity authentication of the object to be authenticated according to the authentication instruction information in step 104 may include the following steps:

[0074] Step 201, determine a first verification value according to the verification instruction information; wherein the first verification value is obtained by encrypting the information to be verified by the terminal device based on a preset base point of the elliptic curve, a preset authentication platform public key, a preset first hash function, a preset second hash function, the identification information of the object to be authenticated and a preset private key of the object to be authenticated.

[0075] In some embodiments of the present application, the verification instruction information may be obtained by concatenating the first verification value with the verification initiation time, so the first verification value may be determined directly according to the verification instruction information. The specific implementation process of the terminal device generating the first verification value may refer to the following embodiment of the identity authentication method based on 5G messages applied to the terminal device side.

[0076] Step 202: verify the first verification value based on the base point of the elliptic curve, the public key of the authentication platform, the first Hash function, the second Hash function, the identification information of the object to be authenticated, and the information to be verified.

[0077] Among them, the base point of the elliptic curve, the authentication platform public key, the first hash function, and the second hash function are all pre-set during the initialization process before identity authentication.

[0078] In some embodiments of the present application, before identity authentication is performed, the authentication platform needs to be initialized to determine the parameter configuration. For example, a non-singular elliptic curve G with a base point P of the elliptic curve and an order q can be selected; the authentication platform private key is randomly selected, and the authentication platform public key is generated based on the base point of the elliptic curve and the authentication platform private key; based on the non-singular elliptic curve G, three one-way hash functions are selected as shown in the following formula (18). At the same time, before identity authentication, the terminal device associated with the object to be authenticated also needs to be initialized. The purpose of the initialization is to pre-set a set of parameters that are consistent with the parameters of the authentication platform after initialization.

[0079] H1:

[0080] H2:

[0081]

[0082] Where H1 is the first hash function; H2 is the second hash function; H3 is the third hash function; G is the multiplication cycle group of all used elliptic curves; {0,1} * is a binary bit string of arbitrary length; is the integer multiplication cyclic group. That is, the first hash function represents the mapping of the input binary data and two elements on the elliptic curve to an integer, and the mapping is irreversible; the second hash function represents the mapping of the binary data, an elliptic curve element, multiple integers and another elliptic curve element input in sequence to an integer, and the mapping is irreversible; the third hash function represents the irreversible mapping of an elliptic curve element to an integer.

[0083] That is to say, the process of verifying the first verification value based on the base point of the elliptic curve, the public key of the authentication platform, the first hash function, the second hash function, the identification information of the object to be authenticated and the information to be verified is equivalent to determining whether the first verification value is obtained by encrypting the information to be verified by the terminal device based on the base point of the elliptic curve, the public key of the authentication platform, the first hash function, the second hash function, the identification information of the object to be authenticated and the private key of the object to be authenticated.

[0084] As a possible implementation method, a first verification value and a second verification value can be generated according to the base point of the elliptic curve, the public key of the authentication platform, the first hash function, the second hash function, the information to be verified and the identification information of the user to be authenticated; the first verification value is verified by determining whether the first verification value is consistent with the second verification value; if the first verification value is consistent with the second verification value, the verification result of the first verification value is determined to be a successful verification; otherwise, the verification result of the first verification value is a failed verification.

[0085] In some embodiments of the present application, the implementation process of step 202 also includes: determining the verification initiation time according to the verification instruction information; determining whether the identity authentication has timed out according to the verification initiation time; if the identity authentication has not timed out, verifying the first verification value based on the base point of the elliptic curve, the authentication platform public key, the first hash function, the second hash function, the identification information of the object to be authenticated, and the information to be verified.

[0086] That is, before verifying the first verification value, it can be determined whether the identity authentication has timed out to ensure that the first verification value is valid for a period of time, thereby further improving the security of the identity authentication process.

[0087] Among them, the process of determining whether the identity authentication has timed out may include: comparing the verification initiation time with the time when the verification instruction information is obtained to obtain a first time difference; comparing the verification initiation time with the initiation time of the identity authentication request to obtain a second time difference; comparing the first time difference with the first time threshold, and comparing the second time difference with the second time threshold; if the first time difference is less than the first time threshold, and the second time difference is less than the second time threshold, it is determined that the identity authentication has not timed out, otherwise, it is determined that the identity authentication has timed out.

[0088] Step 203: Determine the identity authentication result of the object to be authenticated according to the verification result of the first verification value.

[0089] That is to say, if the verification result of the first verification value is verification success, the identity authentication result of the object to be authenticated is authentication success, otherwise, the identity authentication result of the object to be authenticated is authentication failure.

[0090] According to the identity authentication method based on 5G messages in the embodiment of the present application, the first verification value is verified according to the base point of the elliptic curve, the public key of the authentication platform, the first hash function, the second hash function, the identification information of the object to be authenticated and the information to be authenticated, and the identity authentication result of the object to be authenticated is determined according to the verification result of the first verification value to realize the identity authentication of the object to be authenticated. This scheme performs identity authentication based on the first verification value determined by the verification instruction information, which can further ensure the security of information.

[0091] Next, we will focus on Figure 2 Step 202 in FIG. 1 is described in detail.

[0092] Figure 3 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application. Figure 3 As shown, based on the above embodiment, Figure 2 The implementation process of step 202 in may include the following steps:

[0093] Step 301: determine the hidden identity information corresponding to the identification information of the object to be authenticated.

[0094] In some embodiments of the present application, corresponding concealed identity information can be generated according to the identification information of the object to be authenticated during the registration stage of the terminal device. The concealed identity information refers to the result of encrypting the registration information of the object to be authenticated. In other words, the authentication platform stores the corresponding relationship between the identification information of the object to be authenticated and the concealed identity information, so the corresponding concealed identity information can be directly determined according to the identification information of the object to be authenticated. For the specific calculation process of the concealed identity information, please refer to the description in the following embodiments.

[0095] Step 302: Based on the first Hash function, encrypt the identification information of the object to be authenticated, the hidden identity identification information and the public key of the authentication platform to obtain a first authentication intermediate value.

[0096] The expression of the first authentication intermediate value is as follows:

[0097] A=H1(ID,IC,Pu) (1)

[0098] Among them, A is the first authentication intermediate value; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the authentication platform public key.

[0099] Step 303, generating first hidden information and second hidden information according to the information to be verified, the first Hash function, the base point of the elliptic curve, the authentication platform public key, the hidden identity identification information and the identification information of the object to be authenticated.

[0100] The first hidden information and the second hidden information are respectively encrypted information to be verified.

[0101] As a possible implementation method, the implementation process of step 303 may include: generating first hidden information based on the information to be verified and the base point of the elliptic curve; generating second hidden information based on the information to be verified, the first hash function, the authentication platform public key, the hidden identity identification information and the identification letter of the object to be authenticated.

[0102] As an example, the calculation process of generating the first hidden information according to the information to be verified and the base point of the elliptic curve is as shown in formula (2):

[0103] L=l·P (2)

[0104] Wherein, L is the first hidden information; l is the information to be verified; and P is the base point of the elliptic curve.

[0105] As an example, the calculation process of generating the second hidden information according to the information to be verified, the first Hash function, the public key of the authentication platform, the hidden identity identification information and the identification information of the object to be authenticated is as shown in formula (3):

[0106] M=l·(IC+H1(ID,IC,Pu)·Pu) (3)

[0107] Among them, M is the second hidden information; l is the information to be verified; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the authentication platform public key.

[0108] Step 304: Based on the second Hash function, encrypt the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information and the second hidden information to obtain a second authentication intermediate value.

[0109] The expression of the second authentication intermediate value is as follows:

[0110] B=H2(ID,IC,L,M) (4)

[0111] Among them, B is the second authentication intermediate value; H2 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; L is the first hidden information; M is the second hidden information.

[0112] Step 305: verify the first verification value according to the first authentication intermediate value, the second authentication intermediate value, the base point of the elliptic curve, the hidden identity identification information, the authentication platform public key and the first hidden information.

[0113] In some embodiments of the present application, the implementation process of verifying the first verification value based on the first authentication intermediate value, the second authentication intermediate value, the base point of the elliptic curve, the hidden identity identification information, the authentication platform public key and the first hidden information may include: determining the first verification value based on the first verification value and the base point of the elliptic curve; determining the second verification value based on the first hidden information, the first authentication intermediate value, the second authentication intermediate value, the hidden identity identification information and the authentication platform public key; judging whether the first verification value is consistent with the second verification value; if the first verification value is consistent with the second verification value, determining that the first verification value verification is successful.

[0114] As an example, according to the first verification value and the base point of the elliptic curve, the process of determining the first check value can be as follows (5):

[0115] m=D·P (5)

[0116] Among them, m is the first check value; D is the first verification value; P is the base point of the elliptic curve.

[0117] As an example, according to the first hidden information, the first authentication intermediate value, the second authentication intermediate value, the hidden identity information and the authentication platform public key, the process of determining the second verification value can be as follows (6):

[0118] n=L+B·IC+AB·Pu (6)

[0119] Among them, n is the second check value; L is the first hidden information; A is the first authentication intermediate value; B is the second authentication intermediate value; IC is the hidden identity identification information; Pu is the authentication platform public key.

[0120] The principle that the first verification value is consistent with the second verification value and the verification result of the first verification value can be determined as a successful verification will be explained in the following embodiments.

[0121] Next, the registration phase will be introduced.

[0122] Figure 4 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application. Figure 4 As shown, based on the above embodiment, Figure 1 The following steps may also be included before step 101:

[0123] Step 401, receiving registration information of an object to be authenticated and identification information of the object to be authenticated sent by a terminal device; wherein the registration information of the object to be authenticated is generated by the terminal device based on a base point of an elliptic curve.

[0124] In some embodiments of the present application, the terminal device can generate a random number during the registration phase, obtain the registration information of the object to be authenticated based on the random number and the base point of the elliptic curve, and send the registration information of the object to be authenticated and the identification information of the object to be authenticated to the authentication platform.

[0125] As an example, the registration information of the object to be authenticated is expressed as follows (7):

[0126] W=V·P (7)

[0127] Wherein, W is the registration information of the object to be authenticated; V is the random number generated by the terminal device; and P is the base point of the elliptic curve.

[0128] Step 402, generating hidden identity information and a shared private key according to the registration information of the object to be authenticated, the base point of the elliptic curve, the authentication platform public key, the identification information of the object to be authenticated, the preset authentication platform private key, the preset third Hash function and the first Hash function.

[0129] As a possible implementation method, the implementation method of step 402 may include: generating hidden identity identification information based on the registration information of the object to be authenticated and the base point of the elliptic curve; generating a shared private key based on the registration information of the object to be authenticated, the first hash function, the third hash function, the identification information of the object to be authenticated, the hidden identity identification information, the authentication platform private key, and the authentication platform public key.

[0130] As an example, the calculation process of generating the hidden identity information according to the registration information of the object to be authenticated and the base point of the elliptic curve is as follows (8):

[0131] IC=W+R·P=V·P+R·P (8)

[0132] Among them, IC is the hidden identity identification information; W is the registration information of the object to be authenticated; V is the random number generated by the terminal device; P is the base point of the elliptic curve; R is the random number generated by the authentication platform.

[0133] As an example, according to the registration information of the object to be authenticated, the first hash function, the third hash function, the identification information of the object to be authenticated, the hidden identity identification information, the authentication platform private key, and the authentication platform public key, the process of generating a shared private key is as follows (9):

[0134] E=H3(S·W)+R+S·H1(ID,IC,Pu) (9)

[0135] Among them, E is the shared private key; H3 is the third hash function; S is the authentication platform private key; W is the registration information of the object to be authenticated; R is the random number generated by the authentication platform; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the authentication platform public key.

[0136] Step 403, sending the hidden identity information and the shared private key to the terminal device; wherein the shared private key is used by the terminal device to generate the private key of the object to be authenticated.

[0137] That is to say, through the registration stage, the authentication platform obtains the correspondence between the terminal device associated with the object to be authenticated and the identification information of the object to be authenticated, and at the same time obtains the correspondence between the identification information of the object to be authenticated and the hidden identity identification information, and also obtains the shared private key between the terminal device.

[0138] Next, the above embodiment will be described. Figure 3 In step 305, if the first verification value is consistent with the second verification value, the verification result of the first verification value can be determined to be a successful verification.

[0139] If the expression of the first verification value generated by the terminal device is as follows (10):

[0140] D=l+sk·H2(ID,IC,L,M) (10)

[0141] Among them, D is the first verification value; sk is the private key of the object to be verified; H2 is the second hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; L is the first hidden information; M is the second hidden information.

[0142] Based on equations (4), (5) and (10), the first check value is decomposed into equation (11):

[0143] m=D·P=(l+sk·H2(ID,IC,L,M))·P

[0144] =l·P+sk·H2(ID,IC,L,M)·P

[0145] =L+sk·B·P (11)

[0146] Among them, m is the first check value; D is the first verification value; P is the base point of the elliptic curve; l is the information to be verified; sk is the private key of the object to be verified; H2 is the second hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; L is the first hidden information; M is the second hidden information; B is the second authentication intermediate value.

[0147] The authentication platform public key can be determined based on the authentication platform private key and the base point of the elliptic curve, as shown in the following formula (12):

[0148] Pu=S·P (12)

[0149] Among them, Pu is the public key of the authentication platform; S is the private key of the authentication platform; and P is the base point of the elliptic curve.

[0150] Based on equation (6) and equation (12), we get equation (13):

[0151] n=L+B·IC+AB·Pu=L+B·IC+A·B·S·P (13)

[0152] Among them, n is the second check value; L is the first hidden information; A is the first authentication intermediate value; B is the second authentication intermediate value; IC is the hidden identity identification information; Pu is the authentication platform public key; S is the authentication platform private key; P is the base point of the elliptic curve.

[0153] Based on equations (11) and (13), judging whether the first check value is consistent with the second check value is equivalent to judging whether sk·B·P is equal to B·IC+A·B·S·P.

[0154] If the private key of the object to be authenticated can be calculated by the following formula (14):

[0155] sk=E-H3(V·Pu)+V (14)

[0156] Among them, sk is the private key of the object to be authenticated; E is the shared private key; H3 is the third hash function; V is the random number generated by the terminal device; Pu is the public key of the authentication platform.

[0157] Based on equation (9), equation (7), equation (12) and equation (14), the following equation (15) is obtained:

[0158] sk=H3(S·W)+R+S·H1(ID,IC,Pu)-H3(V·Pu)+V

[0159] =H3(S·V·P)+R+S·H1(ID,IC,Pu)-H3(V·S·P)+V

[0160] =R+S·H1(ID,IC,Pu)+V (15)

[0161] Among them, H3 is the third hash function; S is the private key of the authentication platform; W is the registration information of the object to be authenticated; R is the random number generated by the authentication platform; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the public key of the authentication platform; P is the base point of the elliptic curve; V is the random number generated by the terminal device; sk is the private key of the object to be authenticated.

[0162] Based on equation (15) and equation (1), the following equation (16) is obtained:

[0163] sk·B·P=[R+S·H1(ID,IC,Pu)+V]·B·P=[R+S·A+V]·B·P

[0164] =R·B·P+S·A·B·P+V·B·P (16)

[0165] Based on formula (8), the following formula (17) is obtained:

[0166] B·IC+A·B·S·P=B[V·P+R·P]+A·B·S·P

[0167] =B·V·P+B·R·P+A·B·S·P (17)

[0168] Based on equations (16) and (17), it can be determined that if the first verification value is correct, sk·B·P is equal to B·IC+A·B·S·P. In other words, if the first verification value is correct, the first verification value is consistent with the second verification value, that is, if the first verification value is consistent with the second verification value, it means that the first verification value is generated by the terminal device through the private key of the object to be authenticated and has not been tampered with.

[0169] Figure 5 This is a flowchart of another identity authentication method based on 5G messages provided in an embodiment of the present application. It should be noted that the identity authentication method based on 5G messages in an embodiment of the present application is applied to a terminal device, which can be a mobile terminal device such as a mobile phone or a laptop computer. Figure 5 As shown, the method may include the following steps:

[0170] Step 501, receiving a 5G message.

[0171] In some embodiments of the present application, the 5G message is generated by the authentication platform when receiving an identity authentication request and is issued by the 5G message platform. The 5G message may be in the form of a card, and the 5G message carries information to be verified.

[0172] Step 502, determine the information to be verified according to the 5G message; wherein the information to be verified is information generated by the authentication platform based on the received identity authentication request.

[0173] Among them, the 5G message can be encapsulated based on the information to be verified, so the information to be verified can be directly determined based on the 5G message.

[0174] As a possible implementation, after the user triggers a 5G message, a step of determining the information to be verified based on the 5G message may be executed.

[0175] As another implementation, the 5G message is in the form of a card and contains two clickable components after parsing, each clickable component corresponds to a guidance instruction, one of which is used to confirm the verification and the other is used to cancel the verification, and the user selects the corresponding component to click based on his or her own needs; in response to the verification trigger operation of the 5G message, the information to be verified is determined according to the 5G message.

[0176] Step 503: encrypt the information to be verified to generate verification instruction information.

[0177] As a possible implementation manner, the terminal device stores a private key corresponding to the object to be authenticated, and the terminal device encrypts the information to be authenticated by using the private key corresponding to the object to be authenticated to obtain the authentication instruction information.

[0178] Step 504, sending the verification instruction information to the authentication platform; wherein the verification instruction information is used by the authentication platform to perform identity authentication on the authentication object.

[0179] As a possible implementation method, the verification instruction information is sent to the 5G message platform, and the 5G message platform sends the verification execution information to the authentication platform in the form of a 5G message.

[0180] As another possible implementation manner, a communication connection is established between the terminal device and the authentication platform, and the terminal device directly communicates with the authentication platform to send the verification instruction information to the authentication platform.

[0181] According to the identity authentication method based on 5G messages in the embodiment of the present application, the terminal device receives the 5G message, determines the information to be verified based on the 5G message, and encrypts the information to be verified to generate verification instruction information, and sends the verification instruction information to the authentication platform, and the authentication platform performs identity authentication on the object to be authenticated based on the verification instruction information. This solution can realize identity authentication based on 5G messages without the need for users to perform cumbersome operations, which can not only simplify user operations in the identity authentication process, but also avoid information leakage. In addition, the verification instruction information of the data transmission during the authentication process is encrypted, which ensures the confidentiality of the information during the identity authentication interaction process, thereby further improving the security of the operation.

[0182] Next, the process of generating verification instruction information will be introduced in detail.

[0183] Figure 6 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application. Figure 6 As shown, based on the above embodiments, Figure 5 The implementation process of step 503 in may include the following steps:

[0184] Step 601, encrypting the information to be verified based on the preset base point of the elliptic curve, the preset authentication platform public key, the preset first hash function, the preset second hash function, the preset identification information of the object to be authenticated and the preset private key of the object to be authenticated to generate a first verification value.

[0185] As an example, before identity authentication, the authentication platform needs to perform an initialization process to set relevant parameters, including: selecting a non-singular elliptic curve G with a generator point P and an order q, randomly setting the authentication platform private key, and setting the authentication platform public key, and selecting three one-way hash functions based on the non-singular elliptic curve G, namely the first hash function, the second hash function and the third hash function, as shown in the above formula (18). At the same time, the terminal device also needs to be initialized, and its initialization process is equivalent to configuring the corresponding parameters initialized by the authentication platform into the terminal device.

[0186] In some embodiments of the present application, the implementation method of step 601 may include: generating first hidden information based on the base point of the elliptic curve and the information to be verified; determining the hidden identity identification information corresponding to the identification information of the object to be authenticated; generating second hidden information based on the information to be verified, the hidden identity identification information, the first hash function, the identification information of the object to be authenticated, and the public key of the authentication platform; generating a first verification value based on the information to be verified, the private key of the object to be authenticated, the second hash function, the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information, and the second hidden information.

[0187] As an example, according to the base point of the elliptic curve and the information to be verified, the process of generating the first hidden information can be as shown in the above formula (2).

[0188] As another example, the process of generating the second hidden information according to the information to be verified, the hidden identity identification information, the first Hash function, the identification information of the object to be authenticated, and the public key of the authentication platform can be as shown in the above formula (3).

[0189] As another example, the process of generating the first verification value according to the information to be verified, the private key of the object to be authenticated, the second hash function, the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information and the second hidden information is as shown in the above formula (10).

[0190] Step 602: Generate verification instruction information according to the first verification value.

[0191] In some embodiments of the present application, the implementation process of generating verification instruction information according to the first verification value may include: determining the verification initiation time; and concatenating the first verification value and the verification initiation time to obtain the verification instruction information. The verification initiation time may be the time when the verification instruction information is generated, or the time when the user triggers the 5G message.

[0192] Next, the registration phase of the terminal device will be introduced.

[0193] Figure 7 A flowchart of another 5G message-based identity authentication method provided in an embodiment of the present application. Based on the above embodiment, Figure 5 The step 501 in the method further includes the following steps:

[0194] Step 701: In response to a registration triggering operation of an object to be authenticated, identification information of the object to be authenticated is obtained.

[0195] As an example, the registration trigger operation of the object to be verified can be the operation of inserting a phone card, or the operation of turning on the phone for the first time, or it can be determined based on actual needs, and this application does not limit this.

[0196] The identification information of the object to be authenticated may be input by the user through the terminal device, or may be directly obtained based on a phone card in the terminal device.

[0197] Step 702: Generate registration information of the object to be authenticated according to the base point of the elliptic curve and the first random number.

[0198] As a possible implementation manner, the terminal device randomly generates a first random number, and performs calculation based on the first random number and the base point of the elliptic curve of the non-singular elliptic curve to obtain the registration information of the object to be authenticated, as shown in the above formula (7).

[0199] Step 703, sending the identification information of the object to be authenticated and the registration information of the object to be authenticated to the authentication platform; wherein the identification information of the object to be authenticated and the registration information of the object to be authenticated are used by the authentication platform to generate hidden identity information and a shared private key.

[0200] That is, the identification information of the object to be authenticated and the registration information of the object to be authenticated are sent to the authentication platform so that the authentication platform can perform identity registration.

[0201] Step 704: Receive the hidden identity information and the shared private key sent by the authentication platform, and store the corresponding relationship between the hidden identity and the identity of the object to be authenticated.

[0202] Step 705: Generate a private key of the object to be authenticated according to the shared private key, the third hash function, the first random number and the authentication platform public key.

[0203] As a possible implementation manner, the calculation process of generating the private key of the object to be authenticated according to the shared private key, the third hash function and the first random number is shown in the above formula (14).

[0204] In some other embodiments of the present application, in order to ensure that the received shared private key has not been tampered with, after step 705, the following is further included:

[0205] Step 706: verify the shared private key according to the first hash function, the hidden identity identification information, the identification information of the object to be authenticated, the preset base point of the elliptic curve and the preset authentication platform public key.

[0206] As a possible implementation method, a third verification value can be determined based on the private key of the object to be authenticated and the base point of the elliptic curve; a fourth verification value can be determined based on the first hash function, the hidden identity information, the identification information of the object to be authenticated and the public key of the authentication platform; and the verification result of the private key of the object to be authenticated is determined by judging whether the third verification value and the fourth verification value are consistent.

[0207] The process of determining the third check value is as follows:

[0208] a=sk·P (19)

[0209] Wherein, a is the third check value; P is the base point of the elliptic curve; sk is the private key of the object to be authenticated.

[0210] According to the first hash function, the hidden identity information, the identification information of the object to be authenticated and the public key of the authentication platform, the calculation process of determining the fourth check value is as follows (20):

[0211] b=IC+H1(ID,IC,Pu)Pu (20)

[0212] Among them, b is the fourth check value; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the authentication platform public key.

[0213] Substituting the above formula (15) into formula (19) yields the following formula (21):

[0214] a=(R+S·H1(ID,IC,Pu)+V)·P

[0215] =R·P+S·H1(ID,IC,Pu)·P+V·P (21)

[0216] Among them, a is the third check value; S is the private key of the authentication platform; R is the random number generated by the authentication platform; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the public key of the authentication platform; P is the base point of the elliptic curve; V is the random number generated by the terminal device; sk is the private key of the object to be authenticated.

[0217] Substituting the above equation (12) and the above equation (8) into the above equation (20) yields the following equation (22):

[0218] b=V·P+R·P+H1(ID,IC,Pu)·S·P (22)

[0219] Among them, b is the fourth check value; H1 is the first hash function; ID is the identification information of the object to be authenticated; IC is the hidden identity identification information; Pu is the public key of the authentication platform; S is the private key of the authentication platform; P is the base point of the elliptic curve; W is the registration information of the object to be authenticated; V is the random number generated by the terminal device; R is the random number generated by the authentication platform.

[0220] Based on the above formula (21) and the above formula (22), it can be determined that if the third verification value and the fourth verification value are equal, it means that the shared private key is generated using the real authentication platform private key and has not been tampered with, that is, the shared private key verification is successful.

[0221] Step 707: If the verification result of the shared private key is verification failure, the private key of the object to be authenticated is discarded.

[0222] In order to implement the above embodiments, the present application provides an identity authentication system.

[0223] Figure 8 This is a schematic diagram of the structure of an identity authentication system provided by this application. Figure 8 As shown, the system includes an authentication platform 801 and a terminal device 802. In some embodiments of the present application, the system may also include an application platform 803. The identity authentication process based on the system is as follows:

[0224] (1) The application platform 803 generates an identity authentication request and sends it to the authentication platform 801;

[0225] (2) The authentication platform 801 receives an identity authentication request, determines the identification information of the object to be authenticated based on the identity authentication request, and determines the terminal device associated with the object to be authenticated based on the identification information of the object to be authenticated; generates information to be authenticated based on the identity authentication request; and sends the information to be authenticated to the terminal device 802 in the form of a 5G message.

[0226] (3) The terminal device 802 receives the 5G message, determines the information to be verified according to the 5G message, encrypts the information to be verified, generates verification instruction information, and sends the verification instruction information to the authentication platform 801;

[0227] (4) The authentication platform 801 obtains the authentication instruction information, performs identity authentication on the object to be authenticated according to the authentication instruction information, and returns the identity authentication result to the application platform 803.

[0228] It should be noted that the aforementioned explanation of the embodiment of the identity authentication method based on 5G messages is also applicable to the identity authentication system of this embodiment and will not be repeated here.

[0229] According to the identity authentication system of the embodiment of the present application, after receiving the identity authentication request, the authentication platform determines the identification information of the object to be authenticated according to the identity authentication request, and determines the terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated, generates the information to be verified according to the identity authentication request, and sends the information to be verified to the terminal device in the form of a 5G message, and obtains the verification instruction information obtained by encrypting the information to be verified by the terminal device, so as to perform identity authentication on the object to be authenticated according to the verification instruction information. This scheme can realize identity authentication based on 5G messages without the need for users to perform cumbersome operations, which can not only simplify user operations in the identity authentication process, but also avoid information leakage. In addition, the verification instruction information of the data transmitted during the authentication process is encrypted, which ensures the confidentiality of the information during the identity authentication interaction process, thereby further improving the security of the operation.

[0230] In order to implement the above embodiments, the present application provides an identity authentication device based on 5G messages.

[0231] Fig. 9 This is a structural block diagram of a 5G message-based identity authentication device provided in an embodiment of the present application. It should be noted that the device is applied to the authentication platform. Fig. 9 As shown, the device may include:

[0232] A first determination module 910 is configured to, in response to receiving an identity authentication request, determine identification information of an object to be authenticated according to the identity authentication request, and determine a terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated;

[0233] A first generating module 920, configured to generate information to be verified according to an identity authentication request;

[0234] The first sending module 930 is used to send the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information;

[0235] The authentication module 940 is used to obtain the authentication instruction information sent by the terminal device and perform identity authentication of the object to be authenticated according to the authentication instruction information.

[0236] In some embodiments of the present application, the first generating module 920 is specifically used to:

[0237] Determine the identification information and request time of the application platform based on the identity authentication request;

[0238] The information to be verified is generated according to the identification information of the application platform, the request time and the identification information of the object to be authenticated.

[0239] In some embodiments of the present application, the authentication module 940 includes:

[0240] The first determination unit 941 is used to determine a first verification value according to the verification instruction information; wherein the first verification value is obtained by encrypting the information to be verified by the terminal device based on a preset base point of the elliptic curve, a preset authentication platform public key, a preset first hash function, a preset second hash function, identification information of the object to be authenticated, and a preset private key of the object to be authenticated;

[0241] A verification unit 942, configured to verify the first verification value based on the base point of the elliptic curve, the authentication platform public key, the first Hash function, the second Hash function, the identification information of the object to be authenticated, and the information to be verified;

[0242] The second determining unit 943 is used to determine the identity authentication result of the object to be authenticated according to the verification result of the first verification value.

[0243] As a possible implementation manner, the verification unit 942 is specifically configured to:

[0244] Determine the hidden identity information corresponding to the identification information of the object to be authenticated;

[0245] Based on the first hash function, encrypt the identification information of the object to be authenticated, the hidden identity identification information and the public key of the authentication platform to obtain a first authentication intermediate value;

[0246] Generate first hidden information and second hidden information according to the information to be verified, the first Hash function, the base point of the elliptic curve, the public key of the authentication platform, the hidden identity identification information and the identification information of the object to be authenticated;

[0247] Based on the second Hash function, encrypt the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information and the second hidden information to obtain a second authentication intermediate value;

[0248] The first verification value is verified according to the first authentication intermediate value, the second authentication intermediate value, the base point of the elliptic curve, the hidden identity identification information, the authentication platform public key and the first hidden information.

[0249] As an example, the verification unit 942 is further configured to:

[0250] Generate first hidden information according to the information to be verified and the base point of the elliptic curve;

[0251] The second hidden information is generated according to the information to be verified, the first Hash function, the authentication platform public key, the hidden identity identification information and the identification information of the object to be authenticated.

[0252] As another example, the verification unit 942 is further configured to:

[0253] Determine a first check value according to the first verification value and a base point of the elliptic curve;

[0254] Determine a second verification value according to the first hidden information, the first authentication intermediate value, the second authentication intermediate value, the hidden identity information and the authentication platform public key;

[0255] Determining whether the first check value is consistent with the second check value;

[0256] If the first verification value is consistent with the second verification value, it is determined that the first verification value verification is successful.

[0257] As another example, the verification unit 942 is further configured to:

[0258] Determine the verification initiation time according to the verification instruction information;

[0259] Determine whether the identity authentication has timed out based on the verification initiation time;

[0260] If the identity authentication has not timed out, the first verification value is verified based on the base point of the elliptic curve, the authentication platform public key, the first hash function, the second hash function, the identification information of the object to be authenticated, and the information to be verified.

[0261] In some embodiments of the present application, the device further includes a first registration module 950, and the first registration module 950 is used to:

[0262] Before receiving the identity authentication request, receiving the registration information of the object to be authenticated and the identification information of the object to be authenticated sent by the terminal device; wherein the registration information of the object to be authenticated is generated by the terminal device based on the base point of the elliptic curve;

[0263] Generate hidden identity information and a shared private key according to the registration information of the object to be authenticated, the base point of the elliptic curve, the public key of the authentication platform, the identification information of the object to be authenticated, the preset private key of the authentication platform, the preset third Hash function and the first Hash function;

[0264] The hidden identity information and the shared private key are sent to the terminal device; wherein the shared private key is used by the terminal device to generate the private key of the object to be authenticated.

[0265] As a possible implementation manner, the first registration module 950 is further used for:

[0266] Generate hidden identity information based on the registration information of the object to be authenticated and the base point of the elliptic curve;

[0267] A shared private key is generated according to the registration information of the object to be authenticated, the first Hash function, the third Hash function, the identification information of the object to be authenticated, the hidden identity identification information, the authentication platform private key, and the authentication platform public key.

[0268] It should be noted that the explanations in the above-mentioned embodiment of the identity authentication method based on 5G messages are also applicable to the embodiment of the identity authentication device based on 5G messages in this embodiment, and will not be repeated here.

[0269] According to the identity authentication device based on 5G messages in the embodiment of the present application, after receiving the identity authentication request, the identification information of the object to be authenticated is determined according to the identity authentication request, and the terminal device associated with the object to be authenticated is determined according to the identification information of the object to be authenticated, and the information to be verified is generated according to the identity authentication request, and the information to be verified is sent to the terminal device in the form of a 5G message, and the verification instruction information obtained by encrypting the information to be verified by the terminal device is obtained, so as to perform identity authentication on the object to be authenticated according to the verification instruction information. This scheme can realize identity authentication based on 5G messages without the need for users to perform cumbersome operations, which can not only simplify user operations in the identity authentication process, but also avoid information leakage. In addition, the verification instruction information of the data transmitted during the authentication process is encrypted, which ensures the confidentiality of the information during the identity authentication interaction process, thereby further improving the security of the operation.

[0270] Fig.10 This is a structural block diagram of another identity authentication device based on 5G messages provided in an embodiment of the present application. It should be noted that the identity authentication device based on 5G messages in an embodiment of the present application is applied to a terminal device. Fig.10 As shown, the device comprises:

[0271] A first receiving module 1010, configured to receive a 5G message;

[0272] The second determination module 1020 is used to determine the information to be verified according to the 5G message; wherein the information to be verified is information generated by the authentication platform according to the received identity authentication request;

[0273] The encryption module 1030 is used to encrypt the information to be verified to generate verification instruction information;

[0274] The second sending module 1040 is used to send the verification instruction information to the authentication platform; wherein the verification instruction information is used by the authentication platform to perform identity authentication on the authentication object.

[0275] In some embodiments of the present application, the second determining module 1020 is specifically used to:

[0276] In response to a verification trigger operation on the 5G message, information to be verified is determined according to the 5G message.

[0277] As a possible implementation, the encryption module 1030 includes:

[0278] The encryption unit 1031 is used to encrypt the information to be authenticated based on the preset base point of the elliptic curve, the preset authentication platform public key, the preset first hash function, the preset second hash function, the preset identification information of the object to be authenticated and the preset private key of the object to be authenticated to generate a first verification value;

[0279] The generating unit 1032 is configured to generate verification instruction information according to the first verification value.

[0280] As an example, the encryption unit 1031 is specifically used for:

[0281] Generate first hidden information according to the base point of the elliptic curve and the information to be verified;

[0282] Determine the hidden identity information corresponding to the identification information of the object to be authenticated;

[0283] Generate second hidden information according to the information to be verified, the hidden identity identification information, the first Hash function, the identification information of the object to be authenticated, and the public key of the authentication platform;

[0284] A first verification value is generated according to the information to be verified, the private key of the object to be authenticated, the second Hash function, the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information and the second hidden information.

[0285] As another example, the generating unit 1032 is specifically configured to:

[0286] Determine the time to initiate verification;

[0287] The first verification value and the verification initiation time are concatenated to obtain verification instruction information.

[0288] In some embodiments of the present application, the device further includes a second registration module 1050, and the second registration module 1050 is specifically used to:

[0289] In response to a registration triggering operation of the object to be authenticated, obtaining identification information of the object to be authenticated;

[0290] Generate registration information of the object to be authenticated according to the base point of the elliptic curve and the first random number;

[0291] Sending the identification information of the object to be authenticated and the registration information of the object to be authenticated to the authentication platform; wherein the identification information of the object to be authenticated and the registration information of the object to be authenticated are used by the authentication platform to generate hidden identity information and a shared private key;

[0292] Receive the hidden identity information and shared private key sent by the authentication platform, and store the corresponding relationship between the hidden identity and the identity of the object to be authenticated;

[0293] A private key of the object to be authenticated is generated according to the shared private key, the third hash function, the first random number and the authentication platform public key.

[0294] In some other embodiments of the present application, the second registration module 1050 is further used to:

[0295] Verifying the shared private key according to the first Hash function, the hidden identity identification information, the identification information of the object to be authenticated, the base point of the preset elliptic curve and the preset authentication platform public key;

[0296] If the verification result of the shared private key is verification failure, the private key of the object to be authenticated is discarded.

[0297] It should be noted that the explanations in the above-mentioned embodiment of the identity authentication method based on 5G messages are also applicable to the embodiment of the identity authentication device based on 5G messages in this embodiment, and will not be repeated here.

[0298] According to the identity authentication device based on 5G messages of the embodiment of the present application, the terminal device receives the 5G message, determines the information to be verified according to the 5G message, and encrypts the information to be verified to generate verification instruction information, and sends the verification instruction information to the authentication platform, and the authentication platform performs identity authentication on the object to be authenticated according to the verification instruction information. This solution can realize identity authentication based on 5G messages without the need for users to perform cumbersome operations, which can not only simplify user operations in the identity authentication process, but also avoid information leakage. In addition, the verification instruction information of the data transmission during the authentication process is encrypted, which ensures the confidentiality of the information during the identity authentication interaction process, thereby further improving the security of the operation.

[0299] In order to implement the above embodiments, the present application provides an electronic device.

[0300] Fig.11 This is a structural block diagram of an electronic device provided in an embodiment of the present application. The electronic device may be a server, a computer, or other device. Fig.11 As shown, the electronic device includes:

[0301] A memory 1110 and a processor 1120, a bus 1130 connecting different components (including the memory 1110 and the processor 1120), the memory 1110 stores executable instructions for the processor 1120; wherein the processor 1120 is configured to execute the instructions to implement the 5G message-based identity authentication method described in an embodiment of the present application.

[0302] Bus 1130 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0303] The electronic device 1100 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 1100, including volatile and non-volatile media, removable and non-removable media. The memory 1110 can also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1140 and / or cache memory 1150. The electronic device 1100 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 1160 can be used to read and write non-removable, non-volatile magnetic media ( Fig.11 not shown, usually called a "hard drive"). Although Fig.11 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to bus 1130 via one or more data medium interfaces. Memory 1110 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0304] A program / utility 1180 having a set (at least one) of program modules 1170 may be stored, for example, in the memory 1110, such program modules 1170 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 1170 generally perform the functions and / or methods of the embodiments described herein.

[0305] The electronic device 1100 may also communicate with one or more external devices 1190 (e.g., keyboard, pointing device, display 1191, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1100, and / or communicate with any device that enables the electronic device 1100 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 1192. In addition, the electronic device 1100 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) through a network adapter 1193. As shown, the network adapter 1193 communicates with other modules of the electronic device 1100 through a bus 1130. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1100, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0306] The processor 1120 executes various functional applications and data processing by running the programs stored in the memory 1110 .

[0307] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the 5G message-based identity authentication method of the embodiment of the present application, and will not be repeated here.

[0308] In order to implement the above embodiments, the present application also proposes a computer storage medium.

[0309] Among them, when the instructions in the storage medium are executed by the processor of the server, the server can execute the identity authentication method based on 5G messages as described above. Optionally, the computer-readable storage medium can be ROM, random access memory (RAM), CD-ROM, tape, floppy disk and optical data storage device, etc.

[0310] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0311] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0312] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0313] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0314] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0315] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0316] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0317] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A 5G message-based identity authentication method, characterized in that: The method is applied to an authentication platform, and the method comprises: In response to receiving an identity authentication request, determining identification information of an object to be authenticated according to the identity authentication request, and determining a terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated; Generate information to be verified according to the identity authentication request; Sending the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information; Obtaining the verification instruction information sent by the terminal device, and performing identity authentication of the object to be authenticated according to the verification instruction information; Before receiving the identity authentication request, the method further includes: Receiving the registration information of the object to be authenticated and the identification information of the object to be authenticated sent by the terminal device; wherein the registration information of the object to be authenticated is generated by the terminal device based on the base point of the elliptic curve; Generate hidden identity information and a shared private key according to the registration information of the object to be authenticated, the base point of the elliptic curve, the authentication platform public key, the identification information of the object to be authenticated, the preset authentication platform private key, the preset third Hash function and the first Hash function; The hidden identity identification information and the shared private key are sent to the terminal device; wherein the shared private key is used by the terminal device to generate the private key of the object to be authenticated.

2. The method according to claim 1, characterized in that The generating the information to be verified according to the identity authentication request includes: Determine the identification information and request time of the application platform according to the identity authentication request; The information to be verified is generated according to the identification information of the application platform, the request time and the identification information of the object to be authenticated.

3. The method according to claim 1, characterized in that The performing identity authentication of the object to be authenticated according to the verification instruction information includes: Determine a first verification value according to the verification instruction information; wherein the first verification value is obtained by the terminal device encrypting the information to be verified based on a preset base point of the elliptic curve, a preset authentication platform public key, a preset first hash function, a preset second hash function, the identification information of the object to be authenticated, and a preset private key of the object to be authenticated; Verifying the first verification value based on the base point of the elliptic curve, the authentication platform public key, the first Hash function, the second Hash function, the identification information of the object to be authenticated, and the information to be verified; An identity authentication result of the object to be authenticated is determined according to a verification result of the first verification value.

4. The method according to claim 3, characterized in that The verifying the first verification value based on the base point of the elliptic curve, the authentication platform public key, the first Hash function, the second Hash function, the identification information of the object to be authenticated, and the information to be verified includes: Determine the hidden identity identification information corresponding to the identification information of the object to be authenticated; Based on the first Hash function, encrypt the identification information of the object to be authenticated, the hidden identity identification information and the public key of the authentication platform to obtain a first authentication intermediate value; Generate first hidden information and second hidden information according to the information to be verified, the first Hash function, the base point of the elliptic curve, the authentication platform public key, the hidden identity identification information and the identification information of the object to be authenticated; Based on the second Hash function, encrypt the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information and the second hidden information to obtain a second authentication intermediate value; The first verification value is verified according to the first authentication intermediate value, the second authentication intermediate value, the base point of the elliptic curve, the hidden identity identification information, the authentication platform public key and the first hidden information.

5. The method according to claim 4, characterized in that The generating of the first hidden information and the second hidden information according to the information to be verified, the first Hash function, the base point of the elliptic curve, the authentication platform public key, the hidden identity identification information and the identification information of the object to be authenticated includes: Generate the first hidden information according to the information to be verified and the base point of the elliptic curve; The second hidden information is generated according to the information to be verified, the first Hash function, the authentication platform public key, the hidden identity identification information and the identification information of the object to be authenticated.

6. The method according to claim 4, characterized in that The verifying the first verification value according to the first authentication intermediate value, the second authentication intermediate value, the base point of the elliptic curve, the hidden identity information, the authentication platform public key and the first hidden information includes: Determining a first check value according to the first verification value and a base point of the elliptic curve; Determine a second verification value according to the first hidden information, the first authentication intermediate value, the second authentication intermediate value, the hidden identity information and the authentication platform public key; Determining whether the first verification value is consistent with the second verification value; If the first verification value is consistent with the second verification value, it is determined that the first verification value verification is successful.

7. The method according to claim 3, characterized in that The verifying the first verification value based on the base point of the elliptic curve, the authentication platform public key, the first Hash function, the second Hash function, the identification information of the object to be authenticated, and the information to be verified includes: Determine the verification initiation time according to the verification instruction information; Determining whether the identity authentication has timed out according to the verification initiation time; If the identity authentication has not timed out, the first verification value is verified based on the base point of the elliptic curve, the authentication platform public key, the first Hash function, the second Hash function, the identification information of the object to be authenticated and the information to be verified.

8. The method according to claim 1, characterized in that The method of generating the concealed identity information and the shared private key according to the registration information of the object to be authenticated, the base point of the elliptic curve, the public key of the authentication platform, the identification information of the object to be authenticated, the preset private key of the authentication platform, the preset third Hash function and the first Hash function includes: Generate the hidden identity information according to the registration information of the object to be authenticated and the base point of the elliptic curve; The shared private key is generated according to the registration information of the object to be authenticated, the first Hash function, the third Hash function, the identification information of the object to be authenticated, the hidden identity identification information, the authentication platform private key, and the authentication platform public key.

9. A 5G message-based identity authentication method, characterized in that: The method is applied to a terminal device, and the method comprises: Receive 5G messages; Determine the information to be verified according to the 5G message; wherein the information to be verified is information generated by the authentication platform according to the received identity authentication request; Encrypting the information to be verified to generate verification instruction information; Sending the verification instruction information to the authentication platform; wherein the verification instruction information is used by the authentication platform to perform identity authentication on the authentication object; The method further comprises: In response to a registration triggering operation of the object to be authenticated, acquiring identification information of the object to be authenticated; Generate registration information of the object to be authenticated according to the base point of the elliptic curve and the first random number; Sending the identification information of the object to be authenticated and the registration information of the object to be authenticated to the authentication platform; wherein the identification information of the object to be authenticated and the registration information of the object to be authenticated are used by the authentication platform to generate hidden identity information and a shared private key; Receiving the hidden identity information and the shared private key sent by the authentication platform, and storing the corresponding relationship between the hidden identity and the identity of the object to be authenticated; The private key of the object to be authenticated is generated according to the shared private key, the third Hash function, the first random number and the authentication platform public key.

10. The method according to claim 9, characterized in that Determining the information to be verified according to the 5G message includes: In response to a verification trigger operation on the 5G message, the information to be verified is determined according to the 5G message.

11. The method according to claim 9, characterized in that The encrypting the information to be verified to generate verification instruction information includes: Encrypting the information to be authenticated based on a preset base point of the elliptic curve, a preset authentication platform public key, a preset first Hash function, a preset second Hash function, preset identification information of the object to be authenticated, and a preset private key of the object to be authenticated to generate a first verification value; Generate verification instruction information according to the first verification value.

12. The method according to claim 11, characterized in that The encrypting the information to be authenticated based on a preset base point of an elliptic curve, a preset authentication platform public key, a preset first Hash function, a preset second Hash function, preset identification information of an object to be authenticated, and a preset private key of an object to be authenticated to generate a first verification value includes: Generate first hidden information according to the base point of the elliptic curve and the information to be verified; Determine the hidden identity identification information corresponding to the identification information of the object to be authenticated; Generate second hidden information according to the information to be verified, the hidden identity identification information, the first Hash function, the identification information of the object to be authenticated, and the authentication platform public key; The first verification value is generated according to the information to be verified, the private key of the object to be authenticated, the second Hash function, the identification information of the object to be authenticated, the hidden identity identification information, the first hidden information and the second hidden information.

13. The method according to claim 11, characterized in that The generating verification instruction information according to the first verification value includes: Determine the time to initiate verification; The first verification value and the verification initiation time are concatenated to obtain the verification instruction information.

14. The method according to claim 9, characterized in that Also includes: Verifying the shared private key according to the first Hash function, the hidden identity identification information, the identification information of the object to be authenticated, the base point of the preset elliptic curve and the preset authentication platform public key; If the verification result of the shared private key is verification failure, the private key of the object to be authenticated is discarded.

15. An identity authentication system, characterized in that: include: An authentication platform, used to execute the 5G message-based identity authentication method as described in any one of claims 1 to 8; A terminal device, used to execute the 5G message-based identity authentication method as described in any one of claims 9 to 14.

16. An identity authentication device based on 5G messages, characterized in that: The device is applied to an authentication platform, and comprises: A first determination module is used to determine, in response to receiving an identity authentication request, identification information of an object to be authenticated according to the identity authentication request, and to determine a terminal device associated with the object to be authenticated according to the identification information of the object to be authenticated; A first generating module, used to generate information to be verified according to the identity authentication request; A first sending module, used to send the information to be verified to the terminal device in the form of a 5G message; wherein the 5G message is used by the terminal device to encrypt the information to be verified to generate verification instruction information; An authentication module, used to obtain the authentication instruction information sent by the terminal device, and perform identity authentication of the object to be authenticated according to the authentication instruction information; The device further includes a first registration module, wherein the first registration module is configured to: Before receiving the identity authentication request, receiving the registration information of the object to be authenticated and the identification information of the object to be authenticated sent by the terminal device; wherein the registration information of the object to be authenticated is generated by the terminal device based on the base point of the elliptic curve; Generate hidden identity information and a shared private key according to the registration information of the object to be authenticated, the base point of the elliptic curve, the authentication platform public key, the identification information of the object to be authenticated, the preset authentication platform private key, the preset third Hash function and the first Hash function; The hidden identity identification information and the shared private key are sent to the terminal device; wherein the shared private key is used by the terminal device to generate the private key of the object to be authenticated.

17. An identity authentication device based on 5G messages, characterized in that: The device is applied to a terminal device, and the device includes: A first receiving module, used for receiving a 5G message; A second determination module is used to determine the information to be verified according to the 5G message; wherein the information to be verified is information generated by the authentication platform according to the received identity authentication request; An encryption module, used for encrypting the information to be verified to generate verification instruction information; A second sending module is used to send the verification instruction information to the authentication platform; wherein the verification instruction information is used by the authentication platform to perform identity authentication on the authentication object; The device further includes a second registration module, wherein the second registration module is configured to: In response to a registration triggering operation of the object to be authenticated, acquiring identification information of the object to be authenticated; Generate registration information of the object to be authenticated according to the base point of the elliptic curve and the first random number; Sending the identification information of the object to be authenticated and the registration information of the object to be authenticated to the authentication platform; wherein the identification information of the object to be authenticated and the registration information of the object to be authenticated are used by the authentication platform to generate hidden identity information and a shared private key; Receiving the hidden identity information and the shared private key sent by the authentication platform, and storing the corresponding relationship between the hidden identity and the identity of the object to be authenticated; The private key of the object to be authenticated is generated according to the shared private key, the third Hash function, the first random number and the authentication platform public key.

18. An electronic device, characterized in that: include: processor; a memory for storing executable instructions for the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 8, and / or to implement the method according to any one of claims 9 to 14.

19. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method as claimed in any one of claims 1 to 8, and / or implement the method as claimed in any one of claims 9 to 14.

Images