Authentication method and device, electronic equipment and storage medium

Abstract

The present disclosure provides an authentication method and device, electronic equipment and storage medium, including: receiving an authentication request of a target device, wherein the authentication request comprises an entity authentication request; determining an entity server of the target device based on the entity authentication request; in response to determining that the entity server is a target server, performing encryption processing on identity information of the target device based on a private key of the entity server, and obtaining encrypted identity information; performing entity authentication on the target device based on the encrypted identity information, and obtaining an entity authentication result.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an authentication method, apparatus, electronic device, and storage medium. Background Technology

[0002] Public wireless networks serve as a unified platform for wireless applications, supporting a diverse range of services. They typically consist of external leased networks and internal networks, with applications often carried on different regional networks (e.g., internal networks) within the public wireless network, depending on their specific characteristics. Therefore, ensuring the security requirements of these different regional networks becomes a critical challenge when public wireless networks support services.

[0003] In existing technologies, security protection for different areas of a public wireless network is typically achieved by authenticating business applications. However, current business application authentication methods lack security guarantees for the continuity and availability of virtual private networks (VPNs), which can prevent business applications from operating securely and stably in the face of various external security threats. Summary of the Invention

[0004] In view of this, the purpose of this disclosure is to provide an authentication method, apparatus, electronic device and storage medium.

[0005] As one aspect of this disclosure, an authentication method is provided, comprising:

[0006] Receive an authentication request from the target device, wherein the authentication request includes an entity authentication request;

[0007] The entity server of the target device is determined based on the entity authentication request;

[0008] In response to determining that the entity server is the target server, the identity information of the target device is encrypted based on the private key of the entity server, and the encrypted identity information is obtained.

[0009] The target device is authenticated based on the encrypted identity information, and the authentication result is obtained.

[0010] Optionally, determining the entity server of the target device based on the entity authentication request includes:

[0011] The entity authentication request is parsed to obtain the parsed entity authentication request;

[0012] The request transmission path of the target device is determined based on the parsed entity authentication request.

[0013] The entity server of the target device is determined based on the requested transmission path.

[0014] Optionally, after determining the entity server of the target device, the method further includes:

[0015] Obtain the identity information of the target device;

[0016] The identity information is verified based on the entity server, and the verification result is obtained;

[0017] Based on the verification results, the entity server is determined to be the target server.

[0018] Optionally, the step of encrypting the identity information of the target device based on the private key of the entity server to obtain the encrypted identity information includes:

[0019] The identity information transmission terminal is determined based on the entity server.

[0020] The identity information is encrypted using the public key of the transmission terminal to obtain public key encrypted information;

[0021] The encrypted identity information is obtained by signing the public key encrypted information based on the private key of the entity server.

[0022] Optionally, after determining the entity server of the target device, the method further includes:

[0023] In response to determining that the entity server is not the target server;

[0024] The identity information of the target device is encrypted based on the public key of the entity server, and the result of the encryption is obtained.

[0025] Based on the result of the encryption process, entity authentication is performed on the target device, and the authentication result is obtained.

[0026] Optionally, the authentication request further includes a message authentication request, and the method further includes:

[0027] The message server of the target device is determined based on the message authentication request;

[0028] In response to determining that the message server is the target server, the plaintext message of the target device is encrypted to obtain the encrypted plaintext message;

[0029] The target device is authenticated based on the encrypted plaintext message, and the message authentication result is obtained.

[0030] Optionally, encrypting the plaintext message of the target device to obtain the encrypted plaintext message includes:

[0031] The plaintext message is encrypted using a preset public key and a preset private key to obtain the encrypted plaintext message.

[0032] After obtaining the encrypted plaintext message, the method further includes:

[0033] The message transmission terminal of the target device is determined based on the message server;

[0034] The encrypted plaintext message is transmitted from the message server to the message transmission terminal, so that the message transmission terminal can verify the encrypted plaintext information and obtain the message verification result.

[0035] Based on the message verification result, the target device is authenticated, and the message authentication result is obtained.

[0036] As a second aspect of this disclosure, this disclosure also provides an authentication device, comprising:

[0037] The authentication request acquisition module is configured to receive authentication requests from the target device, wherein the authentication request includes an entity authentication request.

[0038] The server determination module is configured to: determine the entity server of the target device based on the entity authentication request;

[0039] The information encryption module is configured to: in response to determining that the entity server is the target server, encrypt the identity information of the target device based on the public key of the entity server, and obtain the encrypted identity information;

[0040] The information authentication module is configured to perform entity authentication on the target device based on the encrypted identity information and obtain the entity authentication result.

[0041] As a third aspect of this disclosure, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the authentication method described above provided in this disclosure.

[0042] As a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is also provided, the non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the methods described in any of the above-mentioned methods.

[0043] As described above, in this disclosure, the public key information of the data to be authenticated is first determined based on the device identifier, then an authentication key is generated based on the preset private key information and the public key information, and finally the authentication key is used to authenticate the data to be authenticated to obtain the authentication ciphertext. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1A This is a schematic diagram of an authentication method provided in an embodiment of this disclosure.

[0046] Figure 1B This is a schematic diagram of a method for determining an entity server provided in an embodiment of this disclosure.

[0047] Figure 1C This is a schematic diagram of a method for encrypting identity information provided in an embodiment of this disclosure.

[0048] Figure 2 This is a schematic diagram of the structure of an authentication device provided in an embodiment of this disclosure.

[0049] Figure 3 This is a schematic diagram of an electronic device structure for an authentication method provided in an embodiment of this disclosure. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0051] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar words used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0052] As described in the background section, the public wireless network serves as a unified platform for wireless applications, and the services it carries are diverse. A public wireless network typically consists of an external leased network and an internal network. Services are usually carried on different regional networks (e.g., internal networks) within the public wireless network, depending on their specific characteristics. Therefore, when the public wireless network carries services, meeting the security requirements of these different regional networks becomes a pressing issue.

[0053] In existing technologies, security protection for different areas of a public wireless network is typically achieved by authenticating business applications. However, current business application authentication methods lack security guarantees for the continuity and availability of virtual private networks (VPNs), which can prevent business applications from operating securely and stably in the face of various external security threats.

[0054] In practice, based on the different needs of business applications, the security protection of different areas of the public wireless network can be divided into external security protection and internal security protection. External security protection includes terminal security and transmission channel security.

[0055] Terminal security can be categorized into information collection terminals and mobile operation terminals based on terminal type. Existing technologies employ varying security protection measures for terminals. Typically, security personnel employ one or more of the following protective measures based on the terminal's specific characteristics: installing terminal protection systems, encryption authentication technologies, and encryption hardware and digital certificate technologies.

[0056] In existing technologies, security protection for information collection terminals typically employs customized terminal protection measures, which provide physical security measures such as theft and vandalism prevention. These customized terminal protection measures usually utilize security modules to ensure the security of the communication data interface. However, due to the nature of the communication module, these customized terminal protection measures require the use of a common username and password. If this username and password are leaked, the security of the information collection terminal will be compromised.

[0057] In addition, existing security measures for mobile operating terminals typically involve installing terminal security software and encrypting data storage.

[0058] Specifically, information collection terminals and mobile operation terminals access dedicated information networks through the operator's wireless network. Because the operator's wireless channels are available anytime and anywhere, and because the terminal networks are widely distributed and difficult to monitor, information collection terminals face security risks such as terminal theft, spoofing by illegal base stations, and easy decryption of encrypted information. Mobile operation terminals also face the risk of easy theft.

[0059] To address the aforementioned problems, this disclosure provides an authentication method, apparatus, electronic device, and storage medium. The method first obtains an authentication request from a target device, then determines the target device's server information based on this request. Next, based on this server information, it determines the governing server for the target device's identity information. If the governing server is the target device's server, it encrypts the target device's identity information based on the target device's server information, thus obtaining encrypted identity information. Finally, it verifies the target device based on this encrypted identity information and obtains the verification result.

[0060] After introducing the basic principles of this disclosure, various non-limiting embodiments of this disclosure will be described in detail below.

[0061] Figure 1A This is a schematic diagram of an authentication method provided in an embodiment of this disclosure.

[0062] Figure 1A The authentication method shown further includes the following steps:

[0063] Step S10: Receive an authentication request from the target device, wherein the authentication request includes an entity authentication request.

[0064] In some optional embodiments, the authentication method of this disclosure can be implemented through an authentication terminal. Specifically, the authentication terminal can first receive an authentication request from the target device to be authenticated, wherein the aforementioned authentication request may include an entity authentication request.

[0065] In some optional embodiments, when the authentication terminal receives an authentication request from the target device to be authenticated, it can call the server connected to the target device to authenticate the device and then obtain the authentication result.

[0066] In some optional embodiments, the aforementioned authentication request may further include a message authentication request. Furthermore, the aforementioned authentication result may include both entity authentication result and message authentication result. This disclosure authenticates the target device from both the entity and message aspects, making the authentication of the target device more specific and thereby improving the security of the public wireless network.

[0067] In some optional embodiments, the aforementioned target device to be authenticated can be either an external leased network carried on a public wireless network or an internal network carried on a public wireless network. This comparison of embodiments does not impose specific limitations.

[0068] Step S20: Determine the entity server of the target device based on the entity authentication request.

[0069] Figure 1BThis is a schematic diagram of a method for determining an entity server provided in an embodiment of this disclosure.

[0070] In some alternative embodiments, such as Figure 1B As shown, step S20 further includes:

[0071] S201: The entity authentication request is parsed to obtain the parsed entity authentication request.

[0072] S202: Determine the request transmission path of the target device based on the parsed entity authentication request.

[0073] S203: Determine the entity server of the target device based on the requested transmission path.

[0074] In some optional embodiments, after receiving the authentication request from the target device to be authenticated, the authentication terminal can generate an entity authentication result based on the entity authentication request in the authentication request, and generate a message authentication result based on the message authentication request in the authentication request.

[0075] In some optional embodiments, the process by which the authentication terminal generates an entity authentication result based on the entity authentication request in the authentication request can be specifically as follows: The authentication terminal can first determine the entity server of the target device to be authenticated based on the aforementioned entity authentication request. Then, it performs authentication processing on the target device to be authenticated based on the entity server.

[0076] In some optional embodiments, the process of determining the entity server of the target device to be authenticated based on the aforementioned entity authentication request can be specifically as follows: the authentication terminal first parses the aforementioned entity authentication request, and then obtains the parsed entity authentication request.

[0077] In some optional embodiments, after receiving the parsed entity authentication request, the authentication terminal can determine the request transmission path of the target device to be authenticated based on this parsed entity authentication request. Then, based on this request transmission path, it can determine the entity server of the target device to be authenticated.

[0078] It is understood that this embodiment authenticates the entity authentication request of the target device to be authenticated, and therefore the entity server of the target device to be authenticated is determined by the request transmission path. Correspondingly, if it is necessary to authenticate the message authentication request of the target device to be authenticated, the message server of the target device to be authenticated can be determined based on the same method. The process of determining the message server in this embodiment will not be described in detail.

[0079] Furthermore, authentication requests are typically transmitted between multiple terminals and servers. For example, the terminal to be authenticated (e.g., the target device to be authenticated) sends the authentication request to the authentication terminal via the server described by the terminal to be authenticated. Therefore, once the authentication terminal determines the transmission path of the authentication request, it can determine the entity server of the terminal to be authenticated (i.e., the target device to be authenticated) based on this transmission path.

[0080] In some optional embodiments, after step S20, the method further includes:

[0081] S204: Obtain the identity information of the target device.

[0082] S205: Verify the identity information based on the entity server and obtain the verification result.

[0083] S206: Based on the verification results, the entity server is determined to be the target server.

[0084] In some optional embodiments, several servers may exist in the public wireless network, each managing different requests from different application devices. Although the authentication terminal determines the physical server of the target device through the request transmission path, the numerous lines between the server and the authentication request may lead to server confirmation errors. Therefore, after determining the physical server of the target device to be authenticated, the authentication terminal can re-evaluate this physical server.

[0085] In some optional embodiments, the process of the authentication terminal re-evaluating the entity server can specifically involve the authentication terminal obtaining the identity information of the target device to be authenticated. Then, it verifies this identity information based on the aforementioned entity server and obtains a verification result. Based on this verification result, it determines whether the aforementioned entity server is the server that handles the authentication request for the target device to be authenticated, i.e., the target server.

[0086] Step S30: In response to determining that the entity server is the target server, the identity information of the target device is encrypted based on the private key of the entity server, and the encrypted identity information is obtained.

[0087] Figure 1C This is a schematic diagram of a method for encrypting identity information provided in an embodiment of this disclosure.

[0088] In some alternative embodiments, such as Figure 1C As shown, step S30 further includes:

[0089] S301: Determine the transmission terminal of the identity information based on the entity server.

[0090] S302: Encrypt the identity information based on the public key of the transmission terminal to obtain public key encrypted information.

[0091] S303: Sign the public key encrypted information based on the private key of the entity server to obtain the encrypted identity information.

[0092] In some optional embodiments, when the authentication terminal determines that the aforementioned entity server is the target server, it can encrypt the identity information of the target device to be authenticated based on the private key of this entity server, thereby obtaining the encrypted identity information.

[0093] In some optional embodiments, the aforementioned process of obtaining encrypted identity information can be specifically as follows: the authentication terminal can determine the transmitting terminal of the identity information based on the entity server. Then, the authentication terminal can encrypt the identity information based on the public key of the transmitting terminal, thereby obtaining public key encrypted information. Subsequently, the authentication terminal can sign the aforementioned public key encrypted information based on the private key of the entity server, and finally obtain the encrypted identity information.

[0094] Step S40: Perform entity authentication on the target device based on the encrypted identity information and obtain the entity authentication result.

[0095] In some optional embodiments, once the authentication terminal obtains the encrypted identity information, it can perform entity authentication on the target device to be authenticated based on this encrypted identity information, thereby obtaining the entity authentication result.

[0096] In some optional embodiments, the process of performing entity authentication on the target device based on this encrypted identity information to obtain the entity authentication result can be specifically as follows: the authentication terminal decrypts the encrypted identity information using its own public and private keys. If decryption is successful, the entity authentication result is obtained. If decryption fails, the entity authentication result is obtained.

[0097] In some optional embodiments, after step S40, the method further includes:

[0098] S401: In response to determining that the entity server is not the target server.

[0099] S402: Encrypt the identity information of the target device based on the public key of the entity server, and obtain the encryption result.

[0100] S403: Perform entity authentication on the target device based on the result of the encryption process, and obtain the authentication result.

[0101] In some optional embodiments, when the authentication terminal discovers that the entity server is not the server that processed the authentication request of the target device to be authenticated, it can encrypt the identity information of the target device to be authenticated based on the public key of the entity server, thereby obtaining the encrypted result. Then, based on this encrypted result, entity authentication is performed on the target device to be authenticated, and finally, the authentication result is obtained.

[0102] In some optional embodiments, if the authentication terminal discovers that the entity server is not the server handling the authentication request of the aforementioned target device to be authenticated, it can further determine the server handling the authentication request of the aforementioned target device based on this entity server. Then, based on this server handling the authentication request of the aforementioned target device, the identity information of the target device to be authenticated is encrypted, thereby obtaining an encrypted result. Finally, based on this encrypted result, entity authentication is performed on the target device to be authenticated, and the authentication result is obtained.

[0103] In some optional embodiments, the aforementioned authentication request further includes a message authentication request, and the process after step S403 further includes:

[0104] S404: Determine the message server of the target device based on the message authentication request.

[0105] S405: In response to determining that the message server is the target server, the plaintext message of the target device is encrypted, and the encrypted plaintext message is obtained.

[0106] In some optional embodiments, step S405 includes:

[0107] S4051: The plaintext message is encrypted based on a preset public key and a preset private key to obtain the encrypted plaintext message.

[0108] In some optional embodiments, the method further includes the following after step S4051:

[0109] S4052: Determine the message transmission terminal of the target device based on the message server.

[0110] S4053: The encrypted plaintext message is transmitted to the message transmission terminal based on the message server, so that the message transmission terminal can verify the encrypted plaintext information and obtain the message verification result.

[0111] S4054: Perform message authentication on the target device based on the message verification result, and obtain the message authentication result.

[0112] S406: Perform message authentication on the target device based on the encrypted plaintext message, and obtain the message authentication result.

[0113] In some optional embodiments, when the authentication terminal needs to authenticate a message authentication request from a target device, the authentication terminal can determine the message server of the target device based on the aforementioned message authentication request. Then, if this message server is the server that processes the message processing request of the target device, the plaintext message of the target device is encrypted to obtain the encrypted plaintext message. Finally, the authentication terminal can perform message authentication on the target device based on this encrypted plaintext message to obtain the message authentication result.

[0114] In some optional embodiments, the process of encrypting the plaintext message of the target device to be authenticated can specifically involve the authentication terminal encrypting the plaintext message based on its own public and private keys to obtain the encrypted plaintext message. It should be noted that the authentication terminal can also encrypt the aforementioned plaintext message using a preset public and private key within its terminal, thereby also obtaining the encrypted plaintext message.

[0115] In some optional embodiments, after receiving the encrypted plaintext message, the authentication terminal can further determine the message transmission terminal of the target device to be authenticated based on the aforementioned message server. Then, based on the aforementioned message server, the encrypted plaintext message is transmitted to this message transmission terminal, so that the message transmission terminal can verify the aforementioned encrypted plaintext information and obtain a message verification result. Finally, the authentication terminal can perform message authentication on the target device to be authenticated based on this message verification result, and ultimately obtain a message authentication result.

[0116] Using the above method, this disclosure first obtains the authentication request of the target device, then determines the server information of the target device based on the authentication request, then judges the governing server of the target device's identity information based on the server information, and when the governing server is the server of the target device, the target device's identity information is encrypted based on the server of the target device to obtain the encrypted identity information, and finally the target device is verified based on the encrypted identity information to obtain the verification result.

[0117] Based on the same technical concept, corresponding to the methods of any of the above embodiments, this disclosure also provides an authentication device, through which the authentication method described in any of the above embodiments can be implemented.

[0118] Figure 2 This is a schematic diagram of an authentication device provided in an embodiment of the present disclosure.

[0119] Figure 2 The authentication device shown further includes the following modules:

[0120] The system includes an authentication request acquisition module 10, a server determination module 20, an information encryption module 30, and an information authentication module 40.

[0121] The authentication request acquisition module 10 is configured to receive authentication requests from the target device, wherein the authentication requests include entity authentication requests.

[0122] The server determination module 20 is configured to determine the entity server of the target device based on the entity authentication request. Specifically, the following steps are performed:

[0123] The entity authentication request is parsed to obtain the parsed entity authentication request;

[0124] The request transmission path of the target device is determined based on the parsed entity authentication request.

[0125] The entity server of the target device is determined based on the requested transmission path;

[0126] Obtain the identity information of the target device;

[0127] The identity information is verified based on the entity server, and the verification result is obtained;

[0128] Based on the verification results, the entity server is determined to be the target server.

[0129] The information encryption module 30 is configured to: in response to determining that the entity server is the target server, encrypt the identity information of the target device based on the public key of the entity server, and obtain the encrypted identity information. Specifically, the following steps are performed:

[0130] The identity information transmission terminal is determined based on the entity server.

[0131] The identity information is encrypted using the public key of the transmission terminal to obtain public key encrypted information;

[0132] The encrypted identity information is obtained by signing the public key encrypted information based on the private key of the entity server.

[0133] In response to determining that the entity server is not the target server;

[0134] The identity information of the target device is encrypted based on the public key of the entity server, and the result of the encryption is obtained.

[0135] Based on the result of the encryption process, entity authentication is performed on the target device, and the authentication result is obtained.

[0136] The information authentication module 40 is configured to: perform entity authentication on the target device based on the encrypted identity information, and obtain the entity authentication result. Specifically, the following steps are executed:

[0137] The message server of the target device is determined based on the message authentication request;

[0138] In response to determining that the message server is the target server, the plaintext message of the target device is encrypted to obtain the encrypted plaintext message, including:

[0139] The plaintext message is encrypted using a preset public key and a preset private key to obtain the encrypted plaintext message.

[0140] The message transmission terminal of the target device is determined based on the message server;

[0141] The encrypted plaintext message is transmitted from the message server to the message transmission terminal, so that the message transmission terminal can verify the encrypted plaintext information and obtain the message verification result.

[0142] Based on the message verification result, the target device is authenticated, and the message authentication result is obtained.

[0143] Based on the same technical concept, corresponding to the methods of any of the above embodiments, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the authentication method described in any of the above embodiments.

[0144] Figure 3 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0145] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0146] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0147] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0148] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0149] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0150] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0151] The electronic devices described above are used to implement the corresponding authentication methods in any of the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0152] Based on the same technical concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the authentication method as described in any of the above embodiments.

[0153] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0154] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the authentication method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0155] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0156] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuitry) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0157] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0158] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An authentication method characterized by, include: Receive an authentication request from the target device, wherein the authentication request includes an entity authentication request; The entity server of the target device is determined based on the entity authentication request; In response to determining that the entity server is the target server, the identity information of the target device is encrypted based on the private key of the entity server, and the encrypted identity information is obtained. The target device is authenticated based on the encrypted identity information, and the authentication result is obtained.

2. The method of claim 1, wherein, The step of determining the entity server of the target device based on the entity authentication request includes: The entity authentication request is parsed to obtain the parsed entity authentication request; The request transmission path of the target device is determined based on the parsed entity authentication request. The entity server of the target device is determined based on the requested transmission path.

3. The method of claim 1, wherein, After determining the entity server of the target device, the method further includes: Obtain the identity information of the target device; The identity information is verified based on the entity server, and the verification result is obtained; Based on the verification results, the entity server is determined to be the target server.

4. The method according to claim 1, characterized in that, The encryption of the target device's identity information based on the entity server's private key, resulting in encrypted identity information, includes: The identity information transmission terminal is determined based on the entity server. The identity information is encrypted using the public key of the transmission terminal to obtain public key encrypted information; The encrypted identity information is obtained by signing the public key encrypted information based on the private key of the entity server.

5. The method according to claim 1, characterized in that, After determining the entity server of the target device, the method further includes: In response to determining that the entity server is not the target server; The identity information of the target device is encrypted based on the public key of the entity server, and the result of the encryption is obtained. Based on the result of the encryption process, entity authentication is performed on the target device, and the authentication result is obtained.

6. The method according to claim 1, characterized in that, The authentication request also includes a message authentication request, and the method further includes: The message server of the target device is determined based on the message authentication request; In response to determining that the message server is the target server, the plaintext message of the target device is encrypted to obtain the encrypted plaintext message; The target device is authenticated based on the encrypted plaintext message, and the message authentication result is obtained.

7. The method according to claim 6, characterized in that, The step of encrypting the plaintext message of the target device to obtain the encrypted plaintext message includes: The plaintext message is encrypted using a preset public key and a preset private key to obtain the encrypted plaintext message. After obtaining the encrypted plaintext message, the method further includes: The message transmission terminal of the target device is determined based on the message server; The encrypted plaintext message is transmitted from the message server to the message transmission terminal, so that the message transmission terminal can verify the encrypted plaintext information and obtain the message verification result. Based on the message verification result, the target device is authenticated, and the message authentication result is obtained.

8. An authentication device, characterized in that, include: The authentication request acquisition module is configured to receive authentication requests from the target device, wherein the authentication request includes an entity authentication request. The server determination module is configured to: determine the entity server of the target device based on the entity authentication request; The information encryption module is configured to: in response to determining that the entity server is the target server, encrypt the identity information of the target device based on the public key of the entity server, and obtain the encrypted identity information; The information authentication module is configured to perform entity authentication on the target device based on the encrypted identity information and obtain the entity authentication result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1 to 7.

Images