Identity authentication method, device, equipment, storage medium and product

Abstract

The application discloses an identity authentication method and device, equipment, a storage medium and a computer program product. The method comprises the following steps: when detecting an application access request sent by a user terminal, sending identity authentication data of the user terminal and a verification instruction to a SIM card application through a preset verification service link, so that the SIM card application performs identity authentication on the user terminal based on the identity authentication data, and an identity authentication result is obtained; the preset verification service link is a service link preset between the user terminal, a service server and an operator server corresponding to the SIM card application; and the identity authentication result fed back by the SIM card application is received. The application reduces the data leakage risk in the user identity authentication process.

Description

Technical Field

[0001] This application relates to the field of identity authentication technology, and in particular to an identity authentication method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] Currently, users need to authenticate their identity when using platforms such as WeChat and Alipay. These platforms can collect users' personal information through identity authentication, but users have no control over their own information. In related technologies, distributed digital identity authentication is generally used to solve this problem, fundamentally solving the privacy issue by returning data ownership to users.

[0003] Existing research on distributed digital identity technology is based on blockchain and key algorithm technologies. It stores key digital information in the authentication process, such as the user's name, in the cloud or mobile terminal service program. This cannot provide users with a convenient and secure distributed identity authentication carrier, and therefore poses a significant risk of data leakage. Summary of the Invention

[0004] The main purpose of this application is to provide an identity authentication method, device, equipment, storage medium, and computer program product, aiming to solve the technical problem in related technologies where storing key digital information in the authentication process, such as user name information, in the cloud or mobile terminal service program poses a significant risk of data leakage.

[0005] To achieve the above objectives, embodiments of this application provide an identity authentication method, the method comprising:

[0006] When an application access request sent by a user terminal is detected, the user terminal's identity authentication data and verification instructions are sent to the SIM card application through a preset verification service link, so that the SIM card application can authenticate the user terminal based on the identity authentication data and obtain the identity authentication result. The preset verification service link is a service link preset between the user terminal, the service server, and the operator server corresponding to the SIM card application.

[0007] Receive the authentication result from the SIM card application.

[0008] In one possible implementation of this application, before the step of sending the user terminal's authentication data and verification command to the SIM card application through a preset verification service link, the following steps are included:

[0009] According to preset rules, the user terminal's identity authentication data is sent to the operator's server so that the operator's server can verify the identity authentication data and obtain the verification result.

[0010] If the verification result shows that the verification is successful, an identity activation request is sent to the user terminal;

[0011] After receiving the confirmation instruction from the user terminal based on the identity activation request, the identity authentication data is processed by a preset algorithm to generate a key index.

[0012] Based on the operator's server, the identity authentication data is decrypted according to the key index to obtain decrypted data;

[0013] The received decrypted data is written to the SIM card application through a preset service verification link, so that the operator server associates the SIM card application with the user's identity.

[0014] In one possible implementation of this application, after the step of writing the received decrypted data to the SIM card application via a preset service verification link, so that the operator server associates the SIM card application with the user's identity, the method includes:

[0015] Receive the association result obtained after associating the SIM card application with the user's identity identifier;

[0016] Based on the association results, the service status of the SIM card application is marked as authentication enabled.

[0017] In one possible implementation of this application, the step of the operator server verifying the identity authentication data and obtaining a verification result includes:

[0018] The operator server verifies the identity authentication data by signing it using the first public key data of the service server.

[0019] After successful signature verification, the identity authentication data is decrypted using the second public key data of the operator's server, and the operation identifier of the SIM card is whitelisted to obtain the verification result.

[0020] In one possible implementation of this application, the step of sending the user terminal's authentication data and verification command to the SIM card application through a preset verification service link, so that the SIM card application can perform authentication on the user terminal based on the authentication data and obtain the authentication result, includes:

[0021] Based on the user terminal's identity authentication data, a verification command is generated;

[0022] The identity authentication data and the verification command are sent to the SIM card application through a preset verification service link;

[0023] Based on the SIM card application, the identity authentication data is processed according to the verification command to obtain the identity authentication result.

[0024] In one possible implementation of this application, before the step of sending the user terminal's authentication data and verification command to the SIM card application through a preset verification service link, the following steps are included:

[0025] The hash value of the user terminal is written into the SIM card, and the key data between the user terminal and the operator server is exchanged to generate a preset verification service link;

[0026] or,

[0027] The key data of the user terminal or business server is written into the SIM card through a preset interface or digital SMS to generate a preset verification service link.

[0028] This application also provides an identity authentication device, the identity authentication device comprising:

[0029] The first sending module is used to send the user terminal's identity authentication data and verification instructions to the SIM card application through a preset verification service link when an application access request sent by the user terminal is detected, so that the SIM card application can perform identity authentication on the user terminal based on the identity authentication data and obtain the identity authentication result. The preset verification service link is a service link preset between the user terminal, the service server and the operator server corresponding to the SIM card application.

[0030] The first receiving module is used to receive the identity authentication result fed back by the SIM card application.

[0031] This application also provides an identity authentication device, which is an entity node device. The identity authentication device includes: a memory, a processor, and a program of the identity authentication method stored in the memory and executable on the processor. When the program of the identity authentication method is executed by the processor, it can implement the steps of the identity authentication method as described above.

[0032] To achieve the above objectives, a storage medium is also provided, on which an authentication program is stored, which, when executed by a processor, implements the steps of any of the authentication methods described above.

[0033] In addition, to achieve the above objectives, the present invention also provides a computer program product, the computer program product including an identity authentication program, which, when executed by a processor, implements the steps of the identity authentication method as described above.

[0034] This application provides an identity authentication method, apparatus, device, storage medium, and computer program product. Compared with related technologies, which store key digital information such as user names in the cloud or mobile terminal service programs during the authentication process, posing a significant risk of data leakage, this application, upon detecting an application access request sent by a user terminal, sends the user terminal's identity authentication data to a SIM card application through a preset verification service link. The SIM card application then authenticates the user terminal, thereby obtaining the authentication result. Therefore, it eliminates the need to store user identity authentication data in the cloud or mobile terminal service programs; instead, identity authentication is performed through the SIM card application, avoiding the leakage of user identity information and reducing the risk of user privacy data leakage. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating the first embodiment of the identity authentication method of this application;

[0036] Figure 2 This is a schematic diagram illustrating the DID identity application process for users involved in the identity authentication method of this application.

[0037] Figure 3 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of this application;

[0038] Figure 4 This is a schematic diagram of the SIM card DID data structure involved in the identity authentication method of this application;

[0039] Figure 5 This is a schematic diagram of the process for applying for DID generation factors via BIP in the identity authentication method of this application;

[0040] Figure 6 This is a schematic diagram illustrating the process of writing the SIM card DID identity identifier via BIP in the identity authentication method of this application;

[0041] Figure 7 This is a schematic diagram of the first authentication process for the user identity identifier involved in the identity authentication method of this application;

[0042] Figure 8 This is a schematic diagram of the second authentication process for the user identity identifier involved in the identity authentication method of this application;

[0043] Figure 9 This is a schematic diagram of the device structure involved in the identity authentication method of this application. Detailed Implementation

[0044] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0045] This application provides an identity authentication method applied to a business server. In the first embodiment of the identity authentication method of this application, refer to... Figure 1 The method includes the following steps:

[0046] Step S10: When an application access request sent by a user terminal is detected, the user terminal's identity authentication data and verification instructions are sent to the SIM card application through a preset verification service link, so that the SIM card application can perform identity authentication on the user terminal based on the identity authentication data and obtain the identity authentication result. The preset verification service link is a service link preset between the user terminal, the service server, and the operator server corresponding to the SIM card application.

[0047] It should be noted that the execution entity of this method is the business server. The user terminal app, authorized by the operator, has the ability to establish a secure channel with the SIM card. It can store the business-side DID (Decentralized Identifier) ​​data identity, associated business key information, and verifiable credential information on the SIM card. Secondly, a SIM card application will be designed to address the security capabilities of the SIM card, with a unique, efficient access and convenient storage DID data structure framework and business instructions to cooperate with the business side in performing relevant business operations. Finally, relying on the current operator TSM, a dedicated service interface will be designed for the business-side DID business to ensure a secure and reliable connection between the SIM card and the business-side app.

[0048] It should be noted that identity authentication methods can be applied to identity authentication devices, which belong to identity authentication systems, and these identity authentication systems belong to identity authentication equipment.

[0049] It should be noted that the user terminal can be a mobile phone, computer, etc. When a user needs to access a mobile application, identity authentication is required. During the authentication process, the user's identity authentication data is sent to the SIM card application through a preset verification service link. The SIM card application then authenticates the user's identity authentication data and obtains the identity authentication result.

[0050] It should be understood that the preset verification service link is a verification service link set up between the user terminal, the service server, the operator server (SEI-TSM), and the SIM card application. The purpose of setting up this link is to provide a secure data link for these applications. The preset verification service link can be established in the following ways: 1. Using the device-card channel capability between the mobile terminal and the SIM card to complete SIM data writing; 2. The user terminal or SP-TSM (service server) completes SIM data writing through BIP; 3. The user terminal or SP-TSM completes SIM data writing through BIP, which will be described in detail in the third embodiment of this application.

[0051] The step S10, which involves sending the user terminal's authentication data and verification command to the SIM card application via a preset verification service link, so that the SIM card application can authenticate the user terminal based on the authentication data and obtain the authentication result, includes:

[0052] Step S11: Generate a verification command based on the user terminal's identity authentication data;

[0053] It is important to understand that after receiving the authentication data sent by the user terminal, the service server generates a verification command and sends the verification command to the SIM card application so that the SIM card application can complete the authentication process.

[0054] Step S12: Send the identity authentication data and the verification command to the SIM card application through a preset verification service link;

[0055] Step S13: Based on the SIM card application, the identity authentication data is processed according to the verification instruction to obtain the identity authentication result.

[0056] It is important to understand that the user authentication process diagram is as follows: Figure 7 As shown, refer to Figure 7 When a user accesses a service, the service provider applies for DID authentication from the DID identity issuer (i.e., SP-TSM). The SP-TSM then applies for SIM card DID authentication from the SEI-TSM. A secure channel is established between the SEI-TSM and the SIM card, and a DID authentication APDU is sent. The SIM card parses the authentication command and selects a key and algorithm according to the DID authentication parameters to complete the identity data verification. The verification result is returned to the SEI-TSM. The verification result is returned to the service provider, and the service is provided upon successful verification.

[0057] Specifically, the authentication process is as follows:

[0058] Process 1: When a user requests a service on their terminal, the request is sent to the service provider. The service provider then initiates a DID authentication request based on the security control policy of the service requested by the user.

[0059] Process 2: Upon receiving the DID authentication request, the credential issuer (SP-TSM), after verifying the validity of the service provider's identity, organizes the DID request command according to the authentication policy configured by the service provider. This command is then sent to the SEI-TSM via the SEI-TSM's security service interface. When requesting the SEI-TSM to perform related authentication services, the SP-TSM does not need to use the user's mobile phone number as a factor; instead, it transmits the DID identifier. The SEI-TSM will then read the mobile phone number associated with the DID identifier to complete the SEI-TSM's management of the SIM card. This innovation greatly ensures user information security without affecting business operations.

[0060] Process 3: When SEI-TSM receives the DID authentication request, after verifying the validity of the service provider's identity, it organizes the SIM card to apply the APDU command. First, it establishes a BIP connection. After the connection is successfully established, it sends the DID authentication APDU command to the SIM card.

[0061] Process 4: After receiving the DID authentication APDU, the SIM card application verifies the parameters and first determines the range of returned information (full return, partial disclosure of information, or signature of the user challenge code); then selects the algorithm and key for this signature based on the key identifier; finally, it signs the organized returned data using the key from step two, encrypts it using the SEI-TSM session key, and returns it to SEI-TSM.

[0062] Process 5: After decrypting the received data, SEI-TSM returns it to SP-TSM, which then returns it to the service provider. The service provider verifies the user's signature based on the user's public key and determines whether to allow the user to access the application based on the returned user information.

[0063] It should be noted that, Figure 8 This is a schematic diagram of the second authentication process for user identity identifiers involved in the identity authentication method of this application. Figure 8 As shown, the user's DID identity authentication is mainly completed by signing the user's challenge code in the DID identity authentication process.

[0064] Step S20: Receive the identity authentication result fed back by the SIM card application.

[0065] It should be noted that after the SIM card application completes the authentication of the user's identity data, it generates an identity authentication result and transmits the identity authentication result to the business server so that the business server can determine whether the user can access the corresponding APP / software.

[0066] This application provides an identity authentication method, apparatus, device, storage medium, and computer program product. Compared with related technologies, which store key digital information such as user names in the cloud or mobile terminal service programs during the authentication process, posing a significant risk of data leakage, this application, upon detecting an application access request sent by a user terminal, sends the user terminal's identity authentication data to a SIM card application through a preset verification service link. The SIM card application then authenticates the user terminal, thereby obtaining the authentication result. Therefore, it eliminates the need to store user identity authentication data in the cloud or mobile terminal service programs; instead, identity authentication is performed through the SIM card application, avoiding the leakage of user identity information and reducing the risk of user privacy data leakage.

[0067] Furthermore, based on the first embodiment of this application, another embodiment of this application is provided. In this embodiment, before step S10 of sending the user terminal's identity authentication data and verification command to the SIM card application through a preset verification service link, the following steps are included:

[0068] Step S101: According to preset rules, the user terminal's identity authentication data is sent to the operator server so that the operator server can verify the identity authentication data and obtain the verification result.

[0069] It should be noted that the identity authentication scheme of this application mainly consists of two main processes: DID identity application writing and DID identity authentication. In this embodiment, the DID identity application writing process is mainly described in detail. For the specific process, please refer to [link / reference]. Figure 2 The specific process is as follows:

[0070] Process 1: The user opens the DID user terminal program on a network-connected device such as a mobile phone or computer to register for DID identity -> The user terminal submits a DID identity application request to the SP-TSM (DID Identity Recognition Server) -> The SP-TSM checks the whitelist based on the mobile phone number entered by the user to determine whether the current mobile phone number has applied for DID identity. If it is a new application, proceed to Process 2; otherwise, the process ends. The DID identity application includes the user's mobile phone number. The mobile phone number is key information for the SEI-TSM (Operator Server) to remotely manage the SIM card and is also one of the unique characteristics of the SIM card. This technical feature is one of the features that distinguishes this proposal from existing technologies.

[0071] Process 2: In accordance with the security rules established between the user terminal (or SP-TSM) and the SIM card security channel in 5.2.1, the SP-TSM sends the requested DID factor data to the SEI-TSM, DATA = DATA1((Mobile Number | Opreate ID | DID Request Parameters) Cipher SEI-TSM Public Key) | DATA2(Sign SP-TSM public key on DATA1), and sends the above calculated data to the SEI-TSM server in accordance with the inter-platform security protocol.

[0072] Process 3: SEI-TSM performs validity verification of DATA. First, it uses the SP-TSM public key to verify the signature of DATA2. After successful verification, it uses the SEI-TSM public key to decrypt DATA1. Next, it performs whitelist verification on the mobile number's Operate ID. After all verifications are successful, SEI-TSM can use its proprietary features to initiate a DID identity activation request to the current mobile number user via BIP or SMS.

[0073] Step S102: If the verification result shows that the verification passed, an identity activation request is sent to the user terminal.

[0074] It should be noted that after verification, the process proceeds to step 4: The SIM card receives the DID application APDU command via BIP (Baidu Identity Platform) link or SMS. First, a pop-up window prompts the user that a DID application is in progress via the STK menu. After the user confirms, the relevant key pair is generated according to the specified algorithm (including SM2, ECC, or RSA). The generated key is stored according to the object format designed for the SIM card, and a key pair index (keyIndex) is generated. Finally, the KeyIndex, SIM public key, DID generation factor, and signature are encrypted using a secure channel (SessionKey) and sent to SEI-TSM. Based on the characteristics of SIM cards, this process features a specially designed SIM card application storage data structure and STK pop-up prompts. These features offer several advantages: 1) Saves storage space; 2) Improves DID lookup speed during DID authentication via keyIndex; 3) Allows a single user to have multiple DIDs, each associated with various security algorithms; 4) The STK pop-up allows users to dynamically input application parameters during the DID application process, adds password protection, enhances user experience, and ensures SIM card security.

[0075] Step S103: After receiving the confirmation instruction from the user terminal based on the identity activation request, perform key generation processing on the identity authentication data based on a preset algorithm to obtain a key index;

[0076] It should be noted that in process 5: SEI-TSM receives the DATA (DID generator ciphertext) returned by SIM, refer to... Figure 5 The process involves decrypting the data using the current Sessionkey, encrypting the decrypted DATA1 (public key + key index + signature) using the SP-TSM public key to obtain data DATA2, and then calling back the SP-TSM notification interface to return DATA2 to SP-TSM. To improve the SIM card's query efficiency during DID authentication, the key index (2 bytes) returned during DID generation is used as a key parameter in subsequent DID authentication and writing processes. Compared to transmitting the DID identity identifier (54-127 bytes), this significantly improves efficiency in both data transmission and querying.

[0077] It should be noted that the DID identifier storage data structure based on the SIM card design is as follows: Figure 4 As shown, the data structure mainly includes DID identity identifier, key pair, and verifiable credential.

[0078] Step S104: Based on the operator server, the identity authentication data is decrypted according to the key index to obtain decrypted data;

[0079] It should be noted that in process 6: SP-TSM verifies the signature of the data returned by SEI-TSM. After successful verification, the obtained public key and DID generation factor (key index) are used as part of the calculation parameters for the DID identity identifier -> DID identity identifier calculation is performed.

[0080] Step S105: The received decrypted data is written to the SIM card application through a preset service verification link, so that the operator server associates the SIM card application with the user's identity.

[0081] It should be noted that in process 7, after the SP-TSM encrypts the calculated DID identity using public key data, it completes the SIM card writing operation through the operator SEI-TSM's BIP and data SMS channel or mobile APP via the SIM card channel. Regardless of the channel used for SIM card writing, the SIM card, with the help of external authentication capabilities, ensures that only legitimate access can execute the writing command. After the DID identity is successfully written, SEI-TSM associates the mobile phone number with the DID identity (ciphertext string). In future use cases, the DID identity can be directly used to replace the mobile phone number to protect the user's mobile phone number security and effectively prevent security problems caused by mobile phone number leakage.

[0082] The step S101, in which the operator server verifies the identity authentication data and obtains the verification result, includes:

[0083] The operator server verifies the identity authentication data by signing it using the first public key data of the service server.

[0084] After successful signature verification, the identity authentication data is decrypted using the second public key data of the operator's server, and the operation identifier of the SIM card is whitelisted to obtain the verification result.

[0085] It should be noted that SEI-TSM performs DATA validity verification by first using the SP-TSM public key to verify the DATA2 signature. After successful verification, it decrypts DATA1 using the SEI-TSM public key. Next, it verifies the whitelist of the mobile number's Operate ID. After all verifications are successful, SEI-TSM can use its proprietary features to initiate a DID identity activation request to the current mobile number user via BIP or SMS.

[0086] It should be noted that the flowchart for writing the SIM card DID identity identifier via BIP is as follows: Figure 6 The flowchart below, taking BIP as an example, illustrates the process of writing a DID identity identifier to a SIM card. It reuses the BIP link established by the DID generation factor and the BIP link sessionkey. First, the SEI-TSM completes the external authentication operation of the SIM card, ensuring mutual authentication between both parties. Next, the SEI-TSM issues an APDU command to create a DID identifier and write it based on the BIP channel. Finally, the SIM card receives this APDU command and, based on the key index (e.g., the SM2 key) in the command parameters, determines the public / private key pair and key algorithm. It then decrypts the encrypted DID identifier sent by the APDU using the SM2 card private key, obtaining the plaintext DID identifier. This process updates the DID object content and associates the key, returning the writing result to the SEI-TSM. The SEI-TSM can also use this step to generate a user VC and write it to the card.

[0087] The step S105, which involves writing the received decrypted data to the SIM card application via a preset service verification link so that the operator server associates the SIM card application with the user's identity, includes the following:

[0088] Receive the association result obtained after associating the SIM card application with the user's identity identifier;

[0089] Based on the association results, the service status of the SIM card application is marked as authentication enabled.

[0090] It should be noted that in process 8: after the SIM is successfully written, the caller is notified of the execution result, and the SIM card application service status is set to DID enabled, and the SIM application is marked as capable of providing DID identity authentication services.

[0091] In this embodiment, by writing identity authentication data into the SIM card, the data transmission efficiency between the SIM card application and the service server and operator server is improved, and the security of data transmission is enhanced.

[0092] Furthermore, based on the first and second embodiments of this application, another embodiment of this application is provided. In this embodiment, before step S10 of sending the user terminal's identity authentication data and verification instructions to the SIM card application through a preset verification service link, the following steps are included:

[0093] The hash value of the user terminal is written into the SIM card, and the key data between the user terminal and the operator server is exchanged to generate a preset verification service link;

[0094] or,

[0095] The key data of the user terminal or business server is written into the SIM card through a preset interface or digital SMS to generate a preset verification service link.

[0096] It should be noted that this application establishes a pre-defined authentication service link between the user terminal and the SIM card through three methods to ensure high security of data transmission between the upper-layer application on the terminal side and the lower-layer SIM card.

[0097] Method 1: Utilizing the SIM card communication channel between the mobile terminal and the SIM card, SIM data is written, and the user terminal's hash value is written to the SIM card's AC access file, allowing the user terminal to access the SIM card's DID application. Simultaneously, this stage also completes the key exchange between the user terminal and the operator's TSM (Transport Service Provider), providing the key to the user terminal's SDK program to complete SIM card operations. It is generally recommended that both parties exchange SM2 public keys, and subsequent data transmissions should use a secure method of encryption with the other party's public key and signing with the user's own private key to enhance communication security.

[0098] Method 2: The user terminal or SP-TSM completes SIM data writing via BIP. This method requires the operator's TSM to authorize the service interface (or SDK) and exchange secure communication keys (generally using SM2 keys; both parties exchange SM2 public keys, encrypt data using the other party's public key during data exchange, and decrypt the received data using their own private key). This secure key serves as the encryption key for the communication data process between the operator's TSM and the SDK, ensuring absolute security of the communication link.

[0099] Method 3: The user terminal or SP-TSM completes the SIM data writing via SMS. (This solution is similar to the BIP method).

[0100] The above three solutions are fully compatible with common services. When the user terminal is a mobile app, the three modes can be selected. If it is another network-connected device such as a PC or a network-connected terminal, BIP or digital SMS can be used.

[0101] In this embodiment, by establishing a preset verification service link between the user terminal and the SIM card, the data transmission security between the user terminal and the SIM card is guaranteed, ensuring that the user's privacy is not leaked.

[0102] Reference Figure 3 , Figure 3 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of this application.

[0103] like Figure 3 As shown, the authentication device may include: a processor 1001, a memory 1005, and a communication bus 1002. The communication bus 1002 is used to realize the connection and communication between the processor 1001 and the memory 1005.

[0104] Optionally, the authentication device may also include a user interface, a network interface, a camera, RF (Radio Frequency) circuitry, sensors, a WiFi module, etc. The user interface may include a display screen and an input submodule such as a keyboard; optional user interfaces may also include standard wired or wireless interfaces. The network interface may include standard wired or wireless interfaces (such as a Wi-Fi interface).

[0105] Those skilled in the art will understand that Figure 3 The identity authentication device structure shown does not constitute a limitation on the identity authentication device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0106] like Figure 3 As shown, the memory 1005, as a storage medium, may include an operating system, a network communication module, and an authentication program. The operating system is a program that manages and controls the hardware and software resources of the authentication device, supporting the operation of the authentication program and other software and / or programs. The network communication module is used to enable communication between the various components within the memory 1005, as well as communication with other hardware and software in the authentication system.

[0107] exist Figure 3In the identity authentication device shown, the processor 1001 is used to execute the identity authentication program stored in the memory 1005 to implement the steps of the identity authentication method described above.

[0108] The specific implementation method of the identity authentication device in this application is basically the same as the embodiments of the above-mentioned identity authentication methods, and will not be described again here.

[0109] Furthermore, embodiments of the present invention also propose a computer program product, including an identity authentication program, which, when executed by a processor, implements the steps of the identity authentication method described above.

[0110] The specific implementation of the computer program product of the present invention is basically the same as the various embodiments of the above-described identity authentication method, and will not be repeated here.

[0111] This application also provides an identity authentication device, referring to... Figure 9 The identity authentication device further includes:

[0112] The first sending module is used to send the user terminal's identity authentication data and verification instructions to the SIM card application through a preset verification service link when an application access request sent by the user terminal is detected, so that the SIM card application can perform identity authentication on the user terminal based on the identity authentication data and obtain the identity authentication result. The preset verification service link is a service link preset between the user terminal, the service server and the operator server corresponding to the SIM card application.

[0113] The first receiving module is used to receive the identity authentication result fed back by the SIM card application.

[0114] In one possible embodiment of this application, the identity authentication device further includes:

[0115] The verification module is used to send the user terminal's identity authentication data to the operator server according to preset rules, so that the operator server can verify the identity authentication data and obtain the verification result.

[0116] The second sending module is used to send an identity activation request to the user terminal if the verification result shows that the verification passed.

[0117] The processing module is used to receive the confirmation instruction from the user terminal based on the identity activation request, and then perform key generation processing on the identity authentication data based on a preset algorithm to obtain a key index.

[0118] The decryption module is used to decrypt the identity authentication data according to the key index based on the operator server to obtain decrypted data;

[0119] The association module is used to write the received decrypted data to the SIM card application through a preset service verification link, so that the operator server associates the SIM card application with the user's identity.

[0120] In one possible embodiment of this application, the identity authentication device further includes:

[0121] The second receiving module is used to receive the association result obtained after the SIM card application is associated with the user's identity identifier;

[0122] The marking module is used to mark the service status of the SIM card application as an authentication enabled state based on the association result.

[0123] In one possible implementation of this application, the verification module includes:

[0124] The first verification unit is used for the operator server to perform signature verification on the identity authentication data using the first public key data of the service server;

[0125] The second verification unit is used to decrypt the identity authentication data using the second public key data of the operator server after the signature verification is successful, and to perform whitelist verification on the operation identifier of the SIM card to obtain the verification result.

[0126] In one possible implementation of this application, the first receiving module includes:

[0127] The generation unit is used to generate verification instructions based on the identity authentication data of the user terminal;

[0128] The sending unit is used to send the identity authentication data and the verification instruction to the SIM card application through a preset verification service link;

[0129] An authentication processing unit is used to perform authentication processing on the identity authentication data according to the verification instruction based on the SIM card application, and obtain an identity authentication result.

[0130] In one possible embodiment of this application, the identity authentication device further includes:

[0131] The switching module is used to write the hash value of the user terminal into the SIM card and exchange key data between the user terminal and the operator server to generate a preset verification service link.

[0132] or,

[0133] The writing module is used to write the key data of the user terminal or business server into the SIM card through a preset interface or digital SMS to generate a preset verification service link.

[0134] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0135] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0136] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0137] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. An identity authentication method, characterized by, The method applied to a service server comprises the following steps: Upon detecting an application access request sent by a user terminal, identity authentication data of the user terminal and a verification instruction are sent to a SIM card application through a preset verification service link, so that the SIM card application performs identity authentication on the user terminal based on the identity authentication data, and an identity authentication result is obtained, wherein the preset verification service link is a service link preset between the user terminal, the service server and an operator server corresponding to the SIM card application; An identity authentication result fed back by the SIM card application is received; Before the step of sending the identity authentication data of the user terminal and the verification instruction to the SIM card application through the preset verification service link, the following steps are included: According to a preset rule, the identity authentication data of the user terminal is sent to the operator server, so that the operator server checks the identity authentication data and obtains a checking result; If the checking result shows that the checking is passed, an identity opening request is sent to the user terminal; After receiving a confirmation instruction fed back by the user terminal based on the identity opening request, the identity authentication data is subjected to key generation processing based on a preset algorithm, and a key index is obtained; Based on the operator server, the identity authentication data is decrypted according to the key index, and decrypted data is obtained; The received decrypted data is written to the SIM card application through a preset service verification link, so that the operator server associates the SIM card application with the identity of the user.

2. The identity authentication method of claim 1, wherein, After the step of writing the received decrypted data to the SIM card application through the preset service verification link, so that the operator server associates the SIM card application with the identity of the user, the following steps are included: An association result obtained after the SIM card application is associated with the identity of the user is received; Based on the association result, the service state of the SIM card application is marked as an authentication enabled state.

3. The identity authentication method of claim 1, wherein, The step of checking the identity authentication data by the operator server and obtaining a checking result comprises the following steps: The identity authentication data is subjected to signature verification by a first public key data of the service server; After the signature verification is successful, the identity authentication data is decrypted by a second public key data of the operator server, and the operation identity of the SIM card is subjected to whitelist verification, and a checking result is obtained.

4. The identity authentication method of claim 1, wherein, The step of sending the identity authentication data of the user terminal and the verification instruction to the SIM card application through the preset verification service link, so that the SIM card application performs identity authentication on the user terminal based on the identity authentication data and obtains an identity authentication result comprises the following steps: Based on the identity authentication data of the user terminal, a verification instruction is generated; The identity authentication data and the verification instruction are sent to the SIM card application through a preset verification service link; Based on the SIM card application, the identity authentication data is subjected to authentication processing according to the verification instruction, and an identity authentication result is obtained.

5. The identity authentication method of claim 1, wherein, Before the step of sending the identity authentication data of the user terminal and the verification instruction to the SIM card application through the preset verification service link, the method comprises the steps of: writing the hash value of the user terminal into the SIM card, and exchanging the key data between the user terminal and the operator server to generate the preset verification service link; or, writing the key data of the user terminal or the service server into the SIM card through the preset interface or the digital short message mode to generate the preset verification service link.

6. An identity authentication apparatus characterized by comprising: The identity authentication device comprises: a first sending module, configured to send the identity authentication data of the user terminal and the verification instruction to the SIM card application through the preset verification service link when detecting the application access request sent by the user terminal, so that the SIM card application performs identity authentication on the user terminal based on the identity authentication data to obtain an identity authentication result, wherein the preset verification service link is a service link preset between the user terminal, the service server and the operator server corresponding to the SIM card application; a first receiving module, configured to receive the identity authentication result fed back by the SIM card application; Before the step of sending the identity authentication data of the user terminal and the verification instruction to the SIM card application through the preset verification service link, the identity authentication device further comprises: a verification module, configured to send the identity authentication data of the user terminal to the operator server according to a preset rule, so that the operator server verifies the identity authentication data to obtain a verification result; a second sending module, configured to send an identity opening request to the user terminal if the verification result shows that the verification is passed; a processing module, configured to, after receiving the confirmation instruction fed back by the user terminal based on the identity opening request, perform key generation processing on the identity authentication data based on a preset algorithm to obtain a key index; a decryption module, configured to decrypt the identity authentication data according to the key index based on the operator server to obtain decrypted data; an association module, configured to write the received decrypted data to the SIM card application through the preset service verification link, so that the operator server associates the SIM card application with the identity of the user.

7. An identity authentication device, characterized by, The device comprises a memory and a processor; the memory stores an identity authentication program, and the processor is configured to run the identity authentication program; the identity authentication program is configured to implement the steps of the identity authentication method according to any one of claims 1 to 5.

8. A computer storage medium, characterized in that, The computer storage medium stores an identity authentication program; when the identity authentication program is executed by a processor, the steps of the identity authentication method according to any one of claims 1 to 5 are implemented.

9. A computer program product, characterised in that, The computer program product comprises an identity authentication program; when the identity authentication program is executed by a processor, the steps of the identity authentication method according to any one of claims 1 to 5 are implemented.

Images