Identity authentication method, device and equipment and computer readable storage medium

Abstract

The invention discloses an identity authentication method, apparatus and device, and a computer readable storage medium. The method comprises the steps of calling first hardware fingerprint information corresponding to a to-be-authenticated user side and deriving a first random number of the first hardware fingerprint information through a first secure channel by using an authorization service; receiving second hardware fingerprint information obtained by calculating the first random number through the physical unclonable function by the to-be-authenticated user side through the second secure channel by using the authorization service; and when the authorization service is utilized to determine that the first hardware fingerprint information is consistent with the second hardware fingerprint information, determining that the identity authentication of the to-be-authenticated user side is passed so as to establish a trust relationship between the to-be-authenticated user side and the task trusted execution environment. By applying the identity authentication method provided by the invention, the accurate authentication of the user identity is realized, and a reliable two-way trust system between the to-be-authenticated user side and the task trusted execution environment is established.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an identity authentication method, device, equipment and computer-readable storage medium. Background Art

[0002] Nowadays, data has become a new asset class, which is of great significance to the development of enterprises and society. However, in the process of data circulation and utilization, it faces many challenges in security and privacy, such as data leakage risk, gradual improvement of legal and regulatory requirements, and data silos. Faced with these imminent challenges, privacy computing technology has emerged. It can encrypt and analyze data without leaking the original data, so as to achieve secure data sharing. It provides the possibility for the safe circulation and utilization of data, so that data can play a greater role under the premise of protecting privacy. At the same time, privacy computing technology also provides technical support for the implementation of laws and regulations, helping enterprises to handle data in compliance with regulations.

[0003] However, although privacy computing technology provides new possibilities for data security and privacy protection, in practical applications, how to build a reliable two-way trust system is still an important challenge in the field of privacy computing. In particular, when establishing a trust relationship between a trusted execution environment (TEE) and a user, it is necessary to ensure the authenticity of the user's identity and the security of the trusted execution environment.

[0004] In summary, how to effectively solve the problem of how to build a reliable two-way trust system and better authenticate the user identity is a problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The purpose of this application is to provide an identity authentication method, which realizes accurate authentication of user identity and establishes a reliable two-way trust system between the user terminal to be authenticated and the task trusted execution environment; another purpose of this application is to provide an identity authentication device, equipment and computer-readable storage medium.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] An identity authentication method, comprising:

[0008] Retrieving, by using the authorization service through the first security channel, first hardware fingerprint information corresponding to the user terminal to be authenticated and a first random number derived from the first hardware fingerprint information;

[0009] Receive, by means of the authorization service through a second secure channel, second hardware fingerprint information obtained by the to-be-authenticated user terminal by calculating the first random number through a physical unclonable function;

[0010] When the authorization service is used to determine that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the to-be-authenticated user terminal is passed, so as to establish a trust relationship between the to-be-authenticated user terminal and the task trusted execution environment.

[0011] In a specific implementation of the present application, before using the authorization service to retrieve the first hardware fingerprint information corresponding to the user terminal to be authenticated through the first security channel and deriving the first random number of the first hardware fingerprint information, it also includes:

[0012] Deriving a second random number by hardware in the task trusted execution environment, and generating a first public-private key pair corresponding to the task trusted execution environment;

[0013] Calculate a first hash value of the second random number and the first public key in the first public-private key pair through the authorization service, and generate a first remote authentication report corresponding to the task trusted execution environment according to the first hash value;

[0014] When the identity authentication of the task trusted execution environment is passed according to the first remote authentication report, a first secure channel is established between the user terminal to be authenticated and the task trusted execution environment.

[0015] In a specific implementation of the present application, before using the authorization service to retrieve the first hardware fingerprint information corresponding to the user terminal to be authenticated through the first security channel and deriving the first random number of the first hardware fingerprint information, it also includes:

[0016] Deriving the first random number through the authorization service hardware, and generating a second public-private key pair corresponding to the authorization service trusted execution environment;

[0017] Calculate, by the authorization service, a second hash value of the first random number and the second public key in the second public-private key pair, and generate a second remote authentication report of the authorization service trusted execution environment according to the second hash value;

[0018] Sending the second remote authentication report, the first random number and the second public key to the to-be-authenticated user terminal through the authorization service, so that the to-be-authenticated user terminal verifies the second remote authentication report using the report verification service;

[0019] When the second remote authentication report is verified to be successful, a second secure channel is established between the user terminal to be authenticated and the authorization service.

[0020] In a specific implementation of the present application, establishing a second secure channel between the to-be-authenticated user terminal and the authorization service includes:

[0021] Obtaining a shared key negotiated between the user to be authenticated and the authorization service;

[0022] A second secure channel is established between the user terminal to be authenticated and the authorization service according to the shared key.

[0023] In a specific implementation of the present application, after establishing the second security channel between the user terminal to be authenticated and the authorization service, before using the authorization service to retrieve the first hardware fingerprint information corresponding to the user terminal to be authenticated through the first security channel and derive the first random number of the first hardware fingerprint information, it also includes:

[0024] The first hardware fingerprint information is obtained by the user terminal to be authenticated calling the physical unclonable function to calculate the first random number;

[0025] Generate a third public-private key pair corresponding to the user terminal to be authenticated, and send the first hardware fingerprint information, the third public key in the third public-private key pair, and the user terminal device identification information to the authorization service through the second secure channel;

[0026] When the authorization service verifies the user terminal device identification information, it generates user identification information corresponding to the user terminal to be authenticated;

[0027] The user identification information, the first random number, the first hardware fingerprint information, the third public key, and the user terminal device identification information are encrypted and stored in a database using the authorization service.

[0028] In a specific implementation of the present application, after generating the user identification information corresponding to the user terminal to be authenticated, the method further includes:

[0029] The authorization service is used to send a certificate issuance request to the report verification service according to the third public key and the user identification information, and the received user certificate and the user identification information are returned to the user terminal to be authenticated.

[0030] In a specific implementation of the present application, using the authorization service to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal through the first security channel and deriving the first random number from the first hardware fingerprint information includes:

[0031] Utilizing the authorization service to receive the user identification information sent by the task trusted execution environment after successfully authenticating the user certificate of the to-be-authenticated user terminal;

[0032] The first hardware fingerprint information and the first random number are retrieved according to the user identification information through the first secure channel using an authorization service.

[0033] An identity authentication device, comprising:

[0034] A fingerprint and random number retrieving module, used to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal and the first random number derived from the first hardware fingerprint information through the first security channel using the authorization service;

[0035] A fingerprint receiving module, configured to receive, by using the authorization service through a second secure channel, second hardware fingerprint information obtained by the to-be-authenticated user terminal by calculating the first random number through a physical unclonable function;

[0036] The trust relationship establishment module is used to determine that the identity authentication of the to-be-authenticated user terminal is passed when the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, so as to establish a trust relationship between the to-be-authenticated user terminal and the task trusted execution environment.

[0037] An identity authentication device, comprising:

[0038] Memory for storing computer programs;

[0039] A processor is used to implement the steps of the identity authentication method as described above when executing the computer program.

[0040] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the identity authentication method described above are implemented.

[0041] The identity authentication method provided by the present application utilizes an authorization service to retrieve, through a first secure channel, first hardware fingerprint information corresponding to a user terminal to be authenticated and a first random number derived from the first hardware fingerprint information; utilizes an authorization service to receive, through a second secure channel, second hardware fingerprint information obtained by calculating the first random number through a physical unclonable function by the user terminal to be authenticated; when utilizing the authorization service to determine that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, so as to establish a trust relationship between the user terminal to be authenticated and a task trusted execution environment.

[0042] It can be seen from the above technical solution that by pre-establishing a first secure channel between the user terminal to be authenticated and the task trusted execution environment, and pre-storing the first hardware fingerprint information corresponding to the user terminal to be authenticated and the first random number derived from the first hardware fingerprint information. Pre-establishing a second secure channel between the user terminal to be authenticated and the authorization service, the user terminal to be authenticated calculates the first random number through a physical unclonable function to obtain the second hardware fingerprint information, and sends the second hardware fingerprint information to the authorization service through the second secure channel. The authorization service compares the consistency of the first hardware fingerprint information and the second hardware fingerprint information. When the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, thereby establishing a trust relationship between the user terminal to be authenticated and the task trusted execution environment. By using a physical unclonable function to calculate the fingerprint information, according to the fingerprint consistency comparison result, accurate authentication of the user identity is achieved. By pre-deploying the authorization service, and establishing the first secure channel between the user terminal to be authenticated and the task trusted execution environment and the second secure channel between the user terminal to be authenticated and the authorization service, a reliable two-way trust system between the user terminal to be authenticated and the task trusted execution environment is established.

[0043] Correspondingly, the present application also provides an identity authentication device, equipment and computer-readable storage medium corresponding to the above-mentioned identity authentication method, which have the above-mentioned technical effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] FIG1 is a flowchart of an implementation of an identity authentication method in an embodiment of the present application;

[0046] FIG2 is another implementation flow chart of the identity authentication method in the embodiment of the present application;

[0047] FIG3 is a timing diagram of an identity authentication method in an embodiment of the present application;

[0048] FIG4 is a structural block diagram of an identity authentication device in an embodiment of the present application;

[0049] FIG5 is a structural block diagram of an identity authentication device in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of the specific structure of an identity authentication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0052] Referring to FIG. 1 , FIG. 1 is a flowchart of an implementation of an identity authentication method in an embodiment of the present application. The method may include the following steps:

[0053] S101: Using an authorization service through a first security channel to retrieve first hardware fingerprint information corresponding to a user terminal to be authenticated and a first random number derived from the first hardware fingerprint information.

[0054] The first secure channel between the user terminal to be authenticated and the task trusted execution environment is established in advance. The platform provides the user with a hardware device as the user terminal offline, and the hardware device has only one unique fingerprint. The first hardware fingerprint information corresponding to the user terminal to be authenticated and the first random number derived from the first hardware fingerprint information are pre-stored. When the user terminal to be authenticated needs to be authenticated, the first hardware fingerprint information corresponding to the user terminal to be authenticated and the first random number derived from the first hardware fingerprint information are retrieved through the first secure channel using the Authorization Service (AS).

[0055] S102: Receive, by using the authorization service through a second secure channel, second hardware fingerprint information obtained by the user terminal to be authenticated by calculating the first random number through a physical unclonable function.

[0056] The user terminal to be authenticated calculates the first random number through a Physical Unclonable Function (PUF) to obtain second hardware fingerprint information.

[0057] S103: When the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, so as to establish a trust relationship between the user terminal to be authenticated and the task trusted execution environment.

[0058] The authorization service compares the first hardware fingerprint information with the second hardware fingerprint information for consistency. When the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, thereby establishing a trust relationship between the user terminal to be authenticated and the task trusted execution environment. By using a physical unclonable function to calculate fingerprint information, accurate authentication of the user identity is achieved based on the fingerprint consistency comparison results. By pre-deploying the authorization service and establishing a first security channel between the user terminal to be authenticated and the task trusted execution environment and a second security channel between the user terminal to be authenticated and the authorization service, a reliable two-way trust system is established between the user terminal to be authenticated and the task trusted execution environment.

[0059] It can be seen from the above technical solution that by pre-establishing a first secure channel between the user terminal to be authenticated and the task trusted execution environment, and pre-storing the first hardware fingerprint information corresponding to the user terminal to be authenticated and the first random number derived from the first hardware fingerprint information. Pre-establishing a second secure channel between the user terminal to be authenticated and the authorization service, the user terminal to be authenticated calculates the first random number through a physical unclonable function to obtain the second hardware fingerprint information, and sends the second hardware fingerprint information to the authorization service through the second secure channel. The authorization service compares the consistency of the first hardware fingerprint information and the second hardware fingerprint information. When the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, thereby establishing a trust relationship between the user terminal to be authenticated and the task trusted execution environment. By using a physical unclonable function to calculate the fingerprint information, according to the fingerprint consistency comparison result, accurate authentication of the user identity is achieved. By pre-deploying the authorization service, and establishing the first secure channel between the user terminal to be authenticated and the task trusted execution environment and the second secure channel between the user terminal to be authenticated and the authorization service, a reliable two-way trust system between the user terminal to be authenticated and the task trusted execution environment is established.

[0060] It should be noted that, based on the above embodiments, the embodiments of the present application also provide corresponding improved solutions. In the subsequent embodiments, the same steps or corresponding steps as those in the above embodiments can be referenced to each other, and the corresponding beneficial effects can also be referenced to each other, which will not be repeated one by one in the following improved embodiments.

[0061] Referring to FIG. 2 , FIG. 2 is another implementation flow chart of the identity authentication method in an embodiment of the present application, and the method may include the following steps:

[0062] S201: Deriving a second random number by hardware in a task trusted execution environment, and generating a first public-private key pair corresponding to the task trusted execution environment.

[0063] It is necessary to perform security authentication on the task trusted execution environment in advance. In the task trusted execution environment, the second random number r2 is derived by hardware, and a first public-private key pair corresponding to the task trusted execution environment is generated.

[0064] It should be noted that the first and second of the first random number and the second random number are only used to distinguish the random number derived from the authentication client and the random number derived from the task trusted execution environment, and there is no distinction in size or order.

[0065] S202: Calculate a first hash value of a second random number and a first public key in a first public-private key pair through an authorization service, and generate a first remote authentication report corresponding to the task trusted execution environment according to the first hash value.

[0066] After generating the first public-private key pair corresponding to the task trusted execution environment, the second random number and the first hash value of the first public key in the first public-private key pair are calculated through the authorization service, and the first remote authentication report corresponding to the task trusted execution environment is generated according to the first hash value.

[0067] S203: When the identity authentication of the task trusted execution environment is passed according to the first remote authentication report, a first secure channel is established between the user terminal to be authenticated and the task trusted execution environment.

[0068] After generating the first remote authentication report corresponding to the task trusted execution environment, the task trusted execution environment is authenticated according to the first remote authentication report using the authorization service. When the task trusted execution environment is authenticated according to the first remote authentication report, a first secure channel is established between the user terminal to be authenticated and the task trusted execution environment, thereby achieving a secure connection between the user terminal to be authenticated and the task trusted execution environment, and ensuring the credibility of the task trusted execution environment.

[0069] S204: Derive a first random number through the authorization service hardware, and generate a second public-private key pair corresponding to the authorization service trusted execution environment.

[0070] Before using the authorization service to authenticate the user to be authenticated, the authorization service needs to be authenticated first. The first random number r is derived through the authorization service hardware, and a second public-private key pair corresponding to the authorization service trusted execution environment is generated.

[0071] S205: Calculate the second hash value of the first random number and the second public key in the second public-private key pair through the authorization service, and generate a second remote authentication report of the authorization service trusted execution environment according to the second hash value.

[0072] After generating a second public-private key pair corresponding to the authorized service trusted execution environment, the authorization service calculates the first random number and the second hash value of the second public key in the second public-private key pair, and generates a second remote authentication report of the authorized service trusted execution environment according to the second hash value.

[0073] It should be noted that the first and second in the first remote authentication report are only for distinguishing the remote authentication reports used to verify the task trusted execution environment and the authorization service trusted execution environment, and there is no distinction in size or order.

[0074] S206: Send the second remote authentication report, the first random number and the second public key to the user terminal to be authenticated through the authorization service, so that the user terminal to be authenticated verifies the second remote authentication report using the report verification service.

[0075] After the second remote authentication report is generated, the second remote authentication report, the first random number and the second public key are sent to the user terminal to be authenticated through the authorization service, and the user terminal to be authenticated verifies the second remote authentication report using the report verification service.

[0076] The report verification service is an authoritative center (Certificate Authority, CA) that can verify the remote authentication report. By using the report verification service to verify the credibility of the second remote authentication report of the authorized service, the reliability of the report verification result is improved.

[0077] S207: When the second remote authentication report is verified to be successful, a second secure channel is established between the user terminal to be authenticated and the authorization service.

[0078] After the user terminal to be authenticated uses the report verification service to verify the second remote authentication report, when the second remote authentication report is verified and passed, a second secure channel is established between the user terminal to be authenticated and the authorization service, thereby realizing a secure connection between the user terminal to be authenticated and the authorization service, and ensuring the credibility of the authorization service.

[0079] In a specific implementation of the present application, establishing a second secure channel between the user terminal to be authenticated and the authorization service may include the following steps:

[0080] Step 1: Obtain the shared key negotiated between the user to be authenticated and the authorization service;

[0081] Step 2: Establish a second secure channel between the client to be authenticated and the authorization service based on the shared key.

[0082] For the convenience of description, the above two steps can be combined for explanation.

[0083] When establishing the second security channel between the user terminal to be authenticated and the authorization service, the user terminal to be authenticated and the authorization service perform key negotiation, obtain the shared key negotiated by the user terminal to be authenticated and the authorization service, and establish the second security channel between the user terminal to be authenticated and the authorization service based on the shared key. By establishing the second security channel between the user terminal to be authenticated and the authorization service based on the shared key negotiated by the user terminal to be authenticated and the authorization service, the security of the second security channel is guaranteed.

[0084] S208: The user terminal to be authenticated calls a physical unclonable function to calculate a first random number to obtain first hardware fingerprint information.

[0085] After the second remote authentication report, the first random number and the second public key are sent to the client to be authenticated through the authorization service, the client to be authenticated calls a physical unclonable function to calculate the first random number to obtain the first hardware fingerprint information p.

[0086] S209: Generate a third public-private key pair corresponding to the user terminal to be authenticated, and send the first hardware fingerprint information, the third public key in the third public-private key pair, and the user terminal device identification information to the authorization service through the second security channel.

[0087] After calculating the first hardware fingerprint information, a third public-private key pair corresponding to the user terminal to be authenticated is generated, and the first hardware fingerprint information, the third public key user_pk in the third public-private key pair and the user terminal device identification information device_id are sent to the authorization service through the second security channel.

[0088] S210: When the authorization service verifies the user terminal device identification information, it generates user identification information corresponding to the user terminal to be authenticated.

[0089] The authorization service receives the user terminal device identification information and verifies the user terminal device identification information. When the authorization service verifies the user terminal device identification information, it generates the user identification information uuid corresponding to the user terminal to be authenticated.

[0090] S211: Using the authorization service to send a certificate issuance request to the report verification service according to the third public key and the user identification information, and returning the received user certificate and user identification information to the user terminal to be authenticated.

[0091] After generating the user identification information uuid corresponding to the user terminal to be authenticated, the authorization service sends a certificate issuance request to the report verification service based on the third public key and user identification information. The authorization service receives the user certificate user_cert returned by the report verification service, and returns the received user certificate and user identification information to the user terminal to be authenticated.

[0092] S212: Utilize the authorization service to encrypt the user identification information, the first random number, the first hardware fingerprint information, the third public key, and the user terminal device identification information and store them in a database.

[0093] After the authorization service returns the received user certificate and user identification information to the user terminal to be authenticated, the authorization service uses the authorization service to encrypt the user identification information uuid, the first random number r, the first hardware fingerprint information p, the third public key user_pk, and the user terminal device identification information device_id and store them in the database.

[0094] S213: Receive, by means of the authorization service, the user identification information sent by the task trusted execution environment after the user certificate of the client to be authenticated is successfully authenticated.

[0095] When the task trusted execution environment receives the authentication request from the user terminal to be authenticated, it first authenticates the user certificate of the user terminal to be authenticated. When the user certificate of the user terminal to be authenticated is successfully authenticated, the user identification information is sent to the authorization service, and the authorization service is used to receive the user identification information sent by the task trusted execution environment after the user certificate of the user terminal to be authenticated is successfully authenticated.

[0096] S214: Using the authorization service through the first security channel to retrieve the first hardware fingerprint information and the first random number according to the user identification information.

[0097] Because the authorization service encrypts the user identification information, the first random number, the first hardware fingerprint information, the third public key, and the user terminal device identification information in advance and stores them in the database. After the authorization service receives the matching user identification information, the authorization service is used to retrieve the first hardware fingerprint information and the first random number according to the user identification information through the first secure channel. For example, identification information can be set for the encrypted stored information, and the ciphertext information to be retrieved can be determined based on the identification information, and then the ciphertext information is decrypted to obtain the plaintext first hardware fingerprint information and the first random number.

[0098] S215: Receive, by using the authorization service through the second security channel, second hardware fingerprint information obtained by the user terminal to be authenticated by calculating the first random number through a physical unclonable function.

[0099] S216: When the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, determine that the identity authentication of the user terminal to be authenticated is passed, so as to establish a trust relationship between the user terminal to be authenticated and the task trusted execution environment.

[0100] See Figure 3, which is a timing diagram of an identity authentication method in an embodiment of the present application. The identity authentication method includes two stages, one is a registration stage, and the other is a verification stage.

[0101] The registration phase includes the following steps:

[0102] a. The AS service derives a random number r from the hardware and generates its own public and private keys: sk, pk;

[0103] b. The AS service uses the random number r and the hash value of pk as input user data to generate its own remote authentication report;

[0104] c. The AS service sends the remote authentication report, r and pk to the user;

[0105] d. The user verifies the remote authentication report of the AS service with the help of the authoritative central CA;

[0106] e. After verification, the user and the AS service negotiate a shared key sym_key and establish a secure channel based on sym_key;

[0107] f. The user uses a physical unclonable function locally, taking the random number r as input to derive the unique fingerprint p of the hardware;

[0108] g. The user generates his own public and private keys locally: user_pk, user_sk;

[0109] h. The user sends p, user_pk, and device_id to the AS service through a secure channel;

[0110] i. After receiving the device_id, AS first verifies the correctness of the device_id, then generates a unique uuid for the user and<uuid、r、p、user_pk、device_id> Encrypted storage;

[0111] j. At the same time, the AS service carries user_pk and uuid to request the CA to issue a certificate for the user, and returns the certificate and uuid to the user.

[0112] The verification phase is equivalent to the task execution phase. A task trusted execution environment is temporarily created and a trust relationship is established with the task trusted execution environment. This phase may include the following steps:

[0113] a. In the task trusted execution environment, the hardware derives the random number r2, public and private keys, and generates a remote authentication report in the same way and sends it to the user;

[0114] b. After receiving the report, the user requests the CA to verify the report to complete the authentication of the trusted execution environment of the task;

[0115] c. After the task trusted execution environment passes identity authentication, a secure channel is established with the task trusted execution environment based on its public key;

[0116] d. Based on the random number r2, use the physical unclonable function to calculate p2, and send the uuid and user_cert together to the task trusted execution environment;

[0117] e. The task trusted execution environment sends uuid, r2, and p2 to the AS service. The AS service queries the associated information from the library based on uuid:<uuid、r、p、user_pk、device_id> ;

[0118] f. The AS service returns the random number r of the registration phase to the user;

[0119] g. The user locally uses the physical unclonable function with input r to calculate the fingerprint p3 and return it to the AS service. The AS service compares p3 with the queried p. If they are consistent, the user identity verification has passed.

[0120] h. The AS service returns the verification result to the task trusted execution environment;

[0121] i. After confirming the user's identity, the task trusted execution environment can complete task consistency verification and user authorization verification based on the user's certificate.

[0122] Corresponding to the above method embodiment, the present application also provides an identity authentication device. The identity authentication device described below and the identity authentication method described above can refer to each other.

[0123] Referring to FIG. 4 , FIG. 4 is a structural block diagram of an identity authentication device in an embodiment of the present application, and the device may include:

[0124] The fingerprint and random number retrieving module 41 is used to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal and the first random number derived from the first hardware fingerprint information through the first secure channel using the authorization service;

[0125] The fingerprint receiving module 42 is used to receive the second hardware fingerprint information obtained by the user terminal to be authenticated by calculating the first random number through a physical unclonable function through the second security channel using the authorization service;

[0126] The trust relationship establishing module 43 is used to determine that the identity authentication of the user terminal to be authenticated is passed when the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, so as to establish a trust relationship between the user terminal to be authenticated and the task trusted execution environment.

[0127] It can be seen from the above technical solution that by pre-establishing a first secure channel between the user terminal to be authenticated and the task trusted execution environment, and pre-storing the first hardware fingerprint information corresponding to the user terminal to be authenticated and the first random number derived from the first hardware fingerprint information. Pre-establishing a second secure channel between the user terminal to be authenticated and the authorization service, the user terminal to be authenticated calculates the first random number through a physical unclonable function to obtain the second hardware fingerprint information, and sends the second hardware fingerprint information to the authorization service through the second secure channel. The authorization service compares the consistency of the first hardware fingerprint information and the second hardware fingerprint information. When the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, thereby establishing a trust relationship between the user terminal to be authenticated and the task trusted execution environment. By using a physical unclonable function to calculate the fingerprint information, according to the fingerprint consistency comparison result, accurate authentication of the user identity is achieved. By pre-deploying the authorization service, and establishing the first secure channel between the user terminal to be authenticated and the task trusted execution environment and the second secure channel between the user terminal to be authenticated and the authorization service, a reliable two-way trust system between the user terminal to be authenticated and the task trusted execution environment is established.

[0128] In a specific embodiment of the present application, the device may further include:

[0129] A first public-private key pair generation module is used to derive a second random number from hardware in a task trusted execution environment and generate a first public-private key pair corresponding to the task trusted execution environment before using the authorization service to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal through the first secure channel and derive the first random number from the first hardware fingerprint information;

[0130] A first remote authentication report generating module, used to calculate a first hash value of a first public key in a first public-private key pair and a second random number through an authorization service, and generate a first remote authentication report corresponding to a task trusted execution environment according to the first hash value;

[0131] The first security channel establishing module is used to establish a first security channel between the user terminal to be authenticated and the task trusted execution environment when the identity authentication of the task trusted execution environment is passed according to the first remote authentication report.

[0132] In a specific embodiment of the present application, the device may further include:

[0133] A second public-private key pair generation module is used to derive a first random number through the authorization service hardware and generate a second public-private key pair corresponding to the authorization service trusted execution environment before using the authorization service to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal through the first secure channel and derive the first random number from the first hardware fingerprint information;

[0134] A second remote authentication report generating module, used to calculate the second hash value of the second public key in the second public-private key pair and the first random number through the authorization service, and generate a second remote authentication report of the authorization service trusted execution environment according to the second hash value;

[0135] A report verification module, used to send the second remote authentication report, the first random number and the second public key to the user terminal to be authenticated through the authorization service, so that the user terminal to be authenticated verifies the second remote authentication report using the report verification service;

[0136] The second security channel establishing module is used to establish a second security channel between the user terminal to be authenticated and the authorization service when the second remote authentication report is verified to be passed.

[0137] In a specific implementation of the present application, the second secure channel establishment module includes:

[0138] The shared key acquisition submodule is used to obtain the shared key negotiated between the user to be authenticated and the authorization service;

[0139] The second security channel submodule is used to establish a second security channel between the user terminal to be authenticated and the authorization service according to the shared key.

[0140] In a specific embodiment of the present application, the device may further include:

[0141] The user terminal information sending module is used to generate a third public-private key pair corresponding to the user terminal to be authenticated, and send the first hardware fingerprint information, the third public key in the third public-private key pair, and the user terminal device identification information to the authorization service through the second security channel;

[0142] A user identification information generation module is used to generate user identification information corresponding to the user terminal to be authenticated when the authorization service verifies the user terminal device identification information;

[0143] The storage module is used to encrypt and store the user identification information, the first random number, the first hardware fingerprint information, the third public key, and the user terminal device identification information by using the authorization service.

[0144] In a specific embodiment of the present application, the device may further include:

[0145] The user information return module is used to generate user identification information corresponding to the user terminal to be authenticated, use the authorization service to send a certificate issuance request to the report verification service according to the third public key and user identification information, and return the received user certificate and user identification information to the user terminal to be authenticated.

[0146] In a specific implementation of the present application, the fingerprint and random number retrieval module 41 includes:

[0147] The user identification information receiving submodule is used to use the authorization service to receive the user identification information sent by the task trusted execution environment after the user certificate of the authentication user terminal is authenticated;

[0148] The fingerprint and random number retrieval submodule is used to retrieve the first hardware fingerprint information and the first random number according to the user identification information through the first security channel using the authorization service.

[0149] Corresponding to the above method embodiment, referring to FIG5 , FIG5 is a schematic diagram of an identity authentication device provided by the present application, and the device may include:

[0150] A memory 332, for storing computer programs;

[0151] The processor 322 is used to implement the steps of the identity authentication method of the above method embodiment when executing the computer program.

[0152] For details, please refer to Figure 6 , Figure 6 A specific structural diagram of an identity authentication device provided for this embodiment, which may have relatively large differences due to different configurations or performances, may include a processor (central processing units, CPU) 322 (for example, one or more processors) and a memory 332, wherein the memory 332 stores one or more computer programs 342 or data 344. Among them, the memory 332 may be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), each of which may include a series of instruction operations in the data processing device. Furthermore, the processor 322 may be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the identity authentication device 301.

[0153] The identity authentication device 301 may also include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0154] The steps in the identity authentication method described above can be implemented by the structure of the identity authentication device.

[0155] Corresponding to the above method embodiment, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps can be implemented:

[0156] The first hardware fingerprint information corresponding to the user terminal to be authenticated and the first random number derived from the first hardware fingerprint information are retrieved through a first security channel by using an authorization service; the second hardware fingerprint information obtained by the user terminal to be authenticated by calculating the first random number through a physical unclonable function is received through a second security channel by using the authorization service; when the authorization service is used to determine that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the user terminal to be authenticated is passed, so as to establish a trust relationship between the user terminal to be authenticated and the task trusted execution environment.

[0157] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0158] For an introduction to the computer-readable storage medium provided in this application, please refer to the above method embodiment, and this application will not go into details here.

[0159] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the devices, equipment and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0160] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the technical solution and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. An identity authentication method, characterized in that: include: Retrieving, by using the authorization service through the first security channel, first hardware fingerprint information corresponding to the user terminal to be authenticated and a first random number derived from the first hardware fingerprint information; Receive, by means of the authorization service through a second secure channel, second hardware fingerprint information obtained by the to-be-authenticated user terminal by calculating the first random number through a physical unclonable function; When the authorization service is used to determine that the first hardware fingerprint information is consistent with the second hardware fingerprint information, it is determined that the identity authentication of the to-be-authenticated user terminal is passed, so as to establish a trust relationship between the to-be-authenticated user terminal and the task trusted execution environment.

2. The identity authentication method according to claim 1, characterized in that: Before using the authorization service to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal through the first security channel and deriving the first random number from the first hardware fingerprint information, the method further includes: Deriving a second random number by hardware in the task trusted execution environment, and generating a first public-private key pair corresponding to the task trusted execution environment; Calculate a first hash value of the second random number and the first public key in the first public-private key pair through the authorization service, and generate a first remote authentication report corresponding to the task trusted execution environment according to the first hash value; When the identity authentication of the task trusted execution environment is passed according to the first remote authentication report, a first secure channel is established between the user terminal to be authenticated and the task trusted execution environment.

3. The identity authentication method according to claim 1, characterized in that: Before using the authorization service to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal through the first security channel and deriving the first random number from the first hardware fingerprint information, the method further includes: Deriving the first random number through the authorization service hardware, and generating a second public-private key pair corresponding to the authorization service trusted execution environment; Calculate, by the authorization service, a second hash value of the first random number and the second public key in the second public-private key pair, and generate a second remote authentication report of the authorization service trusted execution environment according to the second hash value; Sending the second remote authentication report, the first random number and the second public key to the to-be-authenticated user terminal through the authorization service, so that the to-be-authenticated user terminal verifies the second remote authentication report using the report verification service; When the second remote authentication report is verified to be successful, a second secure channel is established between the user terminal to be authenticated and the authorization service.

4. The identity authentication method according to claim 3, characterized in that: Establishing a second secure channel between the user terminal to be authenticated and the authorization service includes: Obtaining a shared key negotiated between the user to be authenticated and the authorization service; A second secure channel is established between the user terminal to be authenticated and the authorization service according to the shared key.

5. The identity authentication method according to claim 3 or 4, characterized in that: After establishing a second security channel between the user terminal to be authenticated and the authorization service, and before using the authorization service to retrieve the first hardware fingerprint information corresponding to the user terminal to be authenticated through the first security channel and derive a first random number from the first hardware fingerprint information, the method further includes: The first hardware fingerprint information is obtained by the user terminal to be authenticated calling the physical unclonable function to calculate the first random number; Generate a third public-private key pair corresponding to the user terminal to be authenticated, and send the first hardware fingerprint information, the third public key in the third public-private key pair, and the user terminal device identification information to the authorization service through the second secure channel; When the authorization service verifies the user terminal device identification information, it generates user identification information corresponding to the user terminal to be authenticated; The user identification information, the first random number, the first hardware fingerprint information, the third public key, and the user terminal device identification information are encrypted and stored in a database using the authorization service.

6. The identity authentication method according to claim 5, characterized in that: After generating the user identification information corresponding to the to-be-authenticated user terminal, the method further includes: The authorization service is used to send a certificate issuance request to the report verification service according to the third public key and the user identification information, and the received user certificate and the user identification information are returned to the user terminal to be authenticated.

7. The identity authentication method according to claim 6, characterized in that: Retrieving first hardware fingerprint information corresponding to the to-be-authenticated user terminal and a first random number derived from the first hardware fingerprint information through a first secure channel using an authorization service includes: Utilizing the authorization service to receive the user identification information sent by the task trusted execution environment after successfully authenticating the user certificate of the to-be-authenticated user terminal; The first hardware fingerprint information and the first random number are retrieved according to the user identification information through the first secure channel using an authorization service.

8. An identity authentication device, characterized in that: include: A fingerprint and random number retrieving module, used to retrieve the first hardware fingerprint information corresponding to the to-be-authenticated user terminal and the first random number derived from the first hardware fingerprint information through the first security channel using the authorization service; A fingerprint receiving module, configured to receive, by using the authorization service through a second secure channel, second hardware fingerprint information obtained by the to-be-authenticated user terminal by calculating the first random number through a physical unclonable function; The trust relationship establishment module is used to determine that the identity authentication of the to-be-authenticated user terminal is passed when the authorization service determines that the first hardware fingerprint information is consistent with the second hardware fingerprint information, so as to establish a trust relationship between the to-be-authenticated user terminal and the task trusted execution environment.

9. An identity authentication device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the identity authentication method as claimed in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the identity authentication method according to any one of claims 1 to 7 are implemented.

Images