Identity authentication method and device, terminal equipment and storage medium

Abstract

The invention discloses an identity authentication method and device, terminal equipment and a storage medium, and the method comprises the steps: determining the certificate information of the equipment to be authenticated when the equipment to be authenticated receives a target instruction; determining a target scene according to the target instruction, determining an auxiliary authentication device according to the target scene, sending a request to the auxiliary authentication device, and generating temporary certificate information of the auxiliary authentication device; and authenticating the identity information of the equipment to be authenticated according to the self certificate information and the temporary certificate information. Therefore, in the equipment identity authentication process, the identity credential credibility of the equipment to be authenticated in the identity authentication process can be effectively improved by combining the credential message of the equipment and the temporary credential message of other equipment and combining the temporary credential information about the equipment to be authenticated in identity generated by other equipment; and the identity information security of the internet equipment in the identity authentication process is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an identity authentication method, device, terminal equipment and storage medium. Background Art

[0002] In the Internet era, device authentication technology can prevent information resources from being used without authorization, thereby ensuring the security of information resources. At present, device authentication technology mainly uses SE (Secure Element) and TEE (Trusted Execution Environment) to ensure network security when data and applications are authenticated in mobile devices and embedded systems. SE is an independent hardware component used to store sensitive information and perform encryption operations. By storing the device's private key and certificate in SE, it can ensure that these data credentials remain secure and not easily tampered with or stolen during the life cycle of the device, achieving a higher level of security isolation. TEE is an isolated area of ​​the processor that runs in parallel with the device operating system to provide a secure execution environment. By running the authentication logic inside the TEE, it can ensure that the device's authentication process is protected from malware and unauthorized access.

[0003] It can be seen that the existing device authentication technology needs to rely on SE and TEE to provide an encrypted place for the device authentication process, which increases the deployment cost of the network system. At the same time, the device authentication technology using SE and TEE only provides a secure authentication execution environment for the device, and cannot improve the credibility of the device's identity credentials during the authentication process.

[0004] Therefore, the prior art still needs to be improved and enhanced. Summary of the invention

[0005] The technical problem to be solved by the present invention is that, in view of the above-mentioned defects of the prior art, an identity authentication method, apparatus, terminal device and storage medium are provided, aiming to solve the problem that the device identity authentication technology in the prior art needs to rely on SE and TEE to provide an encryption place for the device's identity authentication process, which increases the deployment cost of the network system, and the device identity authentication technology using SE and TEE only provides a secure identity authentication execution environment for the device, but cannot improve the credibility of the device's identity credentials during the identity authentication process.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides an identity authentication method, wherein the method comprises: When the device to be authenticated receives the target instruction, determining the own credential information of the device to be authenticated; Determine a target scenario according to the target instruction, determine an auxiliary authentication device according to the target scenario, send a request to the auxiliary authentication device, and generate temporary credential information of the auxiliary authentication device; The identity information of the device to be authenticated is authenticated according to the own credential information and the temporary credential information.

[0007] In one implementation, when the device to be authenticated receives the target instruction, determining the credential information of the device to be authenticated includes: According to the target instruction, obtain the digital certificate and key of the device to be authenticated; The self-credential information of the device to be authenticated is determined according to the digital certificate and the key.

[0008] In one implementation, determining a target scenario according to the target instruction, and determining an auxiliary authentication device according to the target scenario includes: Determining level information of the target scene according to the target instruction; Determining the level requirement and quantity requirement of the auxiliary authentication device according to the level information; The auxiliary authentication device is determined according to the level requirement and the quantity requirement.

[0009] In one implementation, the sending of a request to the auxiliary authentication device to generate temporary credential information of the auxiliary authentication device includes: Based on the distributed soft bus, a request is sent to the auxiliary authentication device; According to the request, temporary credential information of the auxiliary authentication device is generated, and the temporary credential information includes identification information of the device to be authenticated.

[0010] In one implementation, the generating, according to the request, temporary credential information of the auxiliary authentication device includes: Determining, based on the request, a validity period of the temporary credential information; The temporary credential information of the auxiliary authentication device is generated according to the validity period.

[0011] In one implementation, authenticating the identity information of the device to be authenticated according to the own credential information and the temporary credential information includes: Inputting the own credential information and the temporary credential information into the distributed data management system through a preset encrypted channel; According to the distributed data management system, verify the validity of the own credential information and the temporary credential information to obtain a verification result; An identity authentication result of the device to be authenticated is determined according to the verification result.

[0012] In one implementation, determining the identity authentication result of the device to be authenticated according to the verification result includes: When the verification result is that both the own credential information and the temporary credential information are verified, it is determined that the identity authentication result is that the identity information of the device to be authenticated is correct; When the verification result is that at least one of the own credential information and the temporary credential information fails to be verified, it is determined that the identity authentication result is that the identity information of the device to be authenticated is incorrect.

[0013] In a second aspect, an embodiment of the present invention further provides an identity authentication device, wherein the device comprises: A self-credential information determination module, used to determine the self-credential information of the device to be authenticated when the device to be authenticated receives the target instruction; a temporary credential information determination module, configured to determine a target scenario according to the target instruction, determine an auxiliary authentication device according to the target scenario, send a request to the auxiliary authentication device, and generate temporary credential information of the auxiliary authentication device; The identity information authentication module is used to authenticate the identity information of the device to be authenticated according to the own credential information and the temporary credential information.

[0014] In a third aspect, an embodiment of the present invention further provides a terminal device, wherein the terminal device comprises a memory, a processor, and an identity authentication program stored in the memory and executable on the processor, and when the processor executes the identity authentication program, the steps of the identity authentication method of any one of the above-mentioned schemes are implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein an identity authentication program is stored on the computer-readable storage medium, and when the identity authentication program is executed by a processor, the steps of the identity authentication method described in any one of the above schemes are implemented.

[0016] Beneficial effects: Compared with the prior art, the present invention provides an identity authentication method, apparatus, terminal device and storage medium, the method comprising: when the identity authentication device receives a target instruction, determining the self-credential information of the identity authentication device; determining the target scene according to the target instruction, determining the auxiliary authentication device according to the target scene, sending a request to the auxiliary authentication device, generating temporary credential information of the auxiliary authentication device; authenticating the identity information of the identity authentication device according to the self-credential information and the temporary credential information. Therefore, the device identity authentication process of the present invention needs to combine the device's own credential message and the temporary credential message of other devices. By combining the temporary credential information about the identity authentication device generated by other devices, the credibility of the identity credentials of the identity authentication device in the identity authentication process can be effectively improved, and the identity information security of Internet devices in the identity authentication process can be enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a specific implementation of the identity authentication method provided by an embodiment of the present invention.

[0018] Figure 2 This is a functional schematic diagram of an identity authentication device provided by an embodiment of the present invention.

[0019] Figure 3 A functional block diagram of a terminal device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples.

[0021] Those skilled in the art will appreciate that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Unless specifically stated, the singular forms "one", "said", and "the" used herein may also include plural forms, and the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or their groups. It should be understood that when an element is "connected" or "coupled" to another element, it may be directly connected or coupled to other elements, or there may also be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0022] The present embodiment provides an identity authentication method, apparatus, terminal device and storage medium. In specific implementation, the present embodiment first determines the self-credential information of the identity-to-be-authenticated device when the identity-to-be-authenticated device receives a target instruction. Then, the target scenario is determined according to the target instruction, the auxiliary authentication device is determined according to the target scenario, a request is sent to the auxiliary authentication device, and temporary credential information of the auxiliary authentication device is generated. Finally, the identity information of the identity-to-be-authenticated device is authenticated according to the self-credential information and the temporary credential information. Therefore, the device identity authentication process of the present embodiment needs to combine the device's own credential message and the temporary credential message of other devices. By combining the temporary credential information about the identity-to-be-authenticated device generated by other devices, the credibility of the identity credentials of the identity-to-be-authenticated device in the identity authentication process can be effectively improved, and the identity information security of Internet devices in the identity authentication process can be enhanced.

[0023] The identity authentication method of this embodiment can be applied to a terminal device, which can be a preset mobile terminal device such as a mobile phone, a tablet, a computer, or an intelligent device such as a smart TV. In this embodiment, the terminal device can be an external device connected to the identity authentication device, or a device built into the identity authentication device. Further, the device in this embodiment can refer to a device installed in the open source Hongmeng system (OpenHarmony OS), or a device in the standard system of the Kaihong system (KaihongOS). OpenHarmony OS supports the interconnection and interoperability of a variety of terminal devices, covering a variety of intelligent devices from consumer electronics to industrial control, which may include but are not limited to: smart wearable devices, such as smart watches, health monitoring bracelets; smart home products, such as smart speakers, smart TVs, smart lighting systems, security monitoring; mobile terminals, such as smart phones, tablets; Internet of Things devices, such as smart sensors, smart door locks, environmental monitoring equipment; education and office equipment, such as electronic whiteboards, conference systems; vehicle-mounted equipment, such as vehicle-mounted entertainment information systems, smart rearview mirrors.

[0024] like Figure 1 As shown in , the identity authentication method of this embodiment includes the following steps: Step S100: When the device to be authenticated receives the target instruction, the device to be authenticated determines its own credential information.

[0025] Generally, multiple terminal devices in an automation system based on the Internet of Things (IoT) are interconnected. When these terminal devices are connected to an IoT system, they will match and register their own credential information with the system gateway in advance. Then, when these terminal devices send requests to other devices in the IoT system, the gateway will send a target instruction back to the terminal device, through which the relevant credential information of the terminal device can be retrieved. Then, the retrieved credential information is compared and verified with the device's own credential information stored in the gateway when the device was registered. Finally, based on the verification results, it can be determined whether the identity information of the current terminal device is correct.

[0026] That is to say, when the identity-to-be-authenticated device of this embodiment receives the target instruction, its own credential information can be preferentially determined through the registration information of the identity-to-be-authenticated device when joining the Internet of Things system, so that the identity information of the identity-to-be-authenticated device can be verified based on its own credential information in the subsequent process.

[0027] Specifically, the identity authentication method implemented in this embodiment can be carried out in an Internet of Things system platform based on OpenHarmony. The Internet of Things system platform based on OpenHarmony mainly includes a distributed soft bus, a distributed data management module, a distributed task scheduling module and a device virtualization module. Among them, the distributed soft bus is a unified base for multiple device terminals, which provides a unified distributed communication capability for seamless interconnection between devices. It can quickly discover and connect devices, efficiently transmit tasks and data, and has a built-in security mechanism to ensure the security of data transmission and avoid information leakage during interaction between multiple devices. The distributed data management module is based on a distributed soft bus and realizes the distributed management of application data and user data, so that user data is no longer bound to a single physical device, its business logic is separated from data storage, and the data is seamlessly connected when the application runs across devices, creating the basic conditions for creating a consistent and smooth user experience. The distributed task scheduling module builds a unified distributed service management / discovery / synchronization / registration / calling mechanism based on the technical features of distributed soft bus, distributed data management, distributed storage, etc. It supports remote startup, remote calling, binding, unbinding and migration of cross-device applications, and can select the most suitable device to run distributed tasks based on the capabilities, location, business operation status, resource usage of different devices and user habits and intentions. The device virtualization module can realize resource integration, device management, and data processing of different devices, and use peripheral devices as an extension of mobile phone capabilities to form a super virtual terminal.

[0028] In one implementation, step S100 of this embodiment specifically includes the following steps: Step S101: According to the target instruction, obtain the digital certificate and key of the device to be authenticated; Step S102: Determine the self-credential information of the device to be authenticated according to the digital certificate and the key.

[0029] In specific implementation, before the device to be authenticated receives the target instruction, this embodiment also includes: registering each device added to the Internet of Things system, so that each device added to the Internet of Things system will have a unique device identification, and managing their respective keys through a distributed key management system to provide a basis for identity authentication, and then interconnecting all devices in the Internet of Things system based on a distributed soft bus. Among them, the device identification can be the digital certificate and key of the device, and the digital certificate contains data information such as the public key of the device, the private key signature issued by the CA (Certificate Authority) and the identity information of the device.

[0030] Then, when the identity-to-be-authenticated device sends a request to other devices in the IoT system, it will receive a target instruction sent by other devices and returned to the identity-to-be-authenticated device. According to the target instruction, the digital certificate and key of the identity-to-be-authenticated device can be obtained in the distributed key management system, and finally these digital certificates and keys used to verify the identity of the identity-to-be-authenticated device itself are used as the self-credential information of the identity-to-be-authenticated device. Preferably, the self-credential information in this embodiment includes but is not limited to digital certificates, keys and tokens, which are not specifically limited in this embodiment.

[0031] Step S200: determining a target scenario according to the target instruction, determining an auxiliary authentication device according to the target scenario, sending a request to the auxiliary authentication device, and generating temporary credential information of the auxiliary authentication device.

[0032] Since the target instruction is generated based on the request sent by the identity authentication device to other devices, the target instruction can reflect the scenario involved in the request sent by the identity authentication device to other devices. Then, according to the scenario involved in the request, the appropriate auxiliary authentication device is selected, which can improve the reference value of the temporary credential information of the auxiliary authentication device generated in the subsequent process.

[0033] In one implementation, when determining a target scenario according to the target instruction and determining an auxiliary authentication device according to the target scenario, this embodiment includes the following steps: Step S201, determining the level information of the target scene according to the target instruction; Step S202: Determine the level requirement and quantity requirement of the auxiliary authentication device according to the level information; Step S203: Determine the auxiliary authentication device according to the level requirement and the quantity requirement.

[0034] Specifically, the target instruction can reflect the level information of the target scene involved in the request sent by the identity authentication device to other devices, and different level information can be used to reflect different scene security requirements. For example, when the target scene is the startup scene of a smart home device, the level information is the second level; when the target scene is the startup scene of a smart door lock device, the level information is the first level, where the first level scene security requirement is higher than the second level scene security requirement.

[0035] Furthermore, this embodiment can obtain the level requirements and quantity requirements corresponding to different level information based on a reference table of level requirements and quantity requirements corresponding to preset level information, wherein the reference table can be customized according to current needs, for example, in the first level, the level requirement of the auxiliary authentication device is set to level one, and the quantity requirement is three; in the second level, the level requirement of the auxiliary authentication device is set to level two, and the quantity requirement is two.

[0036] Next, in the first level, the auxiliary authentication device can select any required number (for example, three) of devices from the first-level devices in the IoT system, such as smart face recognition devices, smart cameras, smart doors, smart locks, smart switches, etc., and use them as auxiliary authentication devices for the startup scene of the first-level smart door lock device. In the second level, the auxiliary authentication device can select any required number (for example, two) of devices from the second-level devices in the IoT system, such as smart fans, smart air conditioners, smart refrigerators, smart chairs, etc., and use them as auxiliary authentication devices for the startup scene of the second-level smart home devices.

[0037] In one implementation, when this embodiment sends a request to the auxiliary authentication device to generate temporary credential information of the auxiliary authentication device, it includes the following steps: Step S204: Based on the distributed soft bus, a request is sent to the auxiliary authentication device; Step S205: Generate temporary credential information of the auxiliary authentication device according to the request, wherein the temporary credential information includes identification information of the device to be authenticated.

[0038] Since the identity authentication device, auxiliary authentication device and other devices in the Internet of Things system of this embodiment are connected and interoperable based on a distributed soft bus, this embodiment can send a request to the auxiliary authentication device based on the distributed soft bus after determining the auxiliary authentication device. Then, the auxiliary authentication device can generate temporary credential information that reflects and contains the identification information of the identity authentication device based on the request information sent by the identity authentication device.

[0039] Preferably, the temporary credential information in this embodiment includes, but is not limited to, the digital certificate of the device to be authenticated, the key of the device to be authenticated, the session key between the auxiliary authentication device and the device to be authenticated, the encryption certificate, the token or other forms of temporary credential information, which are not specifically limited in this embodiment. At the same time, the process of generating the temporary credential information of the auxiliary authentication device in this embodiment also includes: the auxiliary authentication device and the device to be authenticated each send the digital certificates of both parties to the gateway for verification, thereby ensuring that the device identities of the auxiliary authentication device and the device to be authenticated are legitimate.

[0040] In one implementation, step S205 of this embodiment specifically includes the following steps: Step S2051: Determine the validity period of the temporary credential information according to the request; Step S2052: Generate the temporary credential information of the auxiliary authentication device according to the validity period.

[0041] In the specific implementation process, the temporary credential information generated by the auxiliary authentication device of this embodiment can also set the validity period, where the validity period includes the valid time range and the valid times. That is to say, in the process of the auxiliary authentication device generating temporary credential information, a special instruction containing a time limit is input according to the request to determine the validity period of the temporary credential information, and also ensure that the temporary credential information is only valid in a specific situation, thereby ensuring the timeliness of the temporary credential information.

[0042] Among them, special instructions with time limits can be set according to scenario requirements. For example, in the startup scenario of the smart door lock device, the valid number of times is set to once, so that the temporary credential information of the auxiliary authentication device selected in this scenario can only be used once. In other words, in the next startup scenario of the smart door lock device, a new auxiliary authentication device must be selected or new temporary credential information must be generated, thereby improving the credibility of the identity credentials in the identity authentication process and enhancing the identity information security of Internet devices.

[0043] Optionally, the specific operation process of generating temporary credential information of the auxiliary authentication device in this embodiment can be: using the key exchange algorithm (such as ECDH algorithm) in the Transport Layer Security (TLS) protocol to assist the auxiliary authentication device and the identity authentication device to negotiate a session key shared by both parties, and the session key is limited to the communication encryption authentication process of the current session. Among them, the ECDH (Elliptic Curve Diffie-Hellman) algorithm is a key agreement method based on elliptic curve cryptography, which can provide an efficient and secure key exchange environment.

[0044] Step S300: authenticating the identity information of the device to be authenticated according to the own credential information and the temporary credential information.

[0045] In one implementation, step S300 of this embodiment specifically includes the following steps: Step S301: input the own credential information and the temporary credential information into the distributed data management system through a preset encrypted channel; Step S302: Verify the validity of the own credential information and the temporary credential information according to the distributed data management system to obtain a verification result; Step S303: Determine the identity authentication result of the device to be authenticated according to the verification result.

[0046] Specifically, in this embodiment, after obtaining the digital certificate and key of the device to be authenticated according to the target instruction, the self-credential information has been input into the distributed data management system through the preset encryption channel. Further, after the temporary credential information generated by the auxiliary authentication device is determined in this embodiment, the temporary credential information will also be input into the distributed data management system through the preset encryption channel. Optionally, the preset encryption channel (or encryption protocol) in this embodiment includes but is not limited to: SSL / TLS (Secure Sockets Layer / TransportLayer Security), IPSec (Internet Protocol Security), SSH (Secure Shell), HTTPSwith Client Certificates, MQTT with TLS and RabbitMQ with AMQP and TLS. In the specific application scenario, system architecture and security requirements, the actual personnel can select the appropriate encryption algorithm, key management and certificate verification mechanism as needed to achieve the best data encryption transmission effect.

[0047] Furthermore, in the distributed data management system, the present embodiment verifies the validity of the self-credential information and the temporary credential information, and obtains the verification result. Specifically, the steps of verifying the validity of the self-credential information and the temporary credential information in the present embodiment include: first, verifying the authenticity of the self-credential information of the device to be authenticated. Then, respectively verifying the authenticity and validity of the temporary credential information provided by the auxiliary authentication device. Finally, based on the verification result, further determining the identity authentication result of the device to be authenticated.

[0048] In one implementation, step S303 of this embodiment specifically includes the following steps: Step S3031: When the verification result is that both the own credential information and the temporary credential information are verified, it is determined that the identity authentication result is that the identity information of the device to be authenticated is correct; Step S3032: When the verification result is that at least one of the own credential information and the temporary credential information fails to be verified, it is determined that the identity authentication result is that the identity information of the device to be authenticated is incorrect.

[0049] That is to say, on the one hand, when the verification result of this embodiment is that both the own credential information and the temporary credential information are verified, then the identity authentication result is determined to be that the identity information of the device to be authenticated is correct, that is, the identity authentication of the device to be authenticated is passed. On the other hand, when the verification result of this embodiment is that at least one of the own credential information and the temporary credential information is not verified, then the identity authentication result is determined to be that the identity information of the device to be authenticated is wrong, that is, the identity authentication of the device to be authenticated is not passed. Among them, the verification result of this embodiment is that at least one of the own credential information and the temporary credential information is not verified, including: the case where the own credential information is verified and the temporary credential information is not verified, and also includes: the case where the own credential information is not verified and the temporary credential information is verified, and also includes: the case where both the own credential information and the temporary credential information are not verified.

[0050] In summary, this embodiment provides an identity authentication method. When it is specifically implemented, this embodiment first determines the self-credential information of the identity-to-be-authenticated device when the identity-to-be-authenticated device receives the target instruction. Then, the target scene is determined according to the target instruction, the auxiliary authentication device is determined according to the target scene, a request is sent to the auxiliary authentication device, and temporary credential information of the auxiliary authentication device is generated. Finally, the identity information of the identity-to-be-authenticated device is authenticated according to the self-credential information and the temporary credential information. Therefore, the device identity authentication process of this embodiment needs to combine the device's own credential message and the temporary credential message of other devices. By combining the temporary credential information about the identity-to-be-authenticated device generated by other devices, the credibility of the identity credentials of the identity-to-be-authenticated device in the identity authentication process can be effectively improved, and the identity information security of Internet devices in the identity authentication process can be enhanced.

[0051] Based on the above embodiments, the present invention also provides an identity authentication device, such as Figure 2 As shown in , the identity authentication device includes: a self-credential information determination module 10, a temporary credential information determination module 20 and an identity information authentication module 30. Specifically, the self-credential information determination module 10 is used to determine the self-credential information of the identity to be authenticated device when the identity to be authenticated device receives a target instruction. The temporary credential information determination module 20 is used to determine the target scene according to the target instruction, determine the auxiliary authentication device according to the target scene, send a request to the auxiliary authentication device, and generate temporary credential information of the auxiliary authentication device. The identity information authentication module 30 is used to authenticate the identity information of the identity to be authenticated device based on the self-credential information and the temporary credential information.

[0052] In one implementation, the self-credential information determination module 10 includes: A digital certificate and key acquisition unit, used to acquire the digital certificate and key of the device to be authenticated according to the target instruction; The self-credential information determining unit is used to determine the self-credential information of the device to be authenticated according to the digital certificate and the key.

[0053] In one implementation, the temporary credential information determining module 20 includes: A level information determining unit, configured to determine the level information of the target scene according to the target instruction; a level requirement and quantity requirement determining unit, configured to determine the level requirement and quantity requirement of the auxiliary authentication device according to the level information; The auxiliary authentication device determining unit is used to determine the auxiliary authentication device according to the level requirement and the quantity requirement.

[0054] A request sending unit, configured to send a request to the auxiliary authentication device based on a distributed soft bus; A temporary credential information generating unit is used to generate temporary credential information of the auxiliary authentication device according to the request, wherein the temporary credential information includes identification information of the device to be authenticated.

[0055] In one implementation, the temporary credential information generating unit includes: A validity period determination subunit, configured to determine a validity period of the temporary credential information according to the request; The temporary credential information determination subunit is used to generate the temporary credential information of the auxiliary authentication device according to the validity period.

[0056] In one implementation, the identity information authentication module 30 includes: A credential information transmission unit, used to input the own credential information and the temporary credential information into the distributed data management system through a preset encrypted channel; A credential information verification unit, used to verify the validity of the own credential information and the temporary credential information according to the distributed data management system, and obtain a verification result; The identity authentication result determining unit is used to determine the identity authentication result of the device to be authenticated according to the verification result.

[0057] In one implementation, the identity authentication result determination unit includes: An identity information authentication subunit, configured to determine that the identity authentication result is that the identity information of the device to be authenticated is correct when the authentication result is that both the own credential information and the temporary credential information are authenticated; The identity information authentication failure subunit is used to determine that the identity authentication result is that the identity information of the device to be authenticated is wrong when the authentication result is that at least one of the own credential information and the temporary credential information fails to be authenticated.

[0058] The working principles of each module in the identity authentication device of this embodiment are the same as the principles of each step in the above method embodiment, and will not be repeated here.

[0059] Based on the above embodiments, the present invention further provides a terminal device, the principle block diagram of the terminal device can be as follows: Figure 3 The terminal device may include one or more processors 100 ( Figure 3Only one is shown in the figure), a memory 101 and a computer program 102 stored in the memory 101 and executable on one or more processors 100, for example, an identity authentication program. When one or more processors 100 execute the computer program 102, the various steps in the embodiment of the identity authentication method can be implemented. Alternatively, when one or more processors 100 execute the computer program 102, the functions of the various modules / units in the embodiment of the identity authentication device can be implemented, which is not limited here.

[0060] In one embodiment, the processor 100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0061] In one embodiment, the memory 101 may be an internal storage unit of an electronic device, such as a hard disk or memory of the electronic device. The memory 101 may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device. Further, the memory 101 may also include both an internal storage unit of the electronic device and an external storage device. The memory 101 is used to store computer programs and other programs and data required by the terminal device. The memory 101 may also be used to temporarily store data that has been output or is to be output.

[0062] Those skilled in the art will understand that Figure 3 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the terminal device to which the scheme of the present invention is applied. The specific terminal device may include more or less components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0063] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, operating database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double operational data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0064] In summary, the present invention discloses an identity authentication method, apparatus, terminal device and storage medium, the method comprising: when the identity authentication device receives a target instruction, determining the self-credential information of the identity authentication device; determining the target scene according to the target instruction, determining the auxiliary authentication device according to the target scene, sending a request to the auxiliary authentication device, generating temporary credential information of the auxiliary authentication device; authenticating the identity information of the identity authentication device according to the self-credential information and the temporary credential information. Therefore, the device identity authentication process of the present invention needs to combine the device's own credential message and the temporary credential message of other devices. By combining the temporary credential information about the identity authentication device generated by other devices, the credibility of the identity credential of the identity authentication device in the identity authentication process can be effectively improved, and the identity information security of Internet devices in the identity authentication process can be enhanced.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An identity authentication method, characterized in that: The method comprises: When the device to be authenticated receives the target instruction, determining the own credential information of the device to be authenticated; Determine a target scenario according to the target instruction, determine an auxiliary authentication device according to the target scenario, send a request to the auxiliary authentication device, and generate temporary credential information of the auxiliary authentication device; The identity information of the device to be authenticated is authenticated according to the own credential information and the temporary credential information.

2. The identity authentication method according to claim 1, characterized in that: When the identity-to-be-authenticated device receives the target instruction, determining the own credential information of the identity-to-be-authenticated device includes: According to the target instruction, obtain the digital certificate and key of the device to be authenticated; The self-credential information of the device to be authenticated is determined according to the digital certificate and the key.

3. The identity authentication method according to claim 1, characterized in that: The step of determining a target scene according to the target instruction and determining an auxiliary authentication device according to the target scene includes: Determining level information of the target scene according to the target instruction; Determining the level requirement and quantity requirement of the auxiliary authentication device according to the level information; The auxiliary authentication device is determined according to the level requirement and the quantity requirement.

4. The identity authentication method according to claim 3, characterized in that: The sending of a request to the auxiliary authentication device to generate temporary credential information of the auxiliary authentication device includes: Based on the distributed soft bus, a request is sent to the auxiliary authentication device; According to the request, temporary credential information of the auxiliary authentication device is generated, and the temporary credential information includes identification information of the device to be authenticated.

5. The identity authentication method according to claim 4, characterized in that: The generating, according to the request, temporary credential information of the auxiliary authentication device comprises: Determining, based on the request, a validity period of the temporary credential information; The temporary credential information of the auxiliary authentication device is generated according to the validity period.

6. The identity authentication method according to claim 2 or 5, characterized in that: The authenticating the identity information of the device to be authenticated according to the own credential information and the temporary credential information includes: Inputting the own credential information and the temporary credential information into the distributed data management system through a preset encrypted channel; According to the distributed data management system, verify the validity of the own credential information and the temporary credential information to obtain a verification result; An identity authentication result of the device to be authenticated is determined according to the verification result.

7. The identity authentication method according to claim 6, characterized in that: The step of determining the identity authentication result of the device to be authenticated according to the verification result includes: When the verification result is that both the own credential information and the temporary credential information are verified, it is determined that the identity authentication result is that the identity information of the device to be authenticated is correct; When the verification result is that at least one of the own credential information and the temporary credential information fails to be verified, it is determined that the identity authentication result is that the identity information of the device to be authenticated is incorrect.

8. An identity authentication device, characterized in that: The device comprises: A self-credential information determination module, used to determine the self-credential information of the device to be authenticated when the device to be authenticated receives the target instruction; a temporary credential information determination module, configured to determine a target scenario according to the target instruction, determine an auxiliary authentication device according to the target scenario, send a request to the auxiliary authentication device, and generate temporary credential information of the auxiliary authentication device; The identity information authentication module is used to authenticate the identity information of the device to be authenticated according to the own credential information and the temporary credential information.

9. A terminal device, characterized in that: The terminal device includes a memory, a processor, and an identity authentication program stored in the memory and executable on the processor. When the processor executes the identity authentication program, the steps of the identity authentication method as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an identity authentication program, and when the identity authentication program is executed by the processor, the steps of the identity authentication method according to any one of claims 1 to 7 are implemented.

Images