Identity authentication method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an identity authentication method and device, equipment and a medium. The method comprises the steps that according to input authority information, a first signature key and feedback information are obtained from a server side, the first signature key is generated by the server side according to environment information of a second client side, according to user information obtained in real time, a second signature key is determined, and according to the feedback information, the first signature key and the second signature key, the feedback information is sent to the server side; according to the method, aggregation signature information is determined, and an identity authentication result is acquired from a server according to the aggregation signature information, so that keys of parts related to the environment are safely synchronized on different clients by introducing authority control of synchronizing a first signature key, and the risk of key leakage caused by transmission or storage of a complete signature key is avoided; even if a part of synchronized secret keys are leaked, if the user information is incorrect, identity authentication cannot be completed, the requirement that the user can perform identity authentication on different clients is met, and meanwhile the safety and reliability of identity authentication are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an identity authentication method, an identity authentication device, an electronic device and a computer-readable storage medium. Background Art

[0002] The VisionLink Palm APP (application) can make real-time audio and video calls with the VisionLink network through 4G (fourth-generation mobile communication technology) or WIFI (wireless network), and can view national monitoring data on the mobile terminal. It enables grid workers and other personnel to report an alarm at any time with one click and link the callback function with the GIS (Geographic Information System) platform. The map trajectory can be viewed on the APP terminal, and functions such as receiving alarms, transferring alarms, reporting and calling back can all be realized on the mobile APP, achieving flexible application of mobile alarms.

[0003] With the rapid development of visual networking services, there is an increasing demand for using the mobile app to participate in visual networking conferences, monitoring and other services. Currently, users of the app need to authenticate their identities to participate in conference services. Since the signature private key representing the identity is bound to the device information on the mobile terminal and the app information on the app, once the login device is changed and the login environment changes, the same user will not be able to log in normally. However, in some special cases, users need to log in on another mobile device to participate in visual networking services, so this problem needs to be solved urgently. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide an identity authentication method, a corresponding identity authentication device, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses an identity authentication method, which is applied to a first client, and the method includes:

[0006] During the identity authentication process, a first signing key and feedback information are obtained from the server according to the input permission information; wherein the first signing key is generated by the server according to the environment information of the second client;

[0007] Determine the second signing key according to the user information obtained in real time;

[0008] Determine aggregate signature information according to the feedback information, the first signature key and the second signature key;

[0009] According to the aggregate signature information, an identity authentication result is obtained from the server.

[0010] Optionally, obtaining the first signing key and feedback information from the server according to the input permission information includes:

[0011] Sending the input permission information to the server for the server to verify the permission information;

[0012] Receive the first signature key and feedback information returned by the server after the verification is successful.

[0013] Optionally, the receiving the first signing key and feedback information returned by the server after the verification is successful includes:

[0014] Receiving the first signature key ciphertext and feedback information returned by the server after verification;

[0015] The first signing key ciphertext is decrypted using the permission information to obtain the first signing key.

[0016] Optionally, determining the second signing key according to the user information acquired in real time includes:

[0017] Requesting a key pair from the server according to the user information obtained in real time;

[0018] Receive the second signing key returned by the server.

[0019] Optionally, determining the aggregate signature information according to the feedback information, the first signature key, and the second signature key includes:

[0020] Using the first signature key and the second signature key respectively, the feedback information is signed to obtain corresponding signature information;

[0021] The aggregated signature information is aggregated according to each signature information.

[0022] Optionally, before obtaining the first signing key and feedback information from the server according to the input permission information, the method further includes:

[0023] Sending an identity authentication request to the server according to the user identity authentication information and the device information of the device where the first client is located;

[0024] The server receives a permission information verification request sent by the server when the identity authentication is passed and it is determined that the device information of the device where the first client and the second client are located are inconsistent.

[0025] The embodiment of the present invention also discloses an identity authentication method, which is applied to a server, and the method includes:

[0026] During the identity authentication process, according to the permission information sent by the first client, the first signing key and feedback information are sent to the first client; wherein the first signing key is generated by the server according to the environment information of the second client;

[0027] receiving aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client according to a second signature key, the feedback information, and the first signature key, and the second signature key is determined by the first client according to user information acquired in real time;

[0028] The aggregate signature information is verified, and an identity authentication result is sent to the client.

[0029] Optionally, before sending the first signing key and feedback information to the first client according to the permission information sent by the first client, the method further includes:

[0030] In response to the key pair request sent by the second client, generating a first key pair according to the environment information carried in the key pair request, and generating a second key pair according to the user information carried in the key pair request; wherein the first key pair includes a first signing key, and the second key pair includes a second signing key;

[0031] An aggregated signature verification key is aggregated according to the first key pair and the second key pair, and stored.

[0032] Optionally, the verifying the aggregate signature information includes:

[0033] The aggregate signature information is verified using the aggregate signature verification key.

[0034] Optionally, the method further comprises:

[0035] The first signing key is encrypted using the permission information to obtain a first signing key ciphertext, and the ciphertext is stored.

[0036] Optionally, the method further comprises:

[0037] According to the registration request sent by the second client, user identity authentication information and authority information are recorded.

[0038] The embodiment of the present invention further discloses an identity authentication device, which is applied to a first client, and the device includes:

[0039] An information acquisition module, used to acquire a first signature key and feedback information from a server according to input permission information during identity authentication; wherein the first signature key is generated by the server according to the environment information of the second client;

[0040] A key determination module, used to determine a second signature key according to user information acquired in real time;

[0041] an information determination module, configured to determine aggregate signature information according to the feedback information, the first signature key, and the second signature key;

[0042] The result acquisition module is used to obtain the identity authentication result from the server according to the aggregate signature information.

[0043] Optionally, the information acquisition module includes:

[0044] An information sending submodule, used for sending the input permission information to the server, so that the server can verify the permission information;

[0045] The information receiving submodule is used to receive the first signature key and feedback information returned by the server after the verification is successful.

[0046] Optionally, the information receiving submodule includes:

[0047] An information receiving unit, used to receive the first signature key ciphertext and feedback information returned by the server after the verification is successful;

[0048] A decryption unit is used to decrypt the first signing key ciphertext using the permission information to obtain the first signing key.

[0049] Optionally, the key determination module includes:

[0050] A key pair request submodule, used to request a key pair from the server according to the user information obtained in real time;

[0051] The key receiving submodule is used to receive the second signing key returned by the server.

[0052] Optionally, the information determination module includes:

[0053] A signing submodule, used to sign the feedback information using the first signing key and the second signing key respectively to obtain corresponding signature information;

[0054] The aggregation submodule is used to aggregate the signature information into the aggregate signature information.

[0055] Optionally, the device further comprises:

[0056] a request sending module, configured to send an identity authentication request to the server according to user identity authentication information and device information of the device where the first client is located, before obtaining the first signing key and feedback information from the server according to the input permission information;

[0057] The request receiving module is used to receive the permission information verification request sent by the server when the identity authentication is passed and it is determined that the device information of the device where the first client and the second client are located are inconsistent.

[0058] The embodiment of the present invention further discloses an identity authentication device, which is applied to a server, and the device comprises:

[0059] An information sending module, used to send a first signature key and feedback information to the first client according to the permission information sent by the first client during the identity authentication process; wherein the first signature key is generated by the server according to the environment information of the second client;

[0060] an information receiving module, configured to receive aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client according to a second signature key, the feedback information, and the first signature key, and the second signature key is determined by the first client according to user information acquired in real time;

[0061] The verification module is used to verify the aggregate signature information and send the identity authentication result to the client.

[0062] Optionally, the device further comprises:

[0063] a key pair generation module, configured to generate a first key pair in response to a key pair request sent by the second client according to the environment information carried in the key pair request, and generate a second key pair according to the user information carried in the key pair request, before sending the first signing key and feedback information to the first client according to the permission information sent by the first client; wherein the first key pair includes a first signing key, and the second key pair includes a second signing key;

[0064] The aggregation module is used to aggregate the first key pair and the second key pair into an aggregated signature verification key and store the aggregated signature verification key.

[0065] Optionally, the verification module includes:

[0066] The verification submodule is used to verify the aggregate signature information using the aggregate signature verification key.

[0067] Optionally, the device further comprises:

[0068] The encryption module is used to encrypt the first signature key using the permission information to obtain the first signature key ciphertext and store it.

[0069] Optionally, the device further comprises:

[0070] The information recording module is used to record user identity authentication information and authority information according to the registration request sent by the second client.

[0071] The embodiment of the present invention further discloses an electronic device, including:

[0072] one or more processors; and

[0073] One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the apparatus to perform any of the methods described above.

[0074] An embodiment of the present invention further discloses a computer-readable storage medium, wherein a computer program stored in the storage medium enables a processor to execute any of the methods described above.

[0075] According to an embodiment of the present invention, during the identity authentication process, a first signature key and feedback information are obtained from a server according to input permission information, wherein the first signature key is generated by the server according to environmental information of a second client, a second signature key is determined according to user information acquired in real time, aggregate signature information is determined according to the feedback information, the first signature key and the second signature key, and an identity authentication result is obtained from the server according to the aggregate signature information, so that by introducing permission control for synchronizing the first signature key, keys of parts related to the environment are securely synchronized on different clients, avoiding transmission or storage of complete signature keys, which brings risks of key leakage; even if part of the synchronized keys are leaked, if the user information is incorrect, identity authentication cannot be completed, thereby realizing the need for users to authenticate on different clients, while ensuring the security and reliability of identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 It is a schematic diagram of the principle of the aggregate signature algorithm on different devices;

[0077] Figure 2 is a flowchart of steps of an identity authentication method embodiment of the present invention;

[0078] Figure 3 is a flowchart of steps of an identity authentication method embodiment of the present invention;

[0079] Figure 4 It is a schematic diagram of the authentication process between the client and the server;

[0080] Figure 5 It is a structural block diagram of an embodiment of an identity authentication device of the present invention;

[0081] Figure 6 It is a structural block diagram of an embodiment of an identity authentication device of the present invention;

[0082] Figure 7 The present invention is a structural block diagram of an electronic device for identity authentication according to an exemplary embodiment. DETAILED DESCRIPTION

[0083] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0084] The first client and the second client refer to clients deployed on different devices. For example, the Palmtong APP deployed on mobile phone A is the first client, and the Palmtong APP deployed on mobile phone B is the second client.

[0085] After the second client sends an identity authentication request to the server, the server authenticates the information carried in the identity authentication request (such as user information such as user name and user PIN (Personal Identification Number) code), and after the authentication is passed, the server sends feedback information to the second client. The feedback information can be a random number generated by the server, or any other applicable information, which is not limited in the embodiment of the present invention.

[0086] For example, when the second client participates in a service, it needs to first perform identity authentication. The service includes video calling, video conferencing, monitoring, etc., or any other applicable service, which is not limited in the embodiment of the present invention.

[0087] The server sends multiple keys for signing to the second client in advance, which are recorded as signing keys. The second client can safely store the multiple signing keys. Usually, the signing key can be the private key in the public-private key pair, and the signature verification key can be the public key in the public-private key pair.

[0088] Before participating in the service, the second client needs to generate multiple signature keys and corresponding signature verification keys based on the environment information and user information.

[0089] The environment information includes device information, client information, etc. The device information refers to the relevant information of the device where the second client is located, such as MAC (Media Access Control Address), hardware unique code, etc. Any applicable information can be used, and the embodiment of the present invention does not limit this.

[0090] The client information refers to relevant information of the second client, for example, information such as an authorization code issued by the server to the second client. Any applicable information may be used, and the embodiment of the present invention does not limit this.

[0091] User information refers to user-related information, such as user name, user password, etc. Any applicable information may be used, and the embodiment of the present invention does not limit this.

[0092] The second client can directly use the environment information and user information as multiple signature verification keys, and then send a signature key request to the server. The signature key request carries multiple signature verification keys, and the server responds to the signature key request and generates corresponding multiple signature keys based on the multiple signature verification keys.

[0093] The second client may also send a key pair request to the server, which carries environment information and user information. The server responds to multiple key pair requests and generates multiple signature keys and corresponding signature verification keys according to the environment information and user information.

[0094] One or more signature keys generated according to the environment information of the second client are recorded as first signature keys.

[0095] In one implementation, the string corresponding to the device information is used as a signature verification key. The string corresponding to the client information is used as another signature verification key. According to the two signature verification keys corresponding to the device information and the client information, two corresponding signature keys are generated as the first signature key. The string corresponding to the user information is used as a signature verification key. According to the signature verification key corresponding to the user information, a corresponding signature key is generated as the second signature key.

[0096] In another implementation, the string corresponding to the device information and the string corresponding to the client information are concatenated as a signature verification key. Based on the signature verification key corresponding to the device information and the client information, a corresponding signature key is generated as the first signature key. The string corresponding to the user information is used as a signature verification key. Based on the signature verification key corresponding to the user information, a corresponding signature key is generated as the second signature key.

[0097] For example, KGC (Key Generation Center) can use encryption algorithms such as SM9 algorithm to calculate the signature keys corresponding to multiple signature verification keys. The second client collects device information, client information, and user information, and then calls the server interface. The server obtains the key pair through KGC (Key Generation Center), including the signature verification key and the corresponding signature key, and then sends it to the second client.

[0098] Combining user identity authentication with device information, client information, and user information ensures the authenticity of user identity in multiple dimensions and improves the security of identity authentication.

[0099] The second client uses multiple signature keys to sign the feedback information to obtain an aggregate signature information. Figure 1 The schematic diagram of the principle of the aggregate signature algorithm on different devices shown in the figure, the second client (Zhangshangtong APP on mobile device A) collects device information and client information (Zhangshangtong APP information), user information, and obtains the corresponding signature key fragment 1 (i.e., the first signature key) and signature key fragment 2 (i.e., the second signature key). The second client then uses signature key fragment 1 to sign the random number returned by the server (Zhangshangtong APP server) to obtain signature value fragment 1, and the second client uses signature key fragment 2 to sign the random number returned by the server (Zhangshangtong APP server) to obtain signature value fragment 2, and then generates complete signature information, i.e., aggregate signature information, through the aggregate signature algorithm.

[0100] Among them, aggregate signature is an efficient digital signature scheme that allows multiple signatures to be merged into a single signature, thereby reducing verification costs and increasing transaction processing speed.

[0101] In one implementation, during the identity authentication process, the second client can obtain the environment information and user information in real time. And determine the corresponding aggregated signature verification key based on the environment information and user information. Specifically, various environment information and user information are used as corresponding signature verification keys, and then multiple signature verification keys are combined through the aggregate signature technology to obtain the aggregated signature verification key.

[0102] The second client can send the aggregate signature information to the server, or can send the aggregate signature information and the aggregate signature verification key to the server. The server can verify the aggregate signature information, or the aggregate signature information and the aggregate signature verification key. After the verification is passed, the identity authentication result is returned to the second client. The identity authentication result can be authentication passed, authentication failed, or necessary information for participating in the business, etc., which is not limited in the embodiment of the present invention.

[0103] In one implementation, the server sends the necessary information for participating in the service to the second client, so that the second client obtains the necessary information from the server. The necessary information for participating in the service refers to the information necessary for the client to participate in the service, such as the conference room number and conference password in a video conference, and can include any applicable information according to actual conditions, and the embodiment of the present invention does not limit this.

[0104] Since the aggregated signature information is generated based on multiple signature keys corresponding to the environment information and the user information, and the aggregated signature verification key is generated based on multiple signature verification keys corresponding to the environment information and the user information, wherein the signature verification key and the corresponding signature key are a key pair. Therefore, the server can verify the aggregated signature information according to the aggregated signature verification key. Specifically, other verifications may also be included. For example, the server may compare whether the aggregated signature verification key is consistent with the aggregated signature verification key stored by the server, which is not limited in the embodiments of the present invention.

[0105] In a specific implementation, the second client can use the first signature key and the second signature key to sign the feedback information to obtain corresponding signature information, and aggregate the signature information into aggregate signature information. For example, the second client can call the aggregate signature technology to aggregate the signature information into a complete signature value, that is, the aggregate signature information.

[0106] In a specific implementation, the first signature key and the second signature key need to be encrypted and protected on the second client. The first signature key and the second signature key are encrypted to obtain a ciphertext signature key. The ciphertext signature key is stored on the second client. The key of the ciphertext signature key can be determined based on the user identity authentication information obtained in real time by the second client. The user identity authentication information refers to the information used by the client for user identity authentication, such as a user name and a user password, or any other applicable information, which is not limited in the embodiment of the present invention.

[0107] The second client determines the key used for encryption and the key used for decryption based on the user identity authentication information obtained in real time. For example, the user name and the user password are concatenated together as the key. The key can be determined in any applicable manner, and the embodiment of the present invention does not limit this.

[0108] During the identity authentication stage, if the user identity authentication information is inconsistent with the user identity authentication information when storing multiple signature keys, the first signature key and the second signature key cannot be decrypted, and then the aggregate signature information cannot be synthesized, thereby ensuring the security of identity authentication.

[0109] In a specific implementation, the server can use the user password, the first signature key and the second signature key to encrypt, and then return the first signature key and the second signature key to the second client. The second client uses the user password to decrypt to obtain the first signature key and the second signature key, thereby ensuring the security of the transmission process of the first signature key and the second signature key.

[0110] After obtaining the multiple signature verification keys corresponding to the first signature key and the second signature key, the server aggregates the corresponding multiple signature verification keys into an aggregated signature verification key in the same manner as the second client, and stores the aggregated signature verification key. The aggregated signature verification key can be stored in correspondence with the user unique identifier (oid, ObjectIdentifier) ​​of the second client, so that the server can find the corresponding aggregated signature verification key according to the user unique identifier.

[0111] The server stores the aggregated signature verification key. The server uses the aggregated signature verification key to verify the aggregated signature information. If the verification passes, the verification passes. If the verification fails, the verification fails. The specific verification method can use the verification method of the aggregated signature algorithm.

[0112] Reference Figure 2 , shows a flowchart of an identity authentication method embodiment of the present invention, which is applied to a first client. The method may specifically include the following steps:

[0113] Step 101, during the identity authentication process, obtaining a first signing key and feedback information from a server according to input permission information; wherein the first signing key is generated by the server according to the environment information of the second client.

[0114] In the embodiment of the present invention, the first signature key is generated by the server according to the environment information of the second client. The environment information of the first client is different from the environment information of the second client, and the first client cannot obtain the environment information of the second client. Therefore, the first client needs to obtain the first signature key from the server. After the server generates the first signature key according to the environment information of the second client, it stores the first signature key so as to provide it to the first client.

[0115] In the embodiment of the present invention, during the identity authentication process of the first client, the user can input permission information on the first client, and the first client obtains the first signature key and feedback information from the server according to the permission information.

[0116] Among them, the permission information refers to information indicating to the server that the first client has the permission to obtain the first signing key, for example, the management key set during registration, or the mobile phone verification code, or the email verification code, etc., or any other applicable permission information, which is not limited in this embodiment of the present invention.

[0117] In an optional embodiment of the present invention, a specific implementation method of obtaining a first signature key and feedback information from a server based on input permission information may include: sending the input permission information to the server for the server to verify the permission information; and receiving the first signature key and feedback information returned by the server after the verification is successful.

[0118] In the embodiment of the present invention, the server stores the first signature key. The first client sends the input permission information to the server, and the server verifies the permission information. If the verification is successful, the server returns the first signature key and feedback information to the first client.

[0119] In an optional embodiment of the present invention, a specific implementation method of receiving the first signing key and feedback information returned by the server after the verification is successful may include: receiving the first signing key ciphertext and feedback information returned by the server after the verification is successful; using the permission information to decrypt the first signing key ciphertext to obtain the first signing key.

[0120] When the server returns the first signature key, it is encrypted. Specifically, the first signature key may be encrypted using the permission information, which is recorded as the first signature key ciphertext. For example, after the server generates the first signature key according to the environment information of the second client, it encrypts the first signature key using the permission information and stores it encrypted on the server.

[0121] After receiving the first signing key ciphertext, the first client uses the permission information to decrypt the first signing key ciphertext, thereby obtaining the first signing key.

[0122] The first signature key is encrypted and protected using permission information, which ensures the security of the key and thus improves security.

[0123] In an optional embodiment of the present invention, before obtaining the first signature key and feedback information from the server according to the input permission information, it may also include: sending an identity authentication request to the server according to the user identity authentication information and the device information of the device where the first client is located; receiving the permission information verification request sent by the server when the identity authentication passes and it is determined that the device information of the device where the first client is located is inconsistent with that of the second client.

[0124] User identity authentication information refers to information used for user identity authentication, such as a user name and a user password, or any other applicable information, which is not limited in the embodiment of the present invention. During the identity authentication process, the first client first sends an identity authentication request to the server according to the user identity authentication information. For example, the user enters a user name and a user password in the first client, and sends an identity authentication request carrying the user name and the user password to the server.

[0125] The server performs identity authentication based on the user identity authentication information. For example, the user name and user key are verified. If the verification passes, the identity authentication passes. After the identity authentication passes, the server determines whether the device information of the first client and the second client is consistent based on the device information. If the identity authentication passes but the device information is inconsistent, the server sends a permission information verification request to the first client to require the user on the first client to enter the permission information.

[0126] For example, after the identity authentication is passed, if the server finds that the first client is not the second client, it sends a permission information verification request to the first client.

[0127] Step 102: Determine the second signing key based on the user information obtained in real time.

[0128] In the embodiment of the present invention, the second signature key is generated by the server according to the user information of the second client. Therefore, as long as the user information of the first client and the user information of the second client are the same, that is, the same user logs in at the second client and the first client, the second signature key can be generated according to the user information of the first client.

[0129] In the embodiment of the present invention, the first client obtains user information in real time and determines the second signature key based on the user information. Specifically, the second signature key can be determined in the same manner as the second client, so that as long as the user information is correct, that is, consistent with the user information of the second client, the second signature key will also be correct.

[0130] In an optional embodiment of the present invention, a specific implementation method of determining the second signing key based on the user information obtained in real time may include: requesting a key pair from the server based on the user information obtained in real time; and receiving the second signing key returned by the server.

[0131] The first client can request a key pair from the server based on the user information. For example, the server interface is called, and the server generates a key pair based on the user information, including the second signature key. The first client receives the second signature key returned by the server.

[0132] Step 103: Determine aggregate signature information according to the feedback information, the first signature key and the second signature key.

[0133] In the embodiment of the present invention, the first client uses the first signature key and the second signature key and adopts the aggregate signature algorithm to sign the feedback information to obtain the aggregate signature information. Specifically, the same method as the second client can be adopted to obtain verifiable aggregate signature information.

[0134] In an optional embodiment of the present invention, a specific implementation method of determining the aggregate signature information based on the feedback information, the first signature key and the second signature key may include: using the first signature key and the second signature key to sign the feedback information respectively to obtain corresponding signature information; and aggregating the aggregate signature information based on each signature information.

[0135] For example, Figure 1 As shown, the first client (Zhangshangtong APP on mobile device B) first initiates an identity authentication request to the server. After the server verifies the user information (user name and user key) and the administrator PIN code (i.e., permission information), it ciphertext sends the signature key fragment 1 (i.e., the first signature key) encrypted and stored by the administrator PIN code. The first client collects user information in real time, and determines the signature key fragment 2 (i.e., the second signature key) based on the user information. The first client uses the signature key fragment 1 to sign the random number returned by the server to obtain the signature value fragment 1. The first client uses the signature key fragment 2 to sign the random number returned by the server to obtain the signature value fragment 2. Then, through the aggregate signature algorithm, the complete signature information, i.e., the aggregate signature information, is generated. The aggregate signature information can be sent to the server for verification, thereby completing the identity authentication on the first client.

[0136] Step 104: Obtain an identity authentication result from the server according to the aggregate signature information.

[0137] In the embodiment of the present invention, since the aggregated signature information is generated based on the signature key corresponding to the environment information and the user information, the aggregated signature verification key is generated based on the environment information and the user information. Therefore, the server can verify the aggregated signature information according to the aggregated signature verification key. Other verifications may also be included, which are not limited in the embodiment of the present invention.

[0138] In an embodiment of the present invention, the first client may send the aggregate signature information to the server. The server may verify the aggregate signature information. After verification, the server sends the identity authentication result to the first client, so that the first client obtains the identity authentication result from the server.

[0139] The identity authentication result may be determined by the identity authentication including the verification result of the aggregated signature information. For example, if the verification result of the aggregated signature information is not passed, the identity authentication result is authentication failure, and if the verification result of the aggregated signature information is passed, the identity authentication result is authentication passed. In addition to whether the identity authentication result is passed, the identity authentication result may also include necessary information for participating in the business when the authentication is passed.

[0140] According to an embodiment of the present invention, during the identity authentication process, a first signature key and feedback information are obtained from a server according to input permission information, wherein the first signature key is generated by the server according to environmental information of a second client, a second signature key is determined according to user information acquired in real time, aggregate signature information is determined according to the feedback information, the first signature key and the second signature key, and an identity authentication result is obtained from the server according to the aggregate signature information, so that by introducing permission control for synchronizing the first signature key, keys of parts related to the environment are securely synchronized on different clients, avoiding transmission or storage of complete signature keys, which brings risks of key leakage; even if part of the synchronized keys are leaked, if the user information is incorrect, identity authentication cannot be completed, thereby realizing the need for users to authenticate on different clients, while ensuring the security and reliability of identity authentication.

[0141] Reference Figure 3 , shows a flowchart of an identity authentication method embodiment of the present invention, which is applied to the server. The method may specifically include the following steps:

[0142] Step 201, during the identity authentication process, a first signing key and feedback information are sent to the first client according to the authority information sent by the first client; wherein the first signing key is generated by the server according to the environment information of the second client.

[0143] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0144] In an optional embodiment of the present invention, before sending the first signature key and feedback information to the first client according to the permission information sent by the first client, it may also include: in response to a key pair request sent by the second client, generating a first key pair according to the environmental information carried by the key pair request, and generating a second key pair according to the user information carried by the key pair request; wherein the first key pair includes a first signature key, and the second key pair includes a second signature key; and aggregating the first key pair and the second key pair into an aggregated signature verification key, and storing the aggregated signature verification key.

[0145] The second client sends a key pair request to the server, which carries environment information and user information. The server generates a first key pair based on the environment information, and the first key pair includes a first signing key and a corresponding first signature verification key. The server generates a second key pair based on the user information, and the second key pair includes a second signing key and a corresponding second signature verification key.

[0146] The server may aggregate the first signature verification key and the second signature verification key according to the first key pair and the second key pair to obtain an aggregated signature verification key, and store the aggregated signature verification key on the server.

[0147] In an optional embodiment of the present invention, the method may further include: encrypting the first signature key using the permission information to obtain the first signature key ciphertext and storing the ciphertext.

[0148] The specific implementation method of this step can be found in the description of the above embodiment and will not be repeated here.

[0149] In an optional embodiment of the present invention, the method may further include: recording user identity authentication information and authority information according to the registration request sent by the second client.

[0150] The second client is the client when the user registers. The second client sends a registration request, carrying the user identity authentication information and permission information. The server records the user identity authentication information and permission information.

[0151] Step 202: Receive the aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client based on the second signature key, the feedback information and the first signature key, and the second signature key is determined by the first client based on user information obtained in real time.

[0152] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0153] Step 203: verify the aggregate signature information and send the identity authentication result to the client.

[0154] In an embodiment of the present invention, the server can verify the aggregated signature information according to the aggregated signature verification key, wherein the aggregated signature verification key can be pre-stored on the server, or can be generated in real time according to the environment information and user information.

[0155] In an optional embodiment of the present invention, a specific implementation manner of verifying the aggregate signature information may include: using the aggregate signature verification key to verify the aggregate signature information.

[0156] For example, Figure 4Schematic diagram of the identity authentication process of the client and server shown in FIG. In the process of device A user registration application key and identity authentication, the second client (i.e., the Vision Network Palm APP mobile terminal on device A) user applies to register a user and sets the user's unique identifier, user PIN code, administrator PIN code (i.e., permission information) and other information. The server (i.e., the Vision Network Palm APP server) reviews the registered information. After the review is passed, it records the user information and assigns the user a unique identifier oid. The server returns a successful registration feedback to the client. The second client collects the device information, APP information (i.e., client information), and user information on device A. The second client calls the server interface to obtain the public and private key fragments (i.e., the signature verification key and the signature key). The server uses the administrator PIN code to encrypt and store the key information related to device A (such as the first signature key and the aggregate signature verification key, etc.). The second client sends an identity authentication request to the server. After receiving the user information such as the user name and user PIN code, the server verifies the user information, generates a random number after the verification is passed, and then returns the random number to the second client. The second client uses the private key fragments to sign the random number respectively, and then uses the aggregate signature technology to combine the signature values ​​into a complete signature value, that is, the aggregate signature information. The complete signature value (that is, the aggregate signature information) is sent to the server, and the server verifies the aggregate signature information according to the aggregate signature verification key, and returns the identity verification result to the second client. In the process of device B user authentication, the first client (that is, the visual network palm APP mobile terminal on device B) sends an authentication request to the server. After receiving the device information, user name, user PIN code and other information carried in the authentication request, the server verifies the user information, detects that it has been registered and logged in on other devices, and sends a request to verify the administrator PIN code to the first client. The first client sends the administrator PIN code to the server. The server verifies the administrator PIN code, generates a random number after the verification is passed, and then returns the ciphertext signature key of device A (that is, the ciphertext first signature key) and the random number to the first client. The first client decrypts to obtain the key, signs the random number, generates signature value 1, collects user information, signs the random number to generate signature value 2, and aggregates it into a complete signature value to obtain the aggregate signature information. The aggregate signature information is sent to the server, which verifies the aggregate signature information based on the aggregate signature verification key and returns the identity verification result to the first client.

[0157] According to an embodiment of the present invention, during the identity authentication process, according to the permission information sent by the first client, a first signature key and feedback information are sent to the first client; wherein the first signature key is generated by the server according to the environment information of the second client; the aggregate signature information sent by the first client is received; wherein the aggregate signature information is determined by the first client according to the second signature key, the feedback information and the first signature key, and the second signature key is determined by the first client according to the user information obtained in real time; the aggregate signature information is verified, and the identity authentication result is sent to the client, so that by introducing the permission control of synchronizing the first signature key, the keys of the environment-related parts are securely synchronized on different clients, avoiding the transmission or storage of the complete signature key, which brings risks to key leakage. Even if the synchronized part of the key is leaked, if the user information is incorrect, the identity authentication cannot be completed, thereby realizing the user's need to authenticate on different clients, while ensuring the security and reliability of the identity authentication.

[0158] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0159] Reference Figure 5 The structure block diagram of an embodiment of an identity authentication device of the present invention is shown, which is applied to a first client and may specifically include the following modules:

[0160] The information acquisition module 301 is used to acquire a first signature key and feedback information from the server according to the input permission information during the identity authentication process; wherein the first signature key is generated by the server according to the environment information of the second client;

[0161] A key determination module 302, configured to determine a second signature key according to user information acquired in real time;

[0162] An information determination module 303, configured to determine aggregate signature information according to the feedback information, the first signature key and the second signature key;

[0163] The result acquisition module 304 is used to obtain the identity authentication result from the server according to the aggregate signature information.

[0164] Optionally, the information acquisition module includes:

[0165] An information sending submodule, used for sending the input permission information to the server, so that the server can verify the permission information;

[0166] The information receiving submodule is used to receive the first signature key and feedback information returned by the server after the verification is successful.

[0167] Optionally, the information receiving submodule includes:

[0168] An information receiving unit, used to receive the first signature key ciphertext and feedback information returned by the server after the verification is successful;

[0169] A decryption unit is used to decrypt the first signing key ciphertext using the permission information to obtain the first signing key.

[0170] Optionally, the key determination module includes:

[0171] A key pair request submodule, used to request a key pair from the server according to the user information obtained in real time;

[0172] The key receiving submodule is used to receive the second signing key returned by the server.

[0173] Optionally, the information determination module includes:

[0174] A signing submodule, used to sign the feedback information using the first signing key and the second signing key respectively to obtain corresponding signature information;

[0175] The aggregation submodule is used to aggregate the signature information into the aggregate signature information.

[0176] Optionally, the device further comprises:

[0177] a request sending module, configured to send an identity authentication request to the server according to user identity authentication information and device information of the device where the first client is located, before obtaining the first signing key and feedback information from the server according to the input permission information;

[0178] The request receiving module is used to receive the permission information verification request sent by the server when the identity authentication is passed and it is determined that the device information of the device where the first client and the second client are located are inconsistent.

[0179] According to an embodiment of the present invention, during the identity authentication process, a first signature key and feedback information are obtained from a server according to input permission information, wherein the first signature key is generated by the server according to environmental information of a second client, a second signature key is determined according to user information acquired in real time, aggregate signature information is determined according to the feedback information, the first signature key and the second signature key, and an identity authentication result is obtained from the server according to the aggregate signature information, so that by introducing permission control for synchronizing the first signature key, keys of parts related to the environment are securely synchronized on different clients, avoiding transmission or storage of complete signature keys, which brings risks of key leakage; even if part of the synchronized keys are leaked, if the user information is incorrect, identity authentication cannot be completed, thereby realizing the need for users to authenticate on different clients, while ensuring the security and reliability of identity authentication.

[0180] Reference Figure 6 The structural block diagram of another embodiment of the identity authentication device of the present invention is shown, which is applied to the server and may specifically include the following modules:

[0181] The information sending module 401 is used to send the first signing key and feedback information to the first client according to the permission information sent by the first client during the identity authentication process; wherein the first signing key is generated by the server according to the environment information of the second client;

[0182] The information receiving module 402 is used to receive the aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client according to the second signature key, the feedback information and the first signature key, and the second signature key is determined by the first client according to the user information obtained in real time;

[0183] The verification module 403 is used to verify the aggregate signature information and send an identity authentication result to the client.

[0184] Optionally, the device further comprises:

[0185] a key pair generation module, configured to generate a first key pair in response to a key pair request sent by the second client according to the environment information carried in the key pair request, and generate a second key pair according to the user information carried in the key pair request, before sending the first signing key and feedback information to the first client according to the permission information sent by the first client; wherein the first key pair includes a first signing key, and the second key pair includes a second signing key;

[0186] The aggregation module is used to aggregate the first key pair and the second key pair into an aggregated signature verification key and store the aggregated signature verification key.

[0187] Optionally, the verification module includes:

[0188] The verification submodule is used to verify the aggregate signature information using the aggregate signature verification key.

[0189] Optionally, the device further comprises:

[0190] The encryption module is used to encrypt the first signature key using the permission information to obtain the first signature key ciphertext and store it.

[0191] Optionally, the device further comprises:

[0192] The information recording module is used to record user identity authentication information and authority information according to the registration request sent by the second client.

[0193] According to an embodiment of the present invention, during the identity authentication process, according to the permission information sent by the first client, a first signature key and feedback information are sent to the first client; wherein the first signature key is generated by the server according to the environment information of the second client; the aggregate signature information sent by the first client is received; wherein the aggregate signature information is determined by the first client according to the second signature key, the feedback information and the first signature key, and the second signature key is determined by the first client according to the user information obtained in real time; the aggregate signature information is verified, and the identity authentication result is sent to the client, so that by introducing the permission control of synchronizing the first signature key, the keys of the environment-related parts are securely synchronized on different clients, avoiding the transmission or storage of the complete signature key, which brings risks to key leakage. Even if the synchronized part of the key is leaked, if the user information is incorrect, the identity authentication cannot be completed, thereby realizing the user's need to authenticate on different clients, while ensuring the security and reliability of the identity authentication.

[0194] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0195] Figure 7 1 is a block diagram of an electronic device 600 for identity authentication according to an exemplary embodiment. For example, the electronic device 600 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0196] Reference Figure 7, the electronic device 600 may include one or more of the following components: a processing component 602 , a memory 604 , a power component 606 , a multimedia component 608 , an audio component 610 , an input / output (I / O) interface 612 , a sensor component 614 , and a communication component 616 .

[0197] The processing component 602 generally controls the overall operation of the electronic device 600, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 602 may include one or more processors 620 to execute instructions to complete all or part of the steps of the above-mentioned identity authentication. In addition, the processing component 602 may include one or more modules to facilitate the interaction between the processing component 602 and other components. For example, the processing component 602 may include a multimedia module to facilitate the interaction between the multimedia component 608 and the processing component 602.

[0198] The memory 604 is configured to store various types of data to support operations on the electronic device 600. Examples of such data include instructions for any application or method operating on the electronic device 600, contact data, phone book data, messages, pictures, videos, etc. The memory 604 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0199] The power supply component 606 provides power to the various components of the electronic device 600. The power supply component 606 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 600.

[0200] The multimedia component 608 includes a screen that provides an output interface between the electronic device 600 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 608 includes a front camera and / or a rear camera. When the electronic device 600 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0201] The audio component 610 is configured to output and / or input audio signals. For example, the audio component 610 includes a microphone (MIC), and when the electronic device 600 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 604 or sent via the communication component 616. In some embodiments, the audio component 610 also includes a speaker for outputting audio signals.

[0202] I / O interface 612 provides an interface between processing component 602 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0203] The sensor assembly 614 includes one or more sensors for providing various aspects of status assessment for the electronic device 600. For example, the sensor assembly 614 can detect the open / closed state of the electronic device 600, the relative positioning of the components, such as the display and keypad of the electronic device 600, and the sensor assembly 614 can also detect the position change of the electronic device 600 or a component of the electronic device 600, the presence or absence of contact between the user and the electronic device 600, the orientation or acceleration / deceleration of the electronic device 600, and the temperature change of the electronic device 600. The sensor assembly 614 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 614 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 614 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0204] The communication component 616 is configured to facilitate wired or wireless communication between the electronic device 600 and other devices. The electronic device 600 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 616 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 616 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0205] In an exemplary embodiment, the electronic device 600 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above-mentioned shutdown control method.

[0206] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 604 including instructions, and the instructions can be executed by a processor 620 of an electronic device 600 to complete the above-mentioned shutdown control method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0207] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables a server to perform an identity authentication method, applied to a first client, the method comprising:

[0208] During the identity authentication process, a first signing key and feedback information are obtained from the server according to the input permission information; wherein the first signing key is generated by the server according to the environment information of the second client;

[0209] Determine the second signing key according to the user information obtained in real time;

[0210] Determine aggregate signature information according to the feedback information, the first signature key and the second signature key;

[0211] According to the aggregate signature information, an identity authentication result is obtained from the server.

[0212] Optionally, obtaining the first signing key and feedback information from the server according to the input permission information includes:

[0213] Sending the input permission information to the server for the server to verify the permission information;

[0214] Receive the first signature key and feedback information returned by the server after the verification is successful.

[0215] Optionally, the receiving the first signing key and feedback information returned by the server after the verification is successful includes:

[0216] Receiving the first signature key ciphertext and feedback information returned by the server after verification;

[0217] The first signing key ciphertext is decrypted using the permission information to obtain the first signing key.

[0218] Optionally, determining the second signing key according to the user information acquired in real time includes:

[0219] Requesting a key pair from the server according to the user information obtained in real time;

[0220] Receive the second signing key returned by the server.

[0221] Optionally, determining the aggregate signature information according to the feedback information, the first signature key, and the second signature key includes:

[0222] Using the first signature key and the second signature key respectively, the feedback information is signed to obtain corresponding signature information;

[0223] The aggregated signature information is aggregated according to each signature information.

[0224] Optionally, before obtaining the first signing key and feedback information from the server according to the input permission information, the method further includes:

[0225] Sending an identity authentication request to the server according to the user identity authentication information and the device information of the device where the first client is located;

[0226] The server receives a permission information verification request sent by the server when the identity authentication is passed and it is determined that the device information of the device where the first client and the second client are located are inconsistent.

[0227] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables a server to execute an identity authentication method, applied to a server, the method comprising:

[0228] During the identity authentication process, according to the permission information sent by the first client, the first signing key and feedback information are sent to the first client; wherein the first signing key is generated by the server according to the environment information of the second client;

[0229] receiving aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client according to a second signature key, the feedback information, and the first signature key, and the second signature key is determined by the first client according to user information acquired in real time;

[0230] The aggregate signature information is verified, and an identity authentication result is sent to the client.

[0231] Optionally, before sending the first signing key and feedback information to the first client according to the permission information sent by the first client, the method further includes:

[0232] In response to the key pair request sent by the second client, generating a first key pair according to the environment information carried in the key pair request, and generating a second key pair according to the user information carried in the key pair request; wherein the first key pair includes a first signing key, and the second key pair includes a second signing key;

[0233] An aggregated signature verification key is aggregated according to the first key pair and the second key pair, and stored.

[0234] Optionally, the verifying the aggregate signature information includes:

[0235] The aggregate signature information is verified using the aggregate signature verification key.

[0236] Optionally, the method further comprises:

[0237] The first signing key is encrypted using the permission information to obtain a first signing key ciphertext, and the ciphertext is stored.

[0238] Optionally, the method further comprises:

[0239] According to the registration request sent by the second client, user identity authentication information and authority information are recorded.

[0240] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0241] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0242] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0243] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0244] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0245] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0246] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0247] The identity authentication method and identity authentication device provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. An identity authentication method, characterized in that: Applied to a first client, the method includes: During the identity authentication process, a first signing key and feedback information are obtained from the server according to the input permission information; wherein the first signing key is generated by the server according to the environment information of the second client; Determine the second signing key based on the user information obtained in real time; Determine aggregate signature information according to the feedback information, the first signature key and the second signature key; According to the aggregate signature information, an identity authentication result is obtained from the server.

2. The method according to claim 1, characterized in that: The obtaining of the first signing key and feedback information from the server according to the input permission information includes: Sending the input permission information to the server for the server to verify the permission information; Receive the first signature key and feedback information returned by the server after the verification is successful.

3. The method according to claim 2, characterized in that The receiving the first signing key and feedback information returned by the server after the verification is successful includes: Receiving the first signature key ciphertext and feedback information returned by the server after verification; The first signing key ciphertext is decrypted using the permission information to obtain the first signing key.

4. The method according to claim 1, characterized in that: The determining of the second signing key according to the user information acquired in real time includes: Requesting a key pair from the server according to the user information obtained in real time; Receive the second signing key returned by the server.

5. The method according to claim 1, characterized in that The determining, according to the feedback information, the first signature key and the second signature key, aggregate signature information includes: Using the first signature key and the second signature key respectively, the feedback information is signed to obtain corresponding signature information; The aggregated signature information is aggregated according to each signature information.

6. An identity authentication method, characterized in that: Applied to the server, the method includes: During the identity authentication process, according to the permission information sent by the first client, the first signing key and feedback information are sent to the first client; wherein the first signing key is generated by the server according to the environment information of the second client; receiving aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client according to a second signature key, the feedback information, and the first signature key, and the second signature key is determined by the first client according to user information acquired in real time; The aggregate signature information is verified, and an identity authentication result is sent to the client.

7. An identity authentication device, characterized in that: Applied to a first client, the device comprises: An information acquisition module, used to acquire a first signature key and feedback information from a server according to input permission information during identity authentication; wherein the first signature key is generated by the server according to the environment information of the second client; A key determination module, used to determine a second signature key according to user information acquired in real time; an information determination module, configured to determine aggregate signature information according to the feedback information, the first signature key, and the second signature key; The result acquisition module is used to obtain the identity authentication result from the server according to the aggregate signature information.

8. An identity authentication device, characterized in that: Applied to the server, the device comprises: An information sending module, used to send a first signature key and feedback information to the first client according to the permission information sent by the first client during the identity authentication process; wherein the first signature key is generated by the server according to the environment information of the second client; an information receiving module, configured to receive aggregate signature information sent by the first client; wherein the aggregate signature information is determined by the first client according to a second signature key, the feedback information, and the first signature key, and the second signature key is determined by the first client according to user information acquired in real time; The verification module is used to verify the aggregate signature information and send the identity authentication result to the client.

9. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the apparatus to perform the method of any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the method according to any one of claims 1 to 6.

Images