Identity authentication method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an identity authentication method and device, equipment and a medium. The method comprises the steps of regenerating a server-side signature key and a client-side signature key according to environment information and user information of the current client-side and a historical client-side after permission information sent by the current client-side passes verification, sending the client-side signature key, feedback information and server-side signature information to the current client-side, and sending the client-side signature key, the feedback information and the server-side signature information to the current client-side. According to the method, the overall signature information sent by the current client side is received, the overall signature information is verified, and the identity authentication result is sent to the client side, so that the secret key related to the environment information is safely regenerated for the new client side by introducing authority control for regenerating the secret key for signature, the overall signature secret key is prevented from being transmitted or stored, and the user experience is improved. According to the method and the device, risks are brought to key leakage, even if part of synchronized keys are leaked, the requirement that a user can authenticate identities on different clients is met, and meanwhile, the safety and the reliability of identity authentication are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an identity authentication method, an identity authentication device, an electronic device and a computer-readable storage medium. Background Art

[0002] The VisionLink Palm APP (application) can make real-time audio and video calls with the VisionLink network through 4G (fourth-generation mobile communication technology) or WIFI (wireless network), and can view national monitoring data on the mobile terminal. It enables grid workers and other personnel to report an alarm at any time with one click and link the callback function with the GIS (Geographic Information System) platform. The map trajectory can be viewed on the APP terminal, and functions such as alarm reception, alarm transfer, reporting and callback can be realized on the mobile APP, achieving flexible application of mobile alarm.

[0003] With the rapid development of visual networking services, there is an increasing demand for using the mobile app to participate in visual networking conferences, monitoring and other services. Currently, users of the app need to authenticate their identities to participate in conference services. Since the signature private key representing the identity is bound to the device information on the mobile terminal and the app information on the app, once the login device is changed and the login environment changes, the same user will not be able to log in normally. However, in some special cases, users need to log in on another mobile device to participate in visual networking services, so this problem needs to be solved urgently. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide an identity authentication method, a corresponding identity authentication device, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses an identity authentication method, which is applied to a server, and the method includes:

[0006] After the permission information sent by the current client is verified, the server signing key and the client signing key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information;

[0007] Sending the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key;

[0008] Receiving the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information;

[0009] The overall signature information is verified, and an identity authentication result is sent to the current client.

[0010] Optionally, after the permission information sent by the current client is verified, before regenerating the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information, the method further includes:

[0011] In response to the identity authentication request of the current client, determining that the user information carried in the identity authentication request has been verified;

[0012] Determine that the user has logged in on another device based on the environment information carried in the identity authentication request and the environment information of the historical client;

[0013] Sending a permission information verification request to the current client.

[0014] Optionally, the regenerating the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information includes:

[0015] Regenerate a signature key pair according to the current client environment information, the historical client environment information and the user information; wherein the signature key pair includes an overall signature key and an overall experience signature key;

[0016] The overall signature key is split to obtain a server-side signature key and a client-side signature key.

[0017] Optionally, the method further comprises:

[0018] The server signing key is encrypted using the permission information to obtain a ciphertext of the server signing key and store it.

[0019] Optionally, sending the client signing key, feedback information, and server signing information to the current client includes:

[0020] Using the user key in the user information or the permission information, encrypting the client signature key to obtain a client signature key ciphertext;

[0021] The client signature key ciphertext, feedback information and server signature information are sent to the current client.

[0022] Optionally, the verifying the overall signature information includes:

[0023] Generate a whole experience signing key according to the current client environment information, historical client environment information and user information;

[0024] The entire signature information is verified using the entire verification key.

[0025] Optionally, the method further comprises:

[0026] According to the registration request sent by the historical client, the user information and the authority information are recorded.

[0027] The embodiment of the present invention further discloses an identity authentication method, which is applied to the current client, and the method includes:

[0028] In the identity authentication process, according to the input permission information, the client signature key, feedback information and server signature information are obtained from the server; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client environment information, the historical client environment information and the user information;

[0029] Determine the overall signature information according to the client signature key, the feedback information and the server signature information;

[0030] According to the overall signature information, an identity authentication result is obtained from the server.

[0031] Optionally, determining overall signature information according to the client signature key, the feedback information and the server signature information includes:

[0032] Using the client signature key, signing the feedback information to obtain client signature information;

[0033] The client signature information and the server signature information are combined into overall signature information.

[0034] Optionally, obtaining the client signing key from the server includes:

[0035] Receive the client signature key ciphertext returned by the server;

[0036] The client signing key ciphertext is decrypted using the user key in the user information or the authority information to obtain the client signing key.

[0037] Optionally, before obtaining the client signing key, feedback information and server signing information from the server according to the input permission information, the method further includes:

[0038] Sending an identity authentication request to the server according to the user information and the environment information of the current client;

[0039] A permission information verification request sent by the server is received when the user information verification passes and it is determined that the current client is not among the historical clients.

[0040] The embodiment of the present invention further discloses an identity authentication device, which is applied to a server, and the device comprises:

[0041] A key regeneration module is used to regenerate the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information after the permission information sent by the current client is verified;

[0042] An information sending module, used to send the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key;

[0043] An information receiving module, used to receive the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information;

[0044] The verification module is used to verify the overall signature information and send the identity authentication result to the current client.

[0045] Optionally, the device further comprises:

[0046] A verification module, configured to, after the permission information sent by the current client is verified, respond to the identity authentication request of the current client and determine whether the user information carried in the identity authentication request is verified before regenerating the server signature key and the client signature key according to the environment information of the current client, the environment information of the historical client and the user information;

[0047] A login determination module, used to determine that the user has logged in on another device based on the environment information carried in the identity authentication request and the environment information of the historical client;

[0048] The request sending module is used to send a permission information verification request to the current client.

[0049] Optionally, the key regeneration module includes:

[0050] A key pair generation submodule, used to regenerate a signature key pair according to the current client environment information, the historical client environment information and the user information; wherein the signature key pair includes an overall signature key and an overall experience signing key;

[0051] The key splitting submodule is used to split the overall signing key to obtain a server signing key and a client signing key.

[0052] Optionally, the device further comprises:

[0053] The encryption storage module is used to encrypt the server signature key using the permission information to obtain the server signature key ciphertext and store it.

[0054] Optionally, the information sending module includes:

[0055] An encryption submodule, used to encrypt the client signature key using the user key in the user information or the authority information to obtain a client signature key ciphertext;

[0056] The sending submodule is used to send the client signature key ciphertext, feedback information and server signature information to the current client.

[0057] Optionally, the verification module includes:

[0058] A signature verification key generation submodule, used to generate a whole signature verification key according to the current client environment information, the historical client environment information and the user information;

[0059] The signature verification submodule is used to verify the overall signature information using the overall signature verification key.

[0060] Optionally, the device further comprises:

[0061] The information recording module is used to record the user information and the authority information according to the registration request sent by the historical client.

[0062] The embodiment of the present invention further discloses an identity authentication device, which is applied to the current client, and the device includes:

[0063] An information acquisition module is used to acquire the client signature key, feedback information and server signature information from the server according to the input permission information during the identity authentication process; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client environment information, the historical client environment information and the user information;

[0064] An information determination module, used to determine the overall signature information according to the client signature key, the feedback information and the server signature information;

[0065] The result acquisition module is used to obtain the identity authentication result from the server according to the overall signature information.

[0066] Optionally, the information determination module includes:

[0067] The signature submodule is used to sign the feedback information using the client signature key to obtain client signature information;

[0068] The synthesis submodule is used to synthesize the client signature information and the server signature information into overall signature information.

[0069] Optionally, the information acquisition module includes:

[0070] The ciphertext receiving submodule is used to receive the client signature key ciphertext returned by the server;

[0071] The decryption submodule is used to use the user key in the user information or the permission information to decrypt the client signature key ciphertext to obtain the client signature key.

[0072] Optionally, the device further comprises:

[0073] A request sending module, used to send an identity authentication request to the server according to user information and environment information of the current client before obtaining the client signing key, feedback information and server signing information from the server according to the input permission information;

[0074] The request receiving module is used to receive the permission information verification request sent by the server when the user information verification is passed and it is determined that the current client is not among the historical clients.

[0075] The embodiment of the present invention further discloses an electronic device, including:

[0076] one or more processors; and

[0077] One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the apparatus to perform any of the methods described above.

[0078] The embodiment of the present invention further discloses a computer-readable storage medium, wherein a computer program stored in the storage medium enables a processor to execute any of the methods described above.

[0079] According to an embodiment of the present invention, after the permission information sent by the current client is verified, the server signature key and the client signature key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information, and the client signature key, feedback information and server signature information are sent to the current client, wherein the server signature information is obtained by the server signing the feedback information according to the server signature key, and the overall signature information sent by the current client is received, wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information, the overall signature information is verified, and the identity authentication result is sent to the current client, so that by introducing the permission control of regenerating the key used for signing, the key related to the environment information is safely regenerated for the new client, and the transmission or storage of the overall signature key is avoided, which brings risks to the key leakage. Even if the synchronized part of the key is leaked, the user can realize the need of identity authentication on different clients, and at the same time ensure the security and reliability of the identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 It is a schematic diagram of the principle of threshold signature algorithm on different devices;

[0081] Figure 2 is a flowchart of steps of an identity authentication method embodiment of the present invention;

[0082] Figure 3 is a flowchart of steps of an identity authentication method embodiment of the present invention;

[0083] Figure 4 It is a schematic diagram of the authentication process between the client and the server;

[0084] Figure 5 It is a structural block diagram of an embodiment of an identity authentication device of the present invention;

[0085] Figure 6 It is a structural block diagram of an embodiment of an identity authentication device of the present invention;

[0086] Figure 7 The present invention is a structural block diagram of an electronic device for identity authentication according to an exemplary embodiment. DETAILED DESCRIPTION

[0087] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0088] The current client and the historical client (including one or more) refer to clients deployed on different devices. For example, the Palmtong APP deployed on mobile phone A is the current client, and the Palmtong APP deployed on mobile phone B is the historical client.

[0089] After the historical client sends an identity authentication request to the server, the server authenticates the information carried in the identity authentication request (such as user information such as user name and user PIN (Personal Identification Number) code), and after the authentication is passed, the server sends feedback information to the historical client. The feedback information can be a random number generated by the server, or any other applicable information, which is not limited in the embodiment of the present invention.

[0090] For example, when a historical client participates in a service, it needs to first perform identity authentication. The service includes video calling, video conferencing, monitoring, etc., or any other applicable service, which is not limited in the embodiment of the present invention.

[0091] The server generates a key for signing for the historical client in advance, which is recorded as the client signing key and the server signing key. The historical client can safely store the client signing key. The server can safely store the server signing key. After generating the client signing key, the server sends the client signing key to the historical client.

[0092] In one implementation, the server needs to first generate an overall signature key and a corresponding overall experience signature key, i.e., a signature key pair, based on environmental information and user information. Usually, the overall signature key can be the private key in a public-private key pair, and the overall experience signature key can be the public key in a public-private key pair. The overall signature key is then divided into a client signature key and a server signature key. For example, after the overall signature key is generated, the threshold algorithm (2, 2) is used to divide the overall signature key into two parts, one part is securely stored on the server, and the other part is encrypted and sent to the historical client for storage, while the overall signature key is not stored.

[0093] The environment information includes device information, client information, etc. The device information refers to the relevant information of the device where the historical client is located, such as MAC (Media Access Control Address), hardware unique code, etc. Any applicable information can be used, and the embodiment of the present invention does not limit this.

[0094] The client information refers to relevant information of the historical client, for example, information such as the authorization code issued by the server to the historical client. Any applicable information may be used, and the embodiment of the present invention does not impose any limitation on this.

[0095] User information refers to user-related information, such as user name, user password, etc. Any applicable information may be used, and the embodiment of the present invention does not limit this.

[0096] The historical client can send a signature key request to the server. The signature key request carries environment information and user information. The server responds to the signature key request and generates a server signature key and a client signature key according to the environment information and user information. Specifically, any applicable key generation method can be used, and the present invention does not limit this.

[0097] Combining user identity authentication with device information, client information, and user information ensures the authenticity of user identity in multiple dimensions and improves the security of identity authentication.

[0098] During the identity authentication process, the server uses the server signature key to sign the feedback information, obtains a server signature information, and then sends the server signature information and feedback information to the historical client. The historical client uses the client signature key to sign the feedback information, obtains a client signature information. Then the historical client synthesizes an overall signature information based on the server signature information and the client signature information.

[0099] For example, Figure 1 The schematic diagram of the principle of the threshold signature algorithm on different devices shown in the figure, the historical client (Zhangshangtong APP on mobile device A) collects device information and client information (Zhangshangtong APP information), user information, and sends the collected information to the server (Zhangshangtong APP server). The server stores device information, client information and user information. The server generates a signature key (i.e., the overall signature key) based on the device information, client information and user information. The threshold algorithm is used to divide the signature key into server signature key 1 and mobile signature key 2 (i.e., client signature key). The server stores the user's server signature key 1 and sends the mobile signature key 2 to the historical client. During identity authentication, the server uses the server signature key 1 to sign the generated random number to obtain signature value fragment 1, and then sends it to the historical client. The historical client uses the mobile signature key 2 to sign the random number returned by the server to obtain signature value fragment 2. Then the historical client synthesizes the overall signature information through the threshold algorithm.

[0100] Among them, the general process of using the threshold algorithm for the signature scheme is as follows:

[0101] Initialization: n participants agree to set a threshold value t, obtain their own private key shard x, jointly calculate the data verification public key PK and make it public.

[0102] Generate signature shard: The participant uses the private key shard x to generate the signature shard sig_x for the data m.

[0103] Aggregate and generate signature: Merge the signature fragments. Only no less than t signature fragments can generate the overall signature sig.

[0104] Verify the signature: The verifier uses the public key PK to verify the signature sig about the data m.

[0105] The historical client can send the overall signature information to the server. The server can verify the overall signature information. After the verification is passed, the identity authentication result is returned to the historical client. The identity authentication result can be authentication passed, authentication failed, or necessary information for participating in the business, etc., which is not limited in the embodiment of the present invention.

[0106] In one implementation, the server sends the necessary information for participating in the service to the historical client, so that the historical client obtains the necessary information from the server. The necessary information for participating in the service refers to the information necessary for the client to participate in the service, such as the conference room number and conference password in a video conference, and can include any applicable information according to actual conditions, and the embodiment of the present invention does not limit this.

[0107] Since the overall signature information is generated based on the server signature key and the client signature key corresponding to the environment information and the user information, the complete verification key is generated based on the environment information and the user information, wherein the entire verification key and the corresponding overall signature key are a key pair. Therefore, the server can verify the overall signature information based on the complete verification key. Specifically, other verifications may also be included, for example, the server may compare other information of the historical client with the information stored by the server to see if they are consistent, and the embodiments of the present invention do not limit this.

[0108] In a specific implementation, the client signature key needs to be encrypted and protected on the historical client. The server encrypts the client signature key to obtain the client signature key ciphertext, and then sends it to the historical client. The client signature key ciphertext is stored on the historical client. When necessary, the historical client decrypts it to obtain the client signature key. The key of the client signature key ciphertext can be determined based on the user information obtained in real time by the historical client or the permission information input by the user, for example, a user key or an administrator key, or any other applicable key, which is not limited in this embodiment of the present invention.

[0109] During the identity authentication stage, if the user information obtained in real time or the permission information entered by the user is inconsistent with the user information or permission information when the client signature key is stored, the client signature key cannot be decrypted, and then the overall signature information cannot be synthesized, thus ensuring the security of identity authentication.

[0110] In a specific implementation, the server can use the user password or permission information to encrypt the client signature key, and then return the client signature key ciphertext to the historical client. The historical client uses the user password or permission information to decrypt to obtain the client signature key, thereby ensuring the security of the transmission process of the client signature key.

[0111] Reference Figure 2 , shows a flowchart of an identity authentication method embodiment of the present invention, which is applied to the server. The method may specifically include the following steps:

[0112] Step 101, after the permission information sent by the current client is verified, the server signing key and the client signing key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information.

[0113] In the embodiment of the present invention, the current client is a client other than the historical client. During the identity authentication process of the current client, the user can input permission information on the current client, and the current client sends the permission information to the server, which verifies the permission information.

[0114] Among them, the permission information refers to information indicating to the server that the current client has the permission to obtain the client signing key, for example, the management key set during registration, or the mobile phone verification code, or the email verification code, etc., or any other applicable permission information, which is not limited by the embodiment of the present invention.

[0115] In an embodiment of the present invention, the environment information of the current client is different from the environment information of the historical client, and the current client cannot obtain the environment information of the historical client. Therefore, the current client needs to re-acquire the client signing key from the server. After the permission information sent by the current client is verified, the server regenerates the server signing key and the client signing key based on the environment information of the current client, the environment information of the historical client and the user information. In addition to the newly added environment information of the current client, the way the server generates the server signing key and the client signing key is consistent with the way the server generates the server signing key and the client signing key for the historical client.

[0116] In an optional embodiment of the present invention, after the permission information sent by the current client is verified, before the server signature key and the client signature key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information, it may also include: responding to the identity authentication request of the current client, determining that the user information carried by the identity authentication request is verified; determining that the user has logged in on other devices according to the environment information carried by the identity authentication request and the environment information of the historical client; and sending a permission information verification request to the current client.

[0117] User information refers to information used for user identity authentication, such as a user name and user password, or any other applicable information, which is not limited in the embodiments of the present invention. During the identity authentication process, the current client first sends an identity authentication request to the server based on the user information and environment information. For example, the user enters the user name and user password in the current client, and the current client collects the environment information and sends the identity authentication request carrying the user name, user password and environment information to the server.

[0118] The server performs identity authentication based on the user information. For example, the user name and user key are verified. If the verification passes, the identity authentication passes. After the identity authentication passes, the server determines that the environment information of the current client is not in the environment information of the historical client based on the environment information of the current client and the environment information of the historical client, that is, the client has logged in on other devices. If the identity authentication passes but the client has logged in on other devices, the server sends a permission information verification request to the current client to require the user on the current client to enter the permission information.

[0119] For example, after the server passes the identity authentication, if it finds that the current client is not among the historical clients, it will send a permission information verification request to the current client.

[0120] In an optional embodiment of the present invention, a specific implementation method of regenerating the server signature key and the client signature key according to the environmental information of the current client, the environmental information of the historical client and the user information may include: regenerating a signature key pair according to the environmental information of the current client, the environmental information of the historical client and the user information; wherein the signature key pair includes an overall signature key and an overall experience signature key; and splitting the overall signature key to obtain a server signature key and a client signature key.

[0121] After the permission information is verified, the server updates the stored environment information according to the current client's environment information. That is, after adding the current client's environment information, the server regenerates the signature key pair according to the current client's environment information, the historical client's environment information, and the user information. The signature key pair is the regenerated overall signature key and the overall experience signature key. The overall signature key is split to obtain the regenerated server signature key and client signature key.

[0122] In an optional embodiment of the present invention, the method may further include: using the permission information to encrypt the server-side signature key to obtain a server-side signature key ciphertext, and storing the ciphertext.

[0123] After the server regenerates the server signing key, it can use the permission information to encrypt the server signing key, obtain the server signing key ciphertext, and store it. For example, the server signing key is encrypted and stored using the administrator PIN code.

[0124] In an optional embodiment of the present invention, the method may further include: recording the user information and the authority information according to the registration request sent by the historical client.

[0125] The historical client is the client when the user registers. The historical client sends a registration request, carrying user information and permission information. The server records the user information and permission information.

[0126] Step 102, sending the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key.

[0127] In the embodiment of the present invention, the server stores the regenerated server signature key. The current client sends the input permission information to the server, and the server verifies the permission information. If the verification is successful, the server generates feedback information, and then signs the feedback information according to the regenerated server signature key to obtain the server signature information. The server returns the client signature key, feedback information and server signature information to the current client.

[0128] In an optional embodiment of the present invention, a specific implementation method of sending the client signature key, feedback information and server signature information to the current client may include: using the user key in the user information or the permission information to encrypt the client signature key to obtain the client signature key ciphertext; sending the client signature key ciphertext, feedback information and server signature information to the current client.

[0129] When the server sends the client signature key to the current client, it needs to be encrypted and protected. The client signature key can be encrypted using the user key in the user information or the permission information to obtain the client signature key ciphertext. The client signature key ciphertext is then sent to the current client. Using permission information to encrypt and protect the client signature key ensures the security of the key, thereby improving security.

[0130] Step 103, receiving the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information.

[0131] In the embodiment of the present invention, the current client uses the regenerated client signature key to sign the feedback information to obtain the client signature information. Then, the overall signature information is synthesized based on the client signature information and the server signature information. Specifically, the same method as the historical client can be used to obtain the verifiable overall signature information.

[0132] Step 104: verify the overall signature information and send the identity authentication result to the current client.

[0133] In the embodiment of the present invention, since the overall signature information is generated based on the server signature key and the client signature key corresponding to the environment information and the user information, and the server stores the environment information and the user information of the current client and the historical client, the server can verify the overall signature information based on the environment information and the user information of the current client and the historical client. Other verifications may also be included, which are not limited in the embodiment of the present invention.

[0134] In an embodiment of the present invention, the current client can send the overall signature information to the server. The server can verify the overall signature information. After verification, the server sends the identity authentication result to the current client, so that the current client obtains the identity authentication result from the server.

[0135] The identity authentication result may be determined by the identity authentication including the verification result of the overall signature information. For example, if the verification result of the overall signature information is not passed, the identity authentication result is authentication failure, and if the verification result of the overall signature information is passed, the identity authentication result is authentication passed. In addition to whether the identity authentication result is passed, the identity authentication result may also include necessary information for participating in the business when the authentication is passed.

[0136] For example, Figure 1As shown, the current client (Zhangshangtong APP on mobile device B) collects device information, client information and user information on device B. The current client sends the collected information to the server. The server updates the device information that the user has logged in (including the environmental information of device A and device B). The server regenerates the signature key and then uses the threshold algorithm (2, 2) to perform cryptographic cutting to obtain server signature key 1ˋ and client signature key 2ˋ. The server updates the user's server signature key 1ˋ. The client signature key 2ˋ is sent to the current client. During identity authentication, the current client uses the client signature key 2ˋ to sign and obtain signature value fragment 2 (i.e., client signature information). The server uses the server signature key 1ˋ to sign and obtain signature value fragment 1 (i.e., server signature information), and sends it to the current client. The current client uses the threshold algorithm to synthesize the overall signature information. The overall signature information can be sent to the server for verification, thereby completing the identity authentication on the current client.

[0137] In an optional embodiment of the present invention, the verification of the overall signature information includes: generating an overall verification key based on the environmental information of the current client, the environmental information of the historical client and the user information; and using the overall verification key to verify the overall signature information.

[0138] After receiving the overall signature information each time, the server generates a signature key pair based on the stored current client environment information, historical client environment information and user information, including the entire experience signing key.

[0139] The entire signature information is then verified using the entire verification key. If the verification succeeds, the verification is successful; if the verification fails, the verification fails.

[0140] According to an embodiment of the present invention, after the permission information sent by the current client is verified, the server signature key and the client signature key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information, and the client signature key, feedback information and server signature information are sent to the current client, wherein the server signature information is obtained by the server signing the feedback information according to the server signature key, and the overall signature information sent by the current client is received, wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information, the overall signature information is verified, and the identity authentication result is sent to the current client, so that by introducing the permission control of regenerating the key used for signing, the key related to the environment information is safely regenerated for the new client, and the transmission or storage of the overall signature key is avoided, which brings risks to the key leakage. Even if the synchronized part of the key is leaked, the user can realize the need of identity authentication on different clients, and at the same time ensure the security and reliability of the identity authentication.

[0141] Reference Figure 3 , shows a flowchart of an identity authentication method embodiment of the present invention, which is applied to the current client. The method may specifically include the following steps:

[0142] Step 201, during the identity authentication process, obtain the client signature key, feedback information and server signature information from the server according to the input permission information; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client's environmental information, historical client's environmental information and user information.

[0143] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0144] In an optional embodiment of the present invention, in a specific implementation method of obtaining the client signing key from the server, the client signing key ciphertext returned by the server is received; the client signing key ciphertext is decrypted using the user key in the user information or the permission information to obtain the client signing key.

[0145] The specific implementation method of this step can be found in the description of the above embodiment and will not be repeated here.

[0146] In an optional embodiment of the present invention, before obtaining the client signing key, feedback information and server signing information from the server according to the input permission information, it may also include: sending an identity authentication request to the server according to the user information and the environmental information of the current client; receiving the permission information verification request sent by the server when the user information is verified and it is determined that the current client is not among the historical clients.

[0147] The specific implementation method of this step can be found in the description of the above embodiment and will not be repeated here.

[0148] Step 202: determine the overall signature information according to the client signature key, the feedback information and the server signature information.

[0149] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0150] In an optional embodiment of the present invention, a specific implementation method of determining the overall signature information based on the client signature key, the feedback information and the server signature information may include: using the client signature key to sign the feedback information to obtain the client signature information; and synthesizing the overall signature information based on the client signature information and the server signature information.

[0151] The specific implementation method of this step can be found in the description of the above embodiment and will not be repeated here.

[0152] Step 203: Obtain an identity authentication result from the server according to the overall signature information.

[0153] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0154] For example, Figure 4Schematic diagram of the identity authentication process of the client and server shown in FIG. In the process of device A user registration application key and identity authentication, the user of the historical client (i.e., the Vision Network Palm APP mobile terminal on device A) applies for user registration and sets the user's unique identifier, user PIN code, administrator PIN code (i.e., permission information) and other information. The server (i.e., the Vision Network Palm APP server) reviews the registered information, and after the review is passed, records the user information and assigns the user a unique identifier oid. The server returns a successful registration feedback to the client. The historical client collects the device information, APP information (i.e., client information), and user information on device A. The historical client sends the collected information to the server. The server stores the information collected by the historical client, and generates an overall signature key based on this information, and then uses the threshold algorithm to split the overall signature key to obtain the server signature key fragment (i.e., the server signature key) and the mobile signature key fragment (i.e., the client signature key). The server uses the administrator PIN code to encrypt the storage server signature key fragment, and sends the mobile signature key fragment to the historical client. The historical client uses the user PIN code to encrypt and store the mobile signature key fragment. The historical client sends an identity authentication request to the server. After receiving user information such as user name and user PIN code, device information and other environmental information, the server verifies the user information and environmental information. After the verification is passed, a random number is generated, and then the server signature key fragment is used to sign the random number to obtain the server signature information, and the random number and server signature information are returned to the historical client. The historical client uses the mobile signature key fragment to sign the random number to obtain the client signature information. Then, the threshold signature technology is used to combine each signature value into a complete signature value, that is, the overall signature information. The overall signature value (that is, the overall signature information) is sent to the server. The server verifies the overall signature information based on the entire experience signature key and returns the identity authentication result to the historical client. In the process of user identity authentication of device B, the current client (that is, the Visual Network Palm APP mobile terminal on device B) collects device information, APP information (that is, client information), and user information on device A. The current client sends an identity authentication request to the server. After the server receives the device information and other environmental information, user name, user PIN code and other user information carried in the identity authentication request, it verifies the user information and detects that the user has registered and logged in on other devices, and sends a request to verify the administrator PIN code to the current client. The current client sends the administrator PIN code to the server. The server verifies the administrator PIN code. After the verification is passed, it updates the device-related information (environmental information), regenerates the overall signature key based on the updated environmental information and user information, and then uses the threshold algorithm to split the overall signature key to obtain the server signature key fragment (i.e., the server signature key) and the mobile signature key fragment (i.e., the client signature key). The server uses the administrator PIN code to encrypt the storage service client signature key fragment.The server generates a random number, and then signs the random number with the server signature key fragment to obtain the server signature information. The server returns the ciphertext of the mobile signature key fragment, the random number, and the server signature information to the current client. The current client signs the random number with the mobile signature key fragment to obtain the client signature information. Then, using the threshold signature technology, each signature value is combined into a complete signature value, that is, the overall signature information. The overall signature value (that is, the overall signature information) is sent to the server. The server verifies the overall signature information based on the entire experience key and returns the identity authentication result to the current client.

[0155] According to an embodiment of the present invention, during the identity authentication process, according to the input permission information, the client signature key, feedback information and server signature information are obtained from the server; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the environment information of the current client, the environment information of the historical client and the user information; the overall signature information is determined according to the client signature key, the feedback information and the server signature information; according to the overall signature information, the identity authentication result is obtained from the server, so that by introducing the permission control for regenerating the key used for signing, the key related to the environment information is safely regenerated for the new client, and the transmission or storage of the overall signature key is avoided, which brings the risk of key leakage. Even if part of the synchronized keys are leaked, the user's need for identity authentication on different clients is realized, while ensuring the security and reliability of identity authentication.

[0156] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0157] Reference Figure 5 The following is a structural block diagram of an embodiment of an identity authentication device of the present invention, which is applied to a server and may specifically include the following modules:

[0158] The key regeneration module 301 is used to regenerate the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information after the permission information sent by the current client is verified;

[0159] An information sending module 302 is used to send the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key;

[0160] The information receiving module 303 is used to receive the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information;

[0161] The verification module 304 is used to verify the overall signature information and send the identity authentication result to the current client.

[0162] Optionally, the device further comprises:

[0163] A verification module, configured to, after the permission information sent by the current client is verified, respond to the identity authentication request of the current client and determine whether the user information carried in the identity authentication request is verified before regenerating the server signature key and the client signature key according to the environment information of the current client, the environment information of the historical client and the user information;

[0164] A login determination module, used to determine that the user has logged in on another device based on the environment information carried in the identity authentication request and the environment information of the historical client;

[0165] The request sending module is used to send a permission information verification request to the current client.

[0166] Optionally, the key regeneration module includes:

[0167] A key pair generation submodule, used to regenerate a signature key pair according to the current client environment information, the historical client environment information and the user information; wherein the signature key pair includes an overall signature key and an overall experience signing key;

[0168] The key splitting submodule is used to split the overall signing key to obtain a server signing key and a client signing key.

[0169] Optionally, the device further comprises:

[0170] The encryption storage module is used to encrypt the server signature key using the permission information to obtain the server signature key ciphertext and store it.

[0171] Optionally, the information sending module includes:

[0172] An encryption submodule, used to encrypt the client signature key using the user key in the user information or the authority information to obtain a client signature key ciphertext;

[0173] The sending submodule is used to send the client signature key ciphertext, feedback information and server signature information to the current client.

[0174] Optionally, the verification module includes:

[0175] A signature verification key generation submodule, used to generate a whole signature verification key according to the current client environment information, the historical client environment information and the user information;

[0176] The signature verification submodule is used to verify the overall signature information using the overall signature verification key.

[0177] Optionally, the device further comprises:

[0178] The information recording module is used to record the user information and the authority information according to the registration request sent by the historical client.

[0179] According to an embodiment of the present invention, after the permission information sent by the current client is verified, the server signature key and the client signature key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information, and the client signature key, feedback information and server signature information are sent to the current client, wherein the server signature information is obtained by the server signing the feedback information according to the server signature key, and the overall signature information sent by the current client is received, wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information, the overall signature information is verified, and the identity authentication result is sent to the current client, so that by introducing the permission control of regenerating the key used for signing, the key related to the environment information is safely regenerated for the new client, and the transmission or storage of the overall signature key is avoided, which brings risks to the key leakage. Even if the synchronized part of the key is leaked, the user can realize the need of identity authentication on different clients, and at the same time ensure the security and reliability of the identity authentication.

[0180] Reference Figure 6 The structural block diagram of another embodiment of the identity authentication device of the present invention is shown, which is applied to the current client and may specifically include the following modules:

[0181] The information acquisition module 401 is used to acquire the client signature key, feedback information and server signature information from the server according to the input permission information during the identity authentication process; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client environment information, the historical client environment information and the user information;

[0182] An information determination module 402 is used to determine the overall signature information according to the client signature key, the feedback information and the server signature information;

[0183] The result acquisition module 403 is used to obtain the identity authentication result from the server according to the overall signature information.

[0184] Optionally, the information determination module includes:

[0185] The signature submodule is used to sign the feedback information using the client signature key to obtain client signature information;

[0186] The synthesis submodule is used to synthesize the client signature information and the server signature information into overall signature information.

[0187] Optionally, the information acquisition module includes:

[0188] The ciphertext receiving submodule is used to receive the client signature key ciphertext returned by the server;

[0189] The decryption submodule is used to use the user key in the user information or the permission information to decrypt the client signature key ciphertext to obtain the client signature key.

[0190] Optionally, the device further comprises:

[0191] A request sending module, used to send an identity authentication request to the server according to user information and environment information of the current client before obtaining the client signing key, feedback information and server signing information from the server according to the input permission information;

[0192] The request receiving module is used to receive the permission information verification request sent by the server when the user information verification is passed and it is determined that the current client is not among the historical clients.

[0193] According to an embodiment of the present invention, during the identity authentication process, according to the input permission information, the client signature key, feedback information and server signature information are obtained from the server; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the environment information of the current client, the environment information of the historical client and the user information; the overall signature information is determined according to the client signature key, the feedback information and the server signature information; according to the overall signature information, the identity authentication result is obtained from the server, so that by introducing the permission control for regenerating the key used for signing, the key related to the environment information is safely regenerated for the new client, and the transmission or storage of the overall signature key is avoided, which brings the risk of key leakage. Even if part of the synchronized keys are leaked, the user's need for identity authentication on different clients is realized, while ensuring the security and reliability of identity authentication.

[0194] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0195] Figure 7 1 is a block diagram of an electronic device 600 for identity authentication according to an exemplary embodiment. For example, the electronic device 600 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0196] Reference Figure 7 , the electronic device 600 may include one or more of the following components: a processing component 602 , a memory 604 , a power component 606 , a multimedia component 608 , an audio component 610 , an input / output (I / O) interface 612 , a sensor component 614 , and a communication component 616 .

[0197] The processing component 602 generally controls the overall operation of the electronic device 600, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 602 may include one or more processors 620 to execute instructions to complete all or part of the steps of the above-mentioned identity authentication. In addition, the processing component 602 may include one or more modules to facilitate the interaction between the processing component 602 and other components. For example, the processing component 602 may include a multimedia module to facilitate the interaction between the multimedia component 608 and the processing component 602.

[0198] The memory 604 is configured to store various types of data to support operations on the electronic device 600. Examples of such data include instructions for any application or method operating on the electronic device 600, contact data, phone book data, messages, pictures, videos, etc. The memory 604 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0199] The power supply component 606 provides power to the various components of the electronic device 600. The power supply component 606 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 600.

[0200] The multimedia component 608 includes a screen that provides an output interface between the electronic device 600 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 608 includes a front camera and / or a rear camera. When the electronic device 600 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0201] The audio component 610 is configured to output and / or input audio signals. For example, the audio component 610 includes a microphone (MIC), and when the electronic device 600 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 604 or sent via the communication component 616. In some embodiments, the audio component 610 also includes a speaker for outputting audio signals.

[0202] I / O interface 612 provides an interface between processing component 602 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0203] The sensor assembly 614 includes one or more sensors for providing various aspects of status assessment for the electronic device 600. For example, the sensor assembly 614 can detect the open / closed state of the electronic device 600, the relative positioning of the components, such as the display and keypad of the electronic device 600, and the sensor assembly 614 can also detect the position change of the electronic device 600 or a component of the electronic device 600, the presence or absence of contact between the user and the electronic device 600, the orientation or acceleration / deceleration of the electronic device 600, and the temperature change of the electronic device 600. The sensor assembly 614 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 614 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 614 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0204] The communication component 616 is configured to facilitate wired or wireless communication between the electronic device 600 and other devices. The electronic device 600 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 616 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 616 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0205] In an exemplary embodiment, the electronic device 600 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above-mentioned shutdown control method.

[0206] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 604 including instructions, and the instructions can be executed by a processor 620 of an electronic device 600 to complete the above-mentioned shutdown control method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0207] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables a server to execute an identity authentication method, applied to a server, the method comprising:

[0208] In the identity authentication process, according to the input permission information, the client signature key, feedback information and server signature information are obtained from the server; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client environment information, the historical client environment information and the user information;

[0209] Determine the overall signature information according to the client signature key, the feedback information and the server signature information;

[0210] According to the overall signature information, an identity authentication result is obtained from the server.

[0211] Optionally, determining overall signature information according to the client signature key, the feedback information and the server signature information includes:

[0212] Using the client signature key, signing the feedback information to obtain client signature information;

[0213] The client signature information and the server signature information are combined into overall signature information.

[0214] Optionally, obtaining the client signing key from the server includes:

[0215] Receive the client signature key ciphertext returned by the server;

[0216] The client signing key ciphertext is decrypted using the user key in the user information or the authority information to obtain the client signing key.

[0217] Optionally, before obtaining the client signing key, feedback information and server signing information from the server according to the input permission information, the method further includes:

[0218] Sending an identity authentication request to the server according to the user information and the environment information of the current client;

[0219] A permission information verification request sent by the server is received when the user information verification passes and it is determined that the current client is not among the historical clients.

[0220] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables a server to execute an identity authentication method, applied to a current client, the method comprising:

[0221] After the permission information sent by the current client is verified, the server signing key and the client signing key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information;

[0222] Sending the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key;

[0223] Receiving the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information;

[0224] The overall signature information is verified, and an identity authentication result is sent to the current client.

[0225] Optionally, after the permission information sent by the current client is verified, before regenerating the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information, the method further includes:

[0226] In response to the identity authentication request of the current client, determining that the user information carried in the identity authentication request has been verified;

[0227] Determine that the user has logged in on another device based on the environment information carried in the identity authentication request and the environment information of the historical client;

[0228] Sending a permission information verification request to the current client.

[0229] Optionally, the regenerating the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information includes:

[0230] Regenerate a signature key pair according to the current client environment information, the historical client environment information and the user information; wherein the signature key pair includes an overall signature key and an overall experience signature key;

[0231] The overall signature key is split to obtain a server-side signature key and a client-side signature key.

[0232] Optionally, the method further comprises:

[0233] The server signing key is encrypted using the permission information to obtain a ciphertext of the server signing key and store it.

[0234] Optionally, sending the client signing key, feedback information, and server signing information to the current client includes:

[0235] Using the user key in the user information or the permission information, encrypting the client signature key to obtain a client signature key ciphertext;

[0236] The client signature key ciphertext, feedback information and server signature information are sent to the current client.

[0237] Optionally, the verifying the overall signature information includes:

[0238] Generate a whole experience signing key according to the current client environment information, historical client environment information and user information;

[0239] The entire signature information is verified using the entire verification key.

[0240] Optionally, the method further comprises:

[0241] According to the registration request sent by the historical client, the user information and the authority information are recorded.

[0242] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0243] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0244] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0245] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0246] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0247] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0248] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0249] The identity authentication method and identity authentication device provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. An identity authentication method, characterized in that: Applied to the server, the method includes: After the permission information sent by the current client is verified, the server signing key and the client signing key are regenerated according to the environment information of the current client, the environment information of the historical client and the user information; Sending the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key; Receiving the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information; The overall signature information is verified, and an identity authentication result is sent to the current client.

2. The method according to claim 1, characterized in that After the permission information sent by the current client is verified, before regenerating the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information, the method further includes: In response to the identity authentication request of the current client, determining that the user information carried in the identity authentication request has been verified; Determine that the user has logged in on another device based on the environment information carried in the identity authentication request and the environment information of the historical client; Sending a permission information verification request to the current client.

3. The method according to claim 1, characterized in that The regenerating the server signing key and the client signing key according to the current client environment information, the historical client environment information and the user information includes: Regenerate a signature key pair according to the current client environment information, the historical client environment information and the user information; wherein the signature key pair includes an overall signature key and an overall experience signature key; The overall signature key is split to obtain a server-side signature key and a client-side signature key.

4. The method according to claim 1, characterized in that: The sending the client signature key, feedback information and server signature information to the current client includes: Using the user key in the user information or the permission information, encrypting the client signature key to obtain a client signature key ciphertext; The client signature key ciphertext, feedback information and server signature information are sent to the current client.

5. The method according to claim 1, characterized in that: The verifying the overall signature information includes: Generate a whole experience signing key according to the current client environment information, historical client environment information and user information; The overall signature information is verified using the entire verification key.

6. An identity authentication method, characterized in that: Applied to the current client, the method includes: In the identity authentication process, according to the input permission information, the client signature key, feedback information and server signature information are obtained from the server; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client environment information, the historical client environment information and the user information; Determine the overall signature information according to the client signature key, the feedback information and the server signature information; According to the overall signature information, an identity authentication result is obtained from the server.

7. An identity authentication device, characterized in that: Applied to the server, the device comprises: A key regeneration module is used to regenerate the server signing key and the client signing key according to the environment information of the current client, the environment information of the historical client and the user information after the permission information sent by the current client is verified; An information sending module, used to send the client signature key, feedback information and server signature information to the current client; wherein the server signature information is obtained by the server signing the feedback information according to the server signature key; An information receiving module, used to receive the overall signature information sent by the current client; wherein the overall signature information is determined by the current client according to the client signature key, the feedback information and the server signature information; The verification module is used to verify the overall signature information and send the identity authentication result to the current client.

8. An identity authentication device, characterized in that: Applied to the current client, the device includes: An information acquisition module is used to acquire the client signature key, feedback information and server signature information from the server according to the input permission information during the identity authentication process; wherein the server signature information is obtained by signing the feedback information using the server signature key, and the client signature key and the server signature key are regenerated by the server according to the current client environment information, the historical client environment information and the user information; An information determination module, used to determine the overall signature information according to the client signature key, the feedback information and the server signature information; The result acquisition module is used to obtain the identity authentication result from the server according to the overall signature information.

9. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the apparatus to perform the method of any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the method according to any one of claims 1 to 6.

Images