Identity authentication method and device during service participation, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an identity authentication method and device during service participation, equipment and a medium. The method comprises the steps of determining aggregation signature information according to authentication feedback information returned by a server side and a private key set issued by the server side in advance, determining an aggregation public key according to local information obtained in real time, obtaining necessary information for participating in a service from the server side according to the aggregation signature information and the aggregation public key, and sending the necessary information to the server side. Through acquiring local information in real time, calculating and generating the corresponding aggregation public key, verifying the aggregation signature information, and combining identity authentication with the local information, the authenticity of the user identity is guaranteed, management links such as certificate application, signing and issuing, storage and the like are reduced, the storage space of the client is saved, and the identity authentication process is simplified.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an identity authentication method when participating in a business, an identity authentication device when participating in a business, an electronic device, and a computer-readable storage medium. Background Art

[0002] The VisionLink Palm APP (application) can make real-time audio and video calls with the VisionLink network through 4G (fourth-generation mobile communication technology) or WIFI (wireless network), and can view national monitoring data on the mobile terminal. It enables grid workers and other personnel to report an alarm at any time with one click and link the callback function with the GIS (Geographic Information System) platform. The map trajectory can be viewed on the APP terminal, and functions such as alarm reception, alarm transfer, reporting and callback can be realized on the mobile APP, achieving flexible application of mobile alarm.

[0003] With the rapid development of video networking services, there is an increasing demand for using the mobile app to participate in video networking conferences, monitoring and other services. Currently, to participate in conference services, users of the app only need to know the conference room number and the corresponding conference password to join the conference directly. There is a lack of personnel identity authentication process and it is unable to prevent identity forgery. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide an identity authentication method when participating in a service, a corresponding identity authentication device when participating in a service, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses an identity authentication method for participating in a service, which is applied to a client, and the method includes:

[0006] Determine the aggregate signature information based on the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0007] Determine the aggregated public key based on the local information obtained in real time;

[0008] According to the aggregate signature information and the aggregate public key, necessary information for participating in the service is obtained from the server.

[0009] Optionally, the private key set includes at least two of the following: a device private key, a client private key and a user private key; correspondingly, the local information includes at least two of the following: device information, client information and user information.

[0010] Optionally, determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server includes:

[0011] Using the device private key, the client private key and the user private key respectively, the authentication feedback information is signed to obtain corresponding signature information;

[0012] The aggregated signature information is aggregated according to each signature information.

[0013] Optionally, determining the aggregated public key according to the local information acquired in real time includes:

[0014] Determine a device public key, a client public key, and a user public key according to the device information, the client information, and the user information acquired in real time;

[0015] The aggregate public key is aggregated according to the device public key, the client public key and the user public key.

[0016] Optionally, before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server, the method further includes:

[0017] According to the user identity authentication information obtained in real time, the stored ciphertext private key set is decrypted to obtain the private key set.

[0018] Optionally, the user identity authentication information includes a user name and a user password, and decrypting the stored ciphertext private key set according to the user identity authentication information acquired in real time to obtain the private key set includes:

[0019] The stored ciphertext device private key, ciphertext client private key and ciphertext user private key are decrypted using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively to obtain the device private key, the client private key and the user private key.

[0020] Optionally, before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server, the method further includes:

[0021] Determine the public key set based on the acquired local information;

[0022] According to the public key set, requesting the private key set from the server;

[0023] Receive the private key set returned by the server.

[0024] Optionally, the private key set includes: a device private key, a client private key and a user private key; and the receiving the private key set returned by the server includes:

[0025] Receive the private key set encrypted with the user password returned by the server;

[0026] Decrypt the user password to obtain the device private key, the client private key and the user private key;

[0027] The device private key, the client private key and the user private key are encrypted using the hash value of the user name, the hash value of the user password and the hash value of the user name and the user password respectively to obtain a ciphertext device private key, a ciphertext client private key and a ciphertext user private key, and store them.

[0028] The embodiment of the present invention also discloses an identity authentication method for participating in a service, which is applied to a server, and the method includes:

[0029] In response to a private key set request sent by a client, obtaining a private key set corresponding to the public key set according to the public key set carried in the private key set request, and sending the private key set to the client;

[0030] Aggregating the public key set into an aggregated public key and storing the aggregated public key;

[0031] Receiving the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregate public key is determined by the client according to the local information obtained in real time;

[0032] The aggregate signature information and the aggregate public key are verified, and after the verification is passed, necessary information for participating in the service is sent to the client.

[0033] Optionally, the verifying the aggregate signature information and the aggregate public key includes:

[0034] Comparing the aggregated public key with the stored aggregated public key to see if they are consistent;

[0035] When the aggregate public key is consistent with the stored aggregate public key, the aggregate signature information is verified using the aggregate public key.

[0036] Optionally, acquiring, according to the public key set carried in the private key set request, a private key set corresponding to the public key set includes:

[0037] Sending the public key set and the unique user identifier of the client to a key system;

[0038] The user unique identifier is used to decrypt the ciphertext public and private key pair set returned by the key system to obtain a private key set and a public key set.

[0039] The embodiment of the present invention further discloses an identity authentication device for participating in a service, which is applied to a client, and the device includes:

[0040] An information determination module, used to determine the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0041] A public key determination module, used to determine the aggregated public key based on local information obtained in real time;

[0042] The information acquisition module is used to obtain necessary information for participating in the business from the server according to the aggregate signature information and the aggregate public key.

[0043] Optionally, the private key set includes at least two of the following: a device private key, a client private key and a user private key; correspondingly, the local information includes at least two of the following: device information, client information and user information.

[0044] Optionally, the information determination module includes:

[0045] The signature submodule is used to sign the authentication feedback information using the device private key, the client private key and the user private key respectively to obtain corresponding signature information;

[0046] The information aggregation submodule is used to aggregate the signature information into the aggregate signature information.

[0047] Optionally, the public key determination module includes:

[0048] A public key determination submodule, used to determine a device public key, a client public key and a user public key according to the device information, the client information and the user information acquired in real time;

[0049] The public key aggregation submodule is used to aggregate the device public key, the client public key and the user public key into the aggregated public key.

[0050] Optionally, the device further comprises:

[0051] The decryption module is used to decrypt the stored ciphertext private key set according to the user identity authentication information obtained in real time before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server to obtain the private key set.

[0052] Optionally, the user identity authentication information includes a user name and a user password, and the decryption module includes:

[0053] The decryption submodule is used to decrypt the stored ciphertext device private key, ciphertext client private key and ciphertext user private key using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively to obtain the device private key, the client private key and the user private key.

[0054] Optionally, the device further comprises:

[0055] A public key determination module, used to determine a public key set according to the acquired local information before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0056] A private key request module, used to request the private key set from the server according to the public key set;

[0057] The private key receiving module is used to receive the private key set returned by the server.

[0058] Optionally, the private key set includes: a device private key, a client private key and a user private key; and the private key receiving module includes:

[0059] A receiving submodule, used for receiving the private key set encrypted with the user password returned by the server;

[0060] The private key decryption submodule is used to decrypt the user password to obtain the device private key, the client private key and the user private key;

[0061] The encryption submodule is used to encrypt the device private key, the client private key and the user private key using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively, to obtain the ciphertext device private key, the ciphertext client private key and the ciphertext user private key, and store them.

[0062] The embodiment of the present invention also discloses an identity authentication device for participating in a service, which is applied to a service end, and the device includes:

[0063] The private key issuing module is used to respond to the private key set request sent by the client, obtain the private key set corresponding to the public key set according to the public key set carried in the private key set request, and issue it to the client;

[0064] A public key aggregation module, used to aggregate the public key set into an aggregated public key and store it;

[0065] An information receiving module, used to receive the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregate public key is determined by the client according to the local information obtained in real time;

[0066] The information sending module is used to verify the aggregate signature information and the aggregate public key, and after the verification is passed, send the necessary information for participating in the service to the client.

[0067] Optionally, the information sending module includes:

[0068] A comparison submodule, used to compare whether the aggregated public key is consistent with the stored aggregated public key;

[0069] The signature verification submodule is used to verify the aggregate signature information using the aggregate public key when the aggregate public key is consistent with the stored aggregate public key.

[0070] Optionally, the private key issuing module includes:

[0071] A public key sending submodule, used for sending the public key set and the unique user identifier of the client to a key system;

[0072] The decryption submodule is used to decrypt the ciphertext public and private key pair set returned by the key system using the user unique identifier to obtain a private key set and a public key set.

[0073] The embodiment of the present invention further discloses an electronic device, including:

[0074] one or more processors; and

[0075] One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the apparatus to perform any of the methods described above.

[0076] The embodiment of the present invention further discloses a computer-readable storage medium, wherein a computer program stored in the storage medium enables a processor to execute any of the methods described above.

[0077] According to an embodiment of the present invention, the aggregate signature information is determined based on the authentication feedback information returned by the server and the private key set pre-issued by the server, and the aggregate public key is determined based on the local information obtained in real time. According to the aggregate signature information and the aggregate public key, the necessary information for participating in the business is obtained from the server, so that the corresponding aggregate public key is calculated and generated by real-time acquisition of local information for verification of the aggregate signature information, and identity authentication is combined with local information to ensure the authenticity of the user's identity, reduce management links such as certificate application, issuance, and storage, save client storage space, and simplify the identity authentication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 It is a flowchart of steps of an embodiment of an identity authentication method for participating in a service of the present invention;

[0079] Figure 2 It is a schematic diagram of the principle of the aggregate signature algorithm;

[0080] Figure 3 It is a flowchart of steps of an embodiment of an identity authentication method for participating in a service of the present invention;

[0081] Figure 4 This is a schematic diagram of the identity authentication process when the client and server participate in the business;

[0082] Figure 5 It is a structural block diagram of an embodiment of an identity authentication device for participating in a service of the present invention;

[0083] Figure 6 It is a structural block diagram of an embodiment of an identity authentication device for participating in a service of the present invention;

[0084] Figure 7 The present invention is a structural block diagram of an electronic device for identity authentication when participating in a service according to an exemplary embodiment. DETAILED DESCRIPTION

[0085] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0086] Reference Figure 1 , shows a flowchart of an embodiment of an identity authentication method for participating in a service of the present invention, which is applied to a client. The method may specifically include the following steps:

[0087] Step 101: The client determines the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0088] In the embodiment of the present invention, the service includes video calling, video conferencing, monitoring, etc., or any other applicable service, which is not limited by the embodiment of the present invention.

[0089] In the embodiment of the present invention, the client needs to perform identity authentication before participating in the service. After the client sends an identity authentication request to the server, the server authenticates the information carried in the identity authentication request. After the authentication is passed, the server sends authentication feedback information to the client. The authentication feedback information can be a random number generated by the server, or any other applicable information, which is not limited in the embodiment of the present invention.

[0090] For example, the client sends an identity authentication request to the server, which carries user information such as the user name and the user PIN (Personal Identification Number) code. The server verifies the user information and generates a random number after the verification is passed.

[0091] In the embodiment of the present invention, the server sends a private key set to the client in advance, and the client stores the private key set securely. The private key set refers to a set consisting of multiple private keys.

[0092] In the embodiment of the present invention, before participating in the service, the client needs to first send a private key set request to the server using local information as a public key set. The private key set request carries a public key set, and the server responds to the private key set request and obtains the corresponding private key set according to the public key set. The public key set refers to a set consisting of multiple public keys.

[0093] In an optional embodiment of the present invention, before determining the aggregate signature information based on the authentication feedback information returned by the server and the private key set pre-issued by the server, it may also include: determining the public key set based on the acquired local information; requesting the private key set from the server based on the public key set; and receiving the private key set returned by the server.

[0094] In an embodiment of the present invention, the server determines the corresponding private key set according to the public key set. For example, an encryption algorithm such as the SM9 algorithm can be used to calculate the private keys corresponding to multiple public keys to obtain the private key set. After obtaining the private key set, the server sends the private key set to the client.

[0095] For example, the client collects device information, client information, and user information as three SM9 public keys, and then calls the server interface. The server obtains the SM9 private key corresponding to the public key through the KGC (Key Generation Center) and sends it to the client.

[0096] In an optional embodiment of the present invention, the private key set includes at least two of the following: a device private key, a client private key and a user private key; correspondingly, the local information includes at least two of the following: device information, client information and user information.

[0097] Device information refers to the relevant information of the device where the client is located, such as MAC (Media Access Control Address), hardware unique code, etc. Any applicable information can be used, and the embodiment of the present invention does not limit this. The string corresponding to the device information is used as the public key, which is recorded as the device public key.

[0098] The client information refers to the relevant information of the client, for example, the authorization code issued by the server to the client, and any applicable information may be used, and the embodiment of the present invention does not limit this. The string corresponding to the client information is used as the public key, which is recorded as the client public key.

[0099] User information refers to user-related information, such as user name, user password, etc. Any applicable information may be used, and the embodiment of the present invention does not limit this. The string corresponding to the user information is used as the public key, which is recorded as the user public key.

[0100] According to the device public key, the corresponding private key can be obtained, which is recorded as the device private key. According to the client public key, the corresponding private key can be obtained, which is recorded as the client private key. According to the user public key, the corresponding private key can be obtained, which is recorded as the user private key.

[0101] Combining user identity authentication with device information, client information, and user information ensures the authenticity of user identity in multiple dimensions and improves the security of identity authentication.

[0102] In the embodiment of the present invention, the client uses the private key set to sign the corresponding authentication feedback information to obtain signature information, which is recorded as aggregate signature information. Figure 2 The schematic diagram of the principle of the aggregate signature algorithm shown in the figure, the client (Zhangshangtong APP) collects device information (mobile device information 1), client information (Zhangshangtong APP information 2), user information (user information 3), as the public key, and obtains the corresponding private key fragment (i.e. private key set) through KGC. The client then uses the private key fragment to sign the random number returned by the server (Zhangshangtong APP server), and obtains private key signature fragment 1, private key signature fragment 2 and private key signature fragment 3, and then generates complete signature information, i.e. aggregate signature information, through the aggregate signature algorithm.

[0103] Among them, aggregate signature is an efficient digital signature scheme that allows multiple signatures to be merged into a single signature, thereby reducing verification costs and increasing transaction processing speed.

[0104] Step 102: The client determines the aggregated public key based on the local information obtained in real time.

[0105] In the embodiment of the present invention, during the identity authentication process, the client obtains local information in real time and determines the corresponding aggregated public key based on the local information. Specifically, various local information are used as corresponding public keys respectively, and then multiple public keys are combined through the aggregate signature technology to obtain the aggregated public key.

[0106] Step 103: The client obtains necessary information for participating in the service from the server according to the aggregate signature information and the aggregate public key.

[0107] In an embodiment of the present invention, the client sends the aggregate signature information and the aggregate public key to the server. The server can verify the aggregate signature information and the aggregate public key. After the verification is passed, the server sends the necessary information for participating in the service to the client, so that the client obtains the necessary information from the server.

[0108] The necessary information for participating in the service refers to the information necessary for the client to participate in the service, such as the conference room number and conference password in a video conference, and may include any applicable information according to actual conditions, and the embodiment of the present invention does not impose any limitation on this.

[0109] In the embodiment of the present invention, since the aggregated signature information is generated based on the private key set corresponding to the local information, and the aggregated public key is generated based on the public key set corresponding to the local information, the public key in the public key set and the corresponding private key in the private key set are a public-private key pair. Therefore, the server can verify the aggregated signature information based on the aggregated public key. Specifically, other verifications may also be included. For example, the server can compare whether the aggregated public key is consistent with the aggregated public key stored by the server, which is not limited in the embodiment of the present invention.

[0110] According to an embodiment of the present invention, the aggregate signature information is determined based on the authentication feedback information returned by the server and the private key set pre-issued by the server, and the aggregate public key is determined based on the local information obtained in real time. According to the aggregate signature information and the aggregate public key, the necessary information for participating in the business is obtained from the server, so that the corresponding aggregate public key is calculated and generated by real-time acquisition of local information for verification of the aggregate signature information, and identity authentication is combined with local information to ensure the authenticity of the user's identity, reduce management links such as certificate application, issuance, and storage, save client storage space, and simplify the identity authentication process.

[0111] In an optional embodiment of the present invention, a specific implementation method of determining the aggregate signature information based on the authentication feedback information returned by the server and the private key set pre-issued by the server may include: using the device private key, the client private key and the user private key to sign the authentication feedback information respectively to obtain corresponding signature information; and aggregating the aggregate signature information based on each signature information.

[0112] The client uses the device private key, client private key and user private key respectively to sign the authentication feedback information to obtain corresponding signature information, which can be device signature information, client signature information and user signature information.

[0113] The client then calls the aggregate signature technology based on the signature information to aggregate them into a complete signature value, namely the aggregate signature information.

[0114] In an optional embodiment of the present invention, a specific implementation method of determining an aggregate public key based on local information obtained in real time may include: determining the device public key, the client public key and the user public key based on the device information, the client information and the user information obtained in real time; and aggregating the device public key, the client public key and the user public key into the aggregate public key.

[0115] The client obtains device information, client information and user information in real time. According to the device information, client information and user information, the corresponding device public key, client public key and user public key are determined. For example, the string of device information is used as the device public key, the string of client information is used as the client public key, and the string of user information is used as the user public key.

[0116] The client calls the aggregate signature technology to aggregate the device public key, client public key and user public key into an aggregate public key.

[0117] In an optional embodiment of the present invention, before determining the aggregate signature information based on the authentication feedback information returned by the server and the private key set pre-issued by the server, it may also include: decrypting the stored ciphertext private key set based on the user identity authentication information obtained in real time to obtain the private key set.

[0118] The private key set needs to be encrypted and protected on the client. The private key set is encrypted to obtain a ciphertext private key set. The ciphertext private key set is stored on the client. The key of the ciphertext private key set can be determined based on the user identity authentication information obtained by the client in real time. The user identity authentication information refers to the information used by the client for user identity authentication, such as a user name and a user password, or any other applicable information, which is not limited in the embodiments of the present invention.

[0119] The client determines the encryption key and the decryption key based on the user identity authentication information obtained in real time. For example, the user name and the user password are concatenated together as the key. The key can be determined in any applicable manner, and the embodiment of the present invention does not limit this.

[0120] During the identity authentication stage, if the user identity authentication information is inconsistent with the user identity authentication information when the private key set is stored, the private key set cannot be decrypted, and then the aggregate signature information cannot be synthesized, thus ensuring the security of identity authentication.

[0121] In an optional embodiment of the present invention, the user identity authentication information includes a user name and a user password. According to the user identity authentication information obtained in real time, a stored ciphertext private key set is decrypted to obtain the private key set. A specific implementation method may include: using the hash value of the user name, the hash value of the user password, and the hash value of the user name and user password respectively to decrypt the stored ciphertext device private key, ciphertext client private key, and ciphertext user private key to obtain the device private key, client private key, and user private key.

[0122] The device private key, client private key and user private key are encrypted to generate the ciphertext device private key, ciphertext client private key and ciphertext user private key. Three different hash values ​​are used as keys, namely the hash value of the user name, the hash value of the user password and the hash value of the user name and user password. When decrypting again, the user name and user password are obtained again in real time. Then the three hash values ​​are calculated as the decryption key to decrypt the ciphertext device private key, ciphertext client private key and ciphertext user private key, thereby obtaining the device private key, client private key and user private key.

[0123] The three private keys are encrypted and protected with different keys and stored on the client. During identity authentication, the correct user name and password must be entered for successful decryption, which increases the difficulty of cracking the private key and improves the security of the private key collection.

[0124] In an optional embodiment of the present invention, the private key set includes: a device private key, a client private key and a user private key. In a specific implementation method of receiving the private key set returned by the server, it may include: receiving the private key set returned by the server and encrypted with the user password; decrypting with the user password to obtain the device private key, the client private key and the user private key; encrypting the device private key, the client private key and the user private key using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively to obtain the ciphertext device private key, the ciphertext client private key and the ciphertext user private key, and storing them.

[0125] The server can use the user password to encrypt the private key set and then return the private key set to the client. The client uses the user password to decrypt to obtain the device private key, client private key and user private key, thus ensuring the security of the private key set transmission process.

[0126] Reference Figure 3 , shows a flowchart of an embodiment of an identity authentication method for participating in a service of the present invention, which is applied to a server. The method may specifically include the following steps:

[0127] Step 201, in response to a private key set request sent by a client, obtain a private key set corresponding to the public key set according to a public key set carried in the private key set request, and send the private key set to the client.

[0128] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0129] Step 202: Aggregate the public key set into an aggregated public key and store it.

[0130] In the embodiment of the present invention, after receiving the public key set, the server aggregates the public keys in the public key set into an aggregated public key in the same manner as the client, and stores the aggregated public key. The aggregated public key can be stored in correspondence with the client's user unique identifier (oid, Object Identifier), so that the server can find the corresponding aggregated public key according to the user unique identifier.

[0131] Step 203, receiving the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client based on the authentication feedback information and private key set returned by the server, and the aggregate public key is determined by the client based on local information obtained in real time.

[0132] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0133] Step 204: verify the aggregate signature information and the aggregate public key, and after the verification is passed, send the necessary information for participating in the service to the client.

[0134] In the embodiment of the present invention, the specific implementation method of this step can be found in the description of the aforementioned embodiment and will not be further described here.

[0135] According to an embodiment of the present invention, by responding to a private key set request sent by a client, according to the public key set carried by the private key set request, a private key set corresponding to the public key set is obtained, and sent to the client, according to the public key set, an aggregated public key is aggregated and stored, and the aggregated signature information and the aggregated public key sent by the client are received; wherein the aggregated signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregated public key is determined by the client according to local information obtained in real time, the aggregated signature information and the aggregated public key are verified, and after the verification is passed, the necessary information for participating in the business is sent to the client, so that the corresponding aggregated public key is calculated and generated by real-time acquisition of local information for verification of the aggregated signature information, and identity authentication is combined with local information, the authenticity of the user identity is ensured, the management links such as certificate application, issuance, and storage are reduced, the storage space of the client is saved, and the identity authentication process is simplified.

[0136] In an optional embodiment of the present invention, a specific implementation method for verifying the aggregate signature information and the aggregate public key may include: comparing whether the aggregate public key and the stored aggregate public key are consistent; when the aggregate public key and the stored aggregate public key are consistent, using the aggregate public key to verify the aggregate signature information.

[0137] The server stores the aggregated public key. After receiving the aggregated public key sent by the client, the server compares the aggregated public key with the stored aggregated public key to see if they are consistent. If they are inconsistent, the verification fails. If they are consistent, the aggregated public key is used to verify the aggregated signature information. If the verification passes, the verification passes. If the verification fails, the verification fails. The specific verification method can use the verification method of the aggregate signature algorithm.

[0138] In an optional embodiment of the present invention, a specific implementation method of obtaining a private key set corresponding to the public key set according to the public key set carried in the private key set request may include: sending the public key set and the user unique identifier of the client to a key system; using the user unique identifier to decrypt the ciphertext public-private key pair set returned by the key system to obtain a private key set and a public key set.

[0139] When the server generates a private key set for the client, it needs to send the client's user unique identifier (oid) of the public key set to the key system, and the key system generates the corresponding private key set based on the public key set. The key system uses the user unique identifier to encrypt the public-private key pair set (including the public key set and the private key set), and then sends the encrypted public-private key pair set to the server. The server uses the client's user unique identifier to decrypt and obtain the private key set and the public key set. The server and the key system encrypt and transmit the private key set using the client's user unique identifier, which can improve the transmission security of the private key set.

[0140] For example, Figure 4 The schematic diagram of the identity authentication process when the client and server participate in the service is shown. In the user registration and application SM9 key link, the client (i.e., the Vision Network Palm APP mobile terminal) user applies for user registration and sets user information such as user unique identification and user PIN code. The server (i.e., the Vision Network Palm APP server) reviews the registered information. After the review is passed, it records the user information and assigns the user unique identification oid to the user. The server returns a successful registration feedback to the client. The client collects device information, APP information (i.e., client information), and user information as public key fragments (i.e., public key set). The client calls the server interface to obtain the private key fragment (i.e., private key set) corresponding to the public key fragment. Among them, the private key fragment is obtained by the server from KGC. KGC uses the user oid (i.e., user unique identification) to encrypt and send the public and private key pair set to the server, and the server uses the user PIN code to encrypt and send the private key fragment to the client. The client uses the hash value of the user name, the hash value of the user PIN code, and the hash value of the user name and user PIN code to encrypt and store three private key fragments. The server calculates the aggregate public key based on each public key fragment, and then stores the aggregate public key corresponding to oid on the server. In the user authentication phase, the client sends an authentication request to the server. After receiving user information such as the user name and user PIN code, the server verifies the user information, generates a random number after the verification is successful, and then returns the random number to the client. The client decrypts the three stored private key fragments. Collect device information, APP information, and user information to calculate the aggregate public key. The client uses the private key fragments to sign the random number respectively, and then uses the aggregate signature technology to synthesize each signature value into a complete signature value, namely the aggregate signature information. The complete signature value (i.e., aggregate signature information) and the aggregate public key are sent to the server. The server compares the aggregate public key with the stored aggregate public key. When they are consistent, it verifies the aggregate signature information based on the aggregate public key and returns the result. If the verification is successful, the result returned by the server is the necessary information for participating in the visual network service (such as the conference room number and conference password).

[0141] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0142] Reference Figure 5 The structural block diagram of an embodiment of an identity authentication device for participating in a service of the present invention is shown, which is applied to a client and may specifically include the following modules:

[0143] The information determination module 301 is used to determine the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0144] A public key determination module 302, configured to determine an aggregated public key based on local information obtained in real time;

[0145] The information acquisition module 303 is used to obtain necessary information for participating in the service from the server according to the aggregate signature information and the aggregate public key.

[0146] Optionally, the private key set includes at least two of the following: a device private key, a client private key and a user private key; correspondingly, the local information includes at least two of the following: device information, client information and user information.

[0147] Optionally, the information determination module includes:

[0148] The signature submodule is used to sign the authentication feedback information using the device private key, the client private key and the user private key respectively to obtain corresponding signature information;

[0149] The information aggregation submodule is used to aggregate the signature information into the aggregate signature information.

[0150] Optionally, the public key determination module includes:

[0151] A public key determination submodule, used to determine a device public key, a client public key and a user public key according to the device information, the client information and the user information acquired in real time;

[0152] The public key aggregation submodule is used to aggregate the device public key, the client public key and the user public key into the aggregated public key.

[0153] Optionally, the device further comprises:

[0154] The decryption module is used to decrypt the stored ciphertext private key set according to the user identity authentication information obtained in real time before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server to obtain the private key set.

[0155] Optionally, the user identity authentication information includes a user name and a user password, and the decryption module includes:

[0156] The decryption submodule is used to decrypt the stored ciphertext device private key, ciphertext client private key and ciphertext user private key using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively to obtain the device private key, the client private key and the user private key.

[0157] Optionally, the device further comprises:

[0158] A public key determination module, used to determine a public key set according to the acquired local information before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0159] A private key request module, used to request the private key set from the server according to the public key set;

[0160] The private key receiving module is used to receive the private key set returned by the server.

[0161] Optionally, the private key set includes: a device private key, a client private key and a user private key; and the private key receiving module includes:

[0162] A receiving submodule, used for receiving the private key set encrypted with the user password returned by the server;

[0163] A private key decryption submodule, used to decrypt using the user password to obtain a device private key, a client private key and a user private key;

[0164] The encryption submodule is used to encrypt the device private key, the client private key and the user private key using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively, to obtain the ciphertext device private key, the ciphertext client private key and the ciphertext user private key, and store them.

[0165] According to an embodiment of the present invention, the aggregate signature information is determined based on the authentication feedback information returned by the server and the private key set pre-issued by the server, and the aggregate public key is determined based on the local information obtained in real time. According to the aggregate signature information and the aggregate public key, the necessary information for participating in the business is obtained from the server, so that the corresponding aggregate public key is calculated and generated by real-time acquisition of local information for verification of the aggregate signature information, and identity authentication is combined with local information to ensure the authenticity of the user's identity, reduce management links such as certificate application, issuance, and storage, save client storage space, and simplify the identity authentication process.

[0166] Reference Figure 6 The structural block diagram of another embodiment of the identity authentication device for joining a service of the present invention is shown, which is applied to the server and may specifically include the following modules:

[0167] The private key issuing module 401 is used to respond to the private key set request sent by the client, obtain the private key set corresponding to the public key set according to the public key set carried in the private key set request, and issue it to the client;

[0168] A public key aggregation module 402, configured to aggregate the public key set into an aggregated public key and store the aggregated public key;

[0169] The information receiving module 403 is used to receive the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregate public key is determined by the client according to the local information obtained in real time;

[0170] The information sending module 404 is used to verify the aggregate signature information and the aggregate public key, and after the verification is passed, send the necessary information for participating in the service to the client.

[0171] Optionally, the information sending module includes:

[0172] A comparison submodule, used to compare whether the aggregated public key is consistent with the stored aggregated public key;

[0173] The signature verification submodule is used to verify the aggregate signature information using the aggregate public key when the aggregate public key is consistent with the stored aggregate public key.

[0174] Optionally, the private key issuing module includes:

[0175] A public key sending submodule, used for sending the public key set and the unique user identifier of the client to a key system;

[0176] The decryption submodule is used to decrypt the ciphertext public and private key pair set returned by the key system using the user unique identifier to obtain a private key set and a public key set.

[0177] According to an embodiment of the present invention, by responding to a private key set request sent by a client, according to the public key set carried by the private key set request, a private key set corresponding to the public key set is obtained, and sent to the client, according to the public key set, an aggregated public key is aggregated and stored, and the aggregated signature information and the aggregated public key sent by the client are received; wherein the aggregated signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregated public key is determined by the client according to local information obtained in real time, the aggregated signature information and the aggregated public key are verified, and after the verification is passed, the necessary information for participating in the business is sent to the client, so that the corresponding aggregated public key is calculated and generated by real-time acquisition of local information for verification of the aggregated signature information, and identity authentication is combined with local information, the authenticity of the user identity is ensured, the management links such as certificate application, issuance, and storage are reduced, the storage space of the client is saved, and the identity authentication process is simplified.

[0178] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0179] Figure 7 1 is a block diagram of an electronic device 600 for identity authentication when participating in a service according to an exemplary embodiment. For example, the electronic device 600 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0180] Reference Figure 7 , the electronic device 600 may include one or more of the following components: a processing component 602 , a memory 604 , a power component 606 , a multimedia component 608 , an audio component 610 , an input / output (I / O) interface 612 , a sensor component 614 , and a communication component 616 .

[0181] The processing component 602 generally controls the overall operation of the electronic device 600, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 602 may include one or more processors 620 to execute instructions to complete all or part of the steps of identity authentication when participating in the above-mentioned business. In addition, the processing component 602 may include one or more modules to facilitate the interaction between the processing component 602 and other components. For example, the processing component 602 may include a multimedia module to facilitate the interaction between the multimedia component 608 and the processing component 602.

[0182] The memory 604 is configured to store various types of data to support operations on the electronic device 600. Examples of such data include instructions for any application or method operating on the electronic device 600, contact data, phone book data, messages, pictures, videos, etc. The memory 604 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0183] The power supply component 606 provides power to the various components of the electronic device 600. The power supply component 606 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 600.

[0184] The multimedia component 608 includes a screen that provides an output interface between the electronic device 600 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 608 includes a front camera and / or a rear camera. When the electronic device 600 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0185] The audio component 610 is configured to output and / or input audio signals. For example, the audio component 610 includes a microphone (MIC), and when the electronic device 600 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 604 or sent via the communication component 616. In some embodiments, the audio component 610 also includes a speaker for outputting audio signals.

[0186] I / O interface 612 provides an interface between processing component 602 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0187] The sensor assembly 614 includes one or more sensors for providing various aspects of status assessment for the electronic device 600. For example, the sensor assembly 614 can detect the open / closed state of the electronic device 600, the relative positioning of the components, such as the display and keypad of the electronic device 600, and the sensor assembly 614 can also detect the position change of the electronic device 600 or a component of the electronic device 600, the presence or absence of contact between the user and the electronic device 600, the orientation or acceleration / deceleration of the electronic device 600, and the temperature change of the electronic device 600. The sensor assembly 614 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 614 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 614 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0188] The communication component 616 is configured to facilitate wired or wireless communication between the electronic device 600 and other devices. The electronic device 600 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 616 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 616 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0189] In an exemplary embodiment, the electronic device 600 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above-mentioned shutdown control method.

[0190] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 604 including instructions, and the instructions can be executed by a processor 620 of an electronic device 600 to complete the above-mentioned shutdown control method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0191] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables a server to execute an identity authentication method when participating in a service, applied to a client, the method comprising:

[0192] Determine the aggregate signature information based on the authentication feedback information returned by the server and the private key set pre-issued by the server;

[0193] Determine the aggregated public key based on the local information obtained in real time;

[0194] According to the aggregate signature information and the aggregate public key, necessary information for participating in the service is obtained from the server.

[0195] Optionally, the private key set includes at least two of the following: a device private key, a client private key and a user private key; correspondingly, the local information includes at least two of the following: device information, client information and user information.

[0196] Optionally, determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server includes:

[0197] Using the device private key, the client private key and the user private key respectively, the authentication feedback information is signed to obtain corresponding signature information;

[0198] The aggregated signature information is aggregated according to each signature information.

[0199] Optionally, determining the aggregated public key according to the local information acquired in real time includes:

[0200] Determine a device public key, a client public key, and a user public key according to the device information, the client information, and the user information acquired in real time;

[0201] The aggregate public key is aggregated according to the device public key, the client public key and the user public key.

[0202] Optionally, before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server, the method further includes:

[0203] According to the user identity authentication information obtained in real time, the stored ciphertext private key set is decrypted to obtain the private key set.

[0204] Optionally, the user identity authentication information includes a user name and a user password, and decrypting the stored ciphertext private key set according to the user identity authentication information acquired in real time to obtain the private key set includes:

[0205] The stored ciphertext device private key, ciphertext client private key and ciphertext user private key are decrypted using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively to obtain the device private key, the client private key and the user private key.

[0206] Optionally, before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server, the method further includes:

[0207] Determine the public key set based on the acquired local information;

[0208] According to the public key set, requesting the private key set from the server;

[0209] Receive the private key set returned by the server.

[0210] Optionally, the private key set includes: a device private key, a client private key and a user private key; and the receiving the private key set returned by the server includes:

[0211] Receive the private key set encrypted with the user password returned by the server;

[0212] Decrypt the user password to obtain the device private key, the client private key and the user private key;

[0213] The device private key, the client private key and the user private key are encrypted using the hash value of the user name, the hash value of the user password and the hash value of the user name and the user password respectively to obtain a ciphertext device private key, a ciphertext client private key and a ciphertext user private key, and store them.

[0214] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, enables a server to execute an identity authentication method when participating in a service, applied to a server, the method comprising:

[0215] In response to a private key set request sent by a client, obtaining a private key set corresponding to the public key set according to the public key set carried in the private key set request, and sending the private key set to the client;

[0216] Aggregating the public key set into an aggregated public key and storing the aggregated public key;

[0217] Receiving the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregate public key is determined by the client according to the local information obtained in real time;

[0218] The aggregate signature information and the aggregate public key are verified, and after the verification is passed, necessary information for participating in the service is sent to the client.

[0219] Optionally, the verifying the aggregate signature information and the aggregate public key includes:

[0220] Comparing the aggregated public key with the stored aggregated public key to see if they are consistent;

[0221] When the aggregate public key is consistent with the stored aggregate public key, the aggregate signature information is verified using the aggregate public key.

[0222] Optionally, acquiring, according to the public key set carried in the private key set request, a private key set corresponding to the public key set includes:

[0223] Sending the public key set and the unique user identifier of the client to a key system;

[0224] The user unique identifier is used to decrypt the ciphertext public and private key pair set returned by the key system to obtain a private key set and a public key set.

[0225] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0226] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0227] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0228] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0229] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0230] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0231] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0232] The identity authentication method and the identity authentication device for participating in a business provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for identity authentication when participating in a business, characterized in that: Applied to a client, the method comprises: Determine the aggregate signature information based on the authentication feedback information returned by the server and the private key set pre-issued by the server; Determine the aggregated public key based on the local information obtained in real time; According to the aggregate signature information and the aggregate public key, necessary information for participating in the service is obtained from the server.

2. The method according to claim 1, characterized in that The private key set includes at least two of the following: a device private key, a client private key and a user private key; correspondingly, the local information includes at least two of the following: device information, client information and user information.

3. The method according to claim 2, characterized in that Determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server includes: Using the device private key, the client private key and the user private key respectively, the authentication feedback information is signed to obtain corresponding signature information; The aggregated signature information is aggregated according to each signature information.

4. The method according to claim 2, characterized in that: Determining the aggregated public key according to the local information obtained in real time includes: Determine a device public key, a client public key, and a user public key according to the device information, the client information, and the user information acquired in real time; The aggregate public key is aggregated according to the device public key, the client public key and the user public key.

5. The method according to claim 1, characterized in that Before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server, the method further includes: According to the user identity authentication information obtained in real time, the stored ciphertext private key set is decrypted to obtain the private key set.

6. The method according to claim 5, characterized in that The user identity authentication information includes a user name and a user password. The stored ciphertext private key set is decrypted according to the user identity authentication information obtained in real time to obtain the private key set, including: The stored ciphertext device private key, ciphertext client private key and ciphertext user private key are decrypted using the hash value of the user name, the hash value of the user password and the hash value of the user name and user password respectively to obtain the device private key, the client private key and the user private key.

7. The method according to claim 1, characterized in that Before determining the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server, the method further includes: Determine the public key set based on the acquired local information; According to the public key set, requesting the private key set from the server; Receive the private key set returned by the server.

8. The method according to claim 7, characterized in that The private key set includes: a device private key, a client private key and a user private key; the receiving the private key set returned by the server includes: Receive the private key set encrypted with the user password returned by the server; Decrypt the user password to obtain the device private key, the client private key and the user private key; The device private key, the client private key and the user private key are encrypted using the hash value of the user name, the hash value of the user password and the hash value of the user name and the user password respectively to obtain a ciphertext device private key, a ciphertext client private key and a ciphertext user private key, and store them.

9. A method for identity authentication when participating in a business, characterized in that: Applied to the server, the method includes: In response to a private key set request sent by a client, according to a public key set carried in the private key set request, a private key set corresponding to the public key set is obtained, and the private key set is sent to the client; Aggregating the public key set into an aggregated public key and storing the aggregated public key; Receiving the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregate public key is determined by the client according to the local information obtained in real time; The aggregate signature information and the aggregate public key are verified, and after the verification is passed, necessary information for participating in the service is sent to the client.

10. The method according to claim 9, characterized in that The verifying the aggregate signature information and the aggregate public key includes: Comparing the aggregated public key with the stored aggregated public key to see if they are consistent; When the aggregate public key is consistent with the stored aggregate public key, the aggregate signature information is verified using the aggregate public key.

11. The method according to claim 9, characterized in that The step of obtaining a private key set corresponding to the public key set according to the public key set carried in the private key set request includes: Sending the public key set and the unique user identifier of the client to a key system; The user unique identifier is used to decrypt the ciphertext public and private key pair set returned by the key system to obtain a private key set and a public key set.

12. An identity authentication device for participating in a business, characterized in that: Applied to a client, the device comprises: An information determination module, used to determine the aggregate signature information according to the authentication feedback information returned by the server and the private key set pre-issued by the server; A public key determination module, used to determine the aggregated public key based on local information obtained in real time; The information acquisition module is used to obtain necessary information for participating in the business from the server according to the aggregate signature information and the aggregate public key.

13. An identity authentication device for participating in a business, characterized in that: Applied to the server, the device comprises: The private key issuing module is used to respond to the private key set request sent by the client, obtain the private key set corresponding to the public key set according to the public key set carried in the private key set request, and issue it to the client; A public key aggregation module, used to aggregate the public key set into an aggregated public key and store it; An information receiving module, used to receive the aggregate signature information and aggregate public key sent by the client; wherein the aggregate signature information is determined by the client according to the authentication feedback information and the private key set returned by the server, and the aggregate public key is determined by the client according to the local information obtained in real time; The information sending module is used to verify the aggregate signature information and the aggregate public key, and after the verification is passed, send the necessary information for participating in the service to the client.

14. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the apparatus to perform the method of any one of claims 1 to 11.

15. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the method according to any one of claims 1 to 11.

Images