Client registration method, client communication method, terminal and server

Abstract

The invention relates to a client registration method, a client communication method, a terminal and a server. The client registration method comprises the following steps: generating a registration request based on first terminal information of a client and a first blind-processed registration password; the registration request is sent to a server side, registration feedback information of the server side is received, and the registration feedback information comprises a client side identity label of the client side and a signing blind registration password; performing first blind elimination processing on the signed blind registration password to obtain a signed registration password; carrying out encryption processing on a client private key based on the signing registration password, and generating a client identity authentication credential; and sending the client identity authentication credential to the server. By adopting the method, the security of registration and authentication of the client and the server can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a client registration method, a client communication method, a terminal and a server. Background Art

[0002] During the registration and authentication process between the client and the server, the client often sends its identity and password to the server for authentication through a secure connection. Therefore, the password can be easily stolen by a third party during transmission. On the other hand, the hacking of the server can easily lead to password leakage.

[0003] It can be seen that the current registration and authentication methods between clients and servers still have the problem of poor password storage and communication security. Summary of the invention

[0004] Based on this, it is necessary to provide a client registration method, client communication method, terminal and server that can improve the security of client and server registration and authentication in response to the above technical problems.

[0005] In a first aspect, the present application provides a client registration method, which is applied to a client, and the client registration method includes:

[0006] Generate a registration request based on the first terminal information of the client and the first blinded registration password;

[0007] Sending the registration request to the server, and receiving registration feedback information from the server, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0008] Performing a first unblinding process on the signed blinded registration password to obtain a signed registration password;

[0009] Encrypt the client private key based on the signed registration password to generate a client identity authentication credential;

[0010] Send the client authentication credentials to the server.

[0011] In some embodiments, the sending of the client authentication credentials to the server includes:

[0012] The client identity is stored, and the client private key is deleted.

[0013] In some embodiments, before generating a registration request based on the first terminal information and the first blinded registration password, the step further includes:

[0014] Obtaining a registration password of the client;

[0015] Generate a first blind signature parameter, wherein the first blind signature parameter includes a first random number and a second random number; the greatest common factor of the first random number and the second random number is 1;

[0016] Based on the first random number, the second random number and the server public key of the server, a first blinding process is performed on the registration password to obtain a registration password after the first blinding process.

[0017] In some embodiments, performing a first unblinding process on the signed blinded registration password to obtain the signed registration password includes:

[0018] Based on the first random number, a first deblinding process is performed on the signed blinded registration password to obtain the signed registration password.

[0019] In a second aspect, the present application provides a client registration method, which is applied to a server, and the client registration method includes:

[0020] Receiving a registration request sent by a client, the registration request including first terminal information of the client and a first blinded registration password;

[0021] determining whether the registration request is legal based on the first terminal information;

[0022] If the registration request is legal, then generate registration feedback information, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0023] Sending the registration feedback information to the client, and receiving the client identity authentication credentials sent by the client;

[0024] The client identity authentication credentials are stored.

[0025] In some embodiments, the first terminal information includes at least one of a universal unique identifier, a media access control address, and an Internet Protocol address, and determining whether the registration request is legal based on the terminal information includes:

[0026] Get the terminal whitelist;

[0027] Based on the first terminal information, query the terminal whitelist;

[0028] If the terminal whitelist includes the first terminal information, the registration request is legal.

[0029] In a third aspect, the present application provides a client communication method, which is applied to a client, and the client communication method includes:

[0030] Generate a credential acquisition request based on the client identity of the client and the second blinded verification password;

[0031] Sending the credential acquisition request to the server, and receiving credential feedback information from the server, the credential feedback information including the client identity authentication credential and the signed blind verification password of the client;

[0032] Performing a second unblinding process on the signature blinded verification password to obtain a signature verification password;

[0033] Decrypt the client identity authentication credentials based on the signed verification password to obtain the client private key;

[0034] A secure channel with the server is established based on the second terminal information signed by the client private key.

[0035] In some embodiments, the establishing of a secure channel with the server based on the second terminal information signed by the client private key includes:

[0036] Delete the client private key.

[0037] In some embodiments, before generating the credential acquisition request based on the client identity of the client and the second blinded verification password, the step further includes:

[0038] Obtaining a verification password of the client;

[0039] Generate a second blind signature parameter, wherein the second blind signature parameter includes a third random number and a fourth random number; the greatest common factor of the third random number and the fourth random number is 1;

[0040] Based on the third random number, the fourth random number and the server public key of the server, the verification password is subjected to a second blinding process to obtain a registration password after the second blinding process.

[0041] In some embodiments, performing a second unblinding process on the signature blinded verification password to obtain the signature verification password includes:

[0042] Based on the third random number, a second deblinding process is performed on the signature blinded verification password to obtain the signature verification password.

[0043] In some embodiments, establishing a secure channel with the server based on the second terminal information encrypted by the client private key includes:

[0044] Acquire second terminal information of the client; the second terminal information includes an IP address, a client message and a timestamp;

[0045] Generate a unilateral authentication package based on the client private key, the second terminal information and the client identity; the unilateral authentication package includes the client identity and the second terminal information signed by the client private key;

[0046] The unilateral authentication package is sent to the server, and an attempt is made to establish a secure channel with the server.

[0047] In a fourth aspect, the present application provides a client communication method, which is applied to a server, and the client communication method includes:

[0048] Receive a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password;

[0049] Based on the client identity identifier, credential feedback information is obtained, wherein the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier and the signed blind verification password;

[0050] Sending the credential feedback information to the client;

[0051] The second terminal information of the client signed by the client private key is received, and when the second terminal information is legal, a secure channel is established with the client.

[0052] In some embodiments, establishing a secure channel with the client based on the second terminal information of the client encrypted by the client private key includes:

[0053] Obtaining a unilateral authentication package sent by the client; the unilateral authentication package includes a client identity and second terminal information signed by the client private key; the terminal information includes an IP address, a client message, and a timestamp;

[0054] Based on the client identity, obtaining a client public key corresponding to the client identity;

[0055] authenticating the client based on the client public key and the second terminal information;

[0056] If the identity authentication of the client is passed, the port is started to establish a secure channel with the server.

[0057] In a fifth aspect, the present application provides a terminal, comprising a client, a blinding module and a deblinding module, wherein:

[0058] The blinding module is used to perform blinding processing on the registration password;

[0059] The client is used to generate a registration request based on the first terminal information of the client and the first blinded registration password; send the registration request to the server, and receive registration feedback information from the server, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0060] The deblinding module is used to perform a first deblinding process on the signed blinded registration password to obtain the signed registration password;

[0061] The client is also used to encrypt the client private key based on the signed registration password to generate a client identity authentication credential; and send the client identity authentication credential to the server.

[0062] In some of these embodiments,

[0063] The blinding module is also used to perform blinding processing on the verification password;

[0064] The client is also used to generate a credential acquisition request based on the client identity of the client and the second blinded verification password; send the credential acquisition request to the server, and receive credential feedback information from the server, the credential feedback information including the client identity authentication credential of the client and the signed blinded verification password;

[0065] The deblinding module is used to perform a second deblinding process on the signature blinded verification password to obtain the signature verification password;

[0066] The client is also used to decrypt the client identity authentication credentials based on the signed verification password to obtain the client private key; and establish a secure channel with the server based on the terminal information encrypted by the client private key.

[0067] In a sixth aspect, the present application provides a server, the server comprising a terminal registration device and a terminal management device, the terminal registration device being communicatively connected with the terminal management device, wherein:

[0068] The terminal registration device is used to receive a registration request sent by a client, the registration request including the first terminal information of the client and the first blinded registration password; determine whether the registration request is legal based on the terminal information; if the registration request is legal, forward the registration request to the terminal management device;

[0069] The terminal management device is used to generate registration feedback information, which includes the client identity identifier and the signed blinded registration password of the client; send the registration feedback information to the client, and receive the client identity authentication credentials sent by the client and forwarded by the terminal registration device; store the client identity authentication credentials.

[0070] In some of these embodiments,

[0071] The terminal registration device is further used to receive a credential acquisition request sent by a client, the credential acquisition request including a client identity of the client and a second blinded verification password; and forward the credential acquisition request to the terminal management device;

[0072] The terminal management device is also used to obtain credential feedback information based on the client identity identifier, wherein the credential feedback information includes the client identity authentication credentials corresponding to the client identity identifier, and a signed blind verification password; send the credential feedback information to the client; and establish a secure channel with the client based on the second terminal information of the client signed by the client private key.

[0073] In some embodiments, the server further comprises a single packet authentication module, and the single packet authentication module is connected to the terminal management device.

[0074] The single-packet authentication module is used to obtain a unilateral authentication package sent by the client; the unilateral authentication package includes a client identity and second terminal information signed by the client private key; the terminal information includes an IP address, a client message and a timestamp; based on the client identity, obtain a client public key corresponding to the client identity; based on the client public key and the second terminal information, authenticate the client; if the client's identity authentication is passed, start a port to establish a secure channel between the terminal management device and the server.

[0075] In a seventh aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method described above when executed by a processor.

[0076] In an eighth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the method described above when executed by a processor.

[0077] In a ninth aspect, the present application provides a computer program product, comprising a computer program, which implements the method described above when executed by a processor.

[0078] In a tenth aspect, the present application provides a computer program product, comprising a computer program, which implements the method described above when executed by a processor.

[0079] The above-mentioned client registration method, client communication method, terminal and server can prevent the password from being known by the server by blinding the password, so that the server can process the registration request or credential acquisition request without knowing the password, thereby avoiding password leakage caused by the server being hacked; by deblinding the blinded password signed by the server, the password can be signed and authenticated by the server without being known by the server; the client private key is encrypted by signing the registration password to generate the client identity authentication credential, and the client identity authentication credential is decrypted by signing the verification password to obtain the client private key, so that the client private key can be decrypted only when the password is correct, thereby preventing the client private key from being stolen and used to reduce the communication security, thereby achieving the effect of improving the security of registration and authentication between the client and the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 An application environment diagram of a client registration method in an embodiment;

[0081] Figure 2 A schematic diagram of a client registration method in one embodiment;

[0082] Figure 3 It is a flowchart of a client registration method in another embodiment;

[0083] Figure 4 A schematic diagram of a client communication method in one embodiment;

[0084] Figure 5 is a flow chart of a client communication method in another embodiment;

[0085] Figure 6 is a structural block diagram of a terminal in an embodiment;

[0086] Figure 7 A structural block diagram of a server in one embodiment;

[0087] Figure 8 The following is a logic diagram of interaction between a terminal and a server in an embodiment;

[0088] Fig. 9 Schematic diagram of a blind signature process in one embodiment;

[0089] Fig.10 A schematic diagram of a process flow in a registration phase in an embodiment;

[0090] Fig.11 A schematic diagram of a process of obtaining a private key in an embodiment;

[0091] Fig.12 FIG. 4 is a flow chart of the authentication phase in an embodiment. DETAILED DESCRIPTION

[0092] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0093] The client registration method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the client is installed in the terminal 102, and the client can be software that requests services or resources from the server, such as an application installed on the terminal 102. The terminal 102 generates a registration request based on the first terminal information of the client and the registration password after the first blinding process; sends the registration request to the server, and receives the registration feedback information of the server, the registration feedback information includes the client identity of the client and the signed blind registration password; performs a first deblinding process on the signed blind registration password to obtain a signed registration password; encrypts the client private key based on the signed registration password to generate a client identity authentication credential; sends the client identity authentication credential to the server. Server 104 is a service end, and server 104 is used to receive a registration request sent by a client, the registration request includes the first terminal information of the client and the first blinded registration password; based on the first terminal information, determine whether the registration request is legal; if the registration request is legal, generate registration feedback information, the registration feedback information includes the client identity of the client and the signed blinded registration password; send the registration feedback information to the client, and receive the client identity authentication credentials sent by the client; store the client identity authentication credentials. Terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented as an independent server or a server cluster consisting of multiple servers.

[0094] In one embodiment, Figure 2As shown, a client registration method is provided, which is applied to the client. Figure 1 The terminal 102 in the example is used as an example to illustrate, and the following steps are included:

[0095] Step S110: Generate a registration request based on the first terminal information of the client and the first blinded registration password.

[0096] The first terminal information may be identification information of the client, and may be, for example, a unique identifier such as a device ID, an IP address, or a hardware fingerprint, so that the server can identify the client device based on the first terminal information.

[0097] The registration password can be generated by the terminal, generated by the client, or entered by the user. The registration password is used for identity authentication after registration. During verification, if the entered password is the same as the registration password, the verification is passed.

[0098] The first blinding process may be to encrypt the registration password to obtain a blinded registration password, and the encryption process may be implemented through a blind signature protocol. By performing the first blinding process on the registration password, objects other than the client cannot know the content of the registration password itself, thereby preventing the registration password from being intercepted by a third party during the transmission process of registration, and avoiding the problem of password leakage when the server is hacked.

[0099] The registration request may be generated by packaging the first terminal information and the registration password to obtain a data packet, and initiating the registration request to the server based on the data packet.

[0100] Step S120, sending the registration request to the server, and receiving registration feedback information from the server, wherein the registration feedback information includes the client identity of the client and the signed blinded registration password.

[0101] Among them, after sending the registration request, the registration feedback information from the server is received. The registration feedback information includes the client identity and the signed blind registration password. The client identity is a unique identifier corresponding to the client generated by the server, which can be used as an index basis when the server searches for client-related information. The signed blind registration password is a blind registration password signed by the server's private key. The registration request is verified by the server, and the registration password is signed, so that when the client obtains the registration feedback information, it can determine the authenticity of the registration feedback information based on the signature result, thereby enhancing the degree of trust.

[0102] Step S130, performing a first deblinding process on the signed blinded registration password to obtain the signed registration password.

[0103] Among them, the first deblinding process can be a deblinding process corresponding to the first blinding process to remove the original blinding result of the registration password, so as to obtain a signed registration password that only contains the signature of the server private key.

[0104] Step S140: encrypt the client private key based on the signed registration password to generate a client identity authentication credential.

[0105] Among them, the client private key is encrypted by signing the registration password, which can be a symmetric encryption method, using the signed registration password as the secret key used for encryption and decryption to form the client identity authentication credentials. It is understandable that after the registration is completed, the client needs to obtain the client private key before it can verify the terminal identity and establish a long connection with the server. Therefore, if the input password is inconsistent with the registration password, it cannot be decrypted to obtain the original client private key, thereby avoiding the storage of the registration password by both the client and the server. Even if the client or the server is hacked, it will not cause the leakage of the registration password.

[0106] Step S150, sending the client identity authentication credentials to the server.

[0107] The client authentication credentials are sent to the server so that the server stores the client authentication credentials. It is understandable that by storing the client authentication credentials by the server, only the client identity identification needs to be stored in the client, and although the server stores the client authentication credentials, since it is encrypted with the encrypted registration password, other people cannot know the content of the client private key. Therefore, even if the authentication credentials are leaked, if the client identity identification or password is entered incorrectly, other people cannot decrypt the client private key, and thus cannot establish a secure connection with the server.

[0108] A client registration method provided in this embodiment can prevent the password from being known by the server by blinding the password, so that the server can process the registration request or credential acquisition request without knowing the password, thereby avoiding password leakage caused by the server being hacked; by deblinding the blinded password signed by the server, the password can be signed and authenticated by the server without being known by the server; the client private key is encrypted by signing the registration password to generate the client identity authentication credential, so that the client private key can be decrypted only when the password is correct, thereby preventing the client private key from being stolen and used to reduce the communication security, thereby achieving the effect of improving the security of registration and authentication between the client and the server.

[0109] In some embodiments, the sending of the client authentication credentials to the server includes:

[0110] The client identity is stored, and the client private key is deleted.

[0111] Among them, only the client identity information is stored for the server to retrieve the corresponding server private key and client identity authentication credentials when performing identity authentication.

[0112] A client registration method provided in this embodiment not only reduces the amount of locally stored data by storing identity identification and deleting client private keys, but also makes it difficult for attackers to obtain credentials that can be used to directly access the system even if the client device is compromised, thereby preventing the impact on the security of the server in the event of a client private key leakage, thereby achieving the effect of improving the security of client and server registration and authentication.

[0113] In some embodiments, before generating a registration request based on the first terminal information and the first blinded registration password, the step further includes:

[0114] Obtaining a registration password of the client;

[0115] Generate a first blind signature parameter, wherein the first blind signature parameter includes a first random number and a second random number;

[0116] Based on the first random number and the server public key of the server, the registration password is subjected to a first blinding process to obtain a registration password after the first blinding process.

[0117] The registration password of the client may be obtained by obtaining a registration password built into or generated by the terminal or the client, or by obtaining a registration password input by a user.

[0118] The first blind signature parameter is a parameter generated by the blind signature protocol, including a first random number and a second random number generated by a pseudo-random algorithm. The first random number and the second random number are used to perform a first blinding process on the registration password, thereby obtaining a blinded registration password. The greatest common factor of the first random number and the second random number is 1, that is, the first random number and the second random number are mutually prime, thereby ensuring the accuracy of the blinding and deblinding process in the blind signature scheme. And when the greatest common factor of the first random number and the second random number is 1, the possibility of using the first random number to infer the second random number is greatly reduced, thereby improving the security of the blinded password.

[0119] Blind processing means transforming the original information based on the combination of the first random number and the server public key without revealing the original information. The transformed original password is converted into a seemingly random string, and the original password cannot be deduced.

[0120] A client registration method provided in this embodiment can protect the user's privacy and prevent the user's password from being directly leaked when intercepted during transmission by performing a first blinding process on the registration password based on the first random number, the second random number and the server's server public key, thereby achieving the effect of improving the security of registration and authentication between the client and the server.

[0121] In some embodiments, performing a first unblinding process on the signed blinded registration password to obtain the signed registration password includes:

[0122] Based on the first random number, a first deblinding process is performed on the signed blinded registration password to obtain the signed registration password.

[0123] In a specific embodiment, the server generates a server public key e and a server private key d based on the RSA protocol, and sends the server public key e to the client. After obtaining the registration password X, the client generates a first random number r and a second random number n, and the first random number r and the second random number n satisfy the condition that the greatest common factor is 1. The client uses the server public key e and the first random number r to perform a first blinding process on the registration password X to obtain a blinded registration password M, where M=r e ×H(X), where H(X) is the value obtained by hashing X, which can be a modulo n operation on X, and the second random number n can be made public. The hash modulo algorithm is an algorithm that maps data to a fixed range, and maps the data to a smaller integer range through a modulo operation. The client sends the blinded registration password M to the server, and the server signs the blinded registration password M based on the server private key d to obtain the signed blinded registration password Z, where Z = M d =(r e ×H(X) d =r×H(X) d The server sends the signed blinded registration password Z to the client. The client performs a first deblinding process on the signed blinded registration password Z based on the first random number r to obtain the signed registration password Y, where Y = H (Z × r -1 )=H(r×(H(x)) d × -1 )=H((H(x)) d ), the signed registration password Y can be used to encrypt the client private key.

[0124] A client registration method provided in this embodiment performs a first blinding process on the registration password based on the first random number, the second random number and the server public key of the server, and performs a first unblinding process on the signed blinded registration password based on the first random number to obtain a signed registration password, which can ensure the integrity of data and the validity of the signature during the blinding and unblinding processes, and improve the security of registration and authentication between the client and the server.

[0125] In one embodiment, Figure 3 As shown, a client registration method is provided, which is applied to the server. Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0126] Step S210: receiving a registration request sent by a client, wherein the registration request includes first terminal information of the client and a first blinded registration password.

[0127] The registration request and the first terminal information and the registration password therein may be the same as those in the embodiment of the client registration method applied to the client, and this embodiment is not limited here. Receiving the registration request sent by the client may be receiving the message data sent by the client and parsing the message data to obtain the message data.

[0128] Step S220: determining whether the registration request is legal based on the first terminal information.

[0129] Whether the registration request is legal can be determined based on the first terminal information; the determination based on the first terminal information can be made by querying whether the unique identifier of the terminal in the first terminal information exists in a whitelist and / or a blacklist, or it can be determined by determining whether there is unreasonable access behavior based on the number of registration requests sent within a preset time, and determining the illegality. The legality of the registration request can also be determined based on whether there is an unresolved non-compliant situation of the unique identifier, and by combining other matters for comprehensive weight calculation.

[0130] Furthermore, after a preliminary legal judgment is made on the registration request, it can also be submitted to manual review to determine whether to allow the generation of registration feedback information.

[0131] Step S230: If the registration request is legal, registration feedback information is generated, and the registration feedback information includes the client identity of the client and the signed blinded registration password.

[0132] Among them, the limitations of the registration feedback information, the client identity and the signed blinded registration password can refer to the embodiment of the client registration method applied to the client mentioned above, and this embodiment does not make any limitations here.

[0133] Step S240: sending the registration feedback information to the client, and receiving the client identity authentication credentials sent by the client.

[0134] Step S250, storing the client identity authentication credentials.

[0135] The client authentication credentials may be stored according to the client identity identifier, so that in a later retrieval process, the corresponding identity certificate can be obtained by relying on the client identity identifier.

[0136] A client registration method provided in this embodiment obtains a registration request through a server, determines whether the client is legitimate through first terminal information, generates a client identity, and stores the client identity and client authentication credentials. It can encrypt and save the password and the client private key without knowing the registration password and the client private key content, effectively reduces the risk of password theft, and increases the defense capability against illegal access, thereby achieving the effect of improving the security of registration and authentication between the client and the server.

[0137] In some embodiments, the first terminal information includes at least one of a universal unique identifier, a media access control address, and an Internet Protocol address, and determining whether the registration request is legal based on the terminal information includes:

[0138] Get the terminal whitelist;

[0139] Based on the first terminal information, query the terminal whitelist;

[0140] If the terminal whitelist includes the first terminal information, the registration request is legal.

[0141] The terminal whitelist may be a list preset on the server side, which records the information of legal terminals that are allowed to register and access the system, and may include at least one of a universal unique identifier (GUID), a media access control address (MAC address), and an Internet Protocol address (IP address). During registration, the server side extracts the first terminal information in the registration request, and based on the first terminal information, queries the terminal whitelist. If the terminal whitelist includes the first terminal information, it means that the client and its corresponding terminal are clients and terminals that are allowed to register, and the registration request is legal.

[0142] A client registration method provided in the present application can effectively prevent registration attempts of unauthorized devices by querying the terminal whitelist based on the first terminal information to determine whether the registration request is legal, thereby achieving the effect of improving the security of registration and authentication between the client and the server.

[0143] In one embodiment, Figure 4 As shown, a client communication method is provided, which is applied to a client, and the method is applied to Figure 1 The terminal 102 in the example is used as an example to illustrate, and the following steps are included:

[0144] Step S310: Generate a credential acquisition request based on the client identity of the client and the second blinded verification password.

[0145] The client identity is an identification code generated by the server and is provided to the server so that the server can retrieve the corresponding client identity authentication credentials according to the client identity.

[0146] The verification password can be generated by the terminal, generated by the client, or entered by the user. The verification password is used for identity authentication when obtaining the client private key. If the entered password is the same as the registered password, the verification is successful.

[0147] The second blinding process may be to encrypt the verification password to obtain a blinded verification password, and the encryption process may be implemented through a blind signature protocol. By performing the second blinding process on the verification password, the same or different parameters as those of the first blinding process may be used, so that no object other than the client can know the content of the registration password itself, thereby preventing the registration password from being intercepted by a third party during the registration transmission process, and avoiding the problem of password leakage when the server is hacked.

[0148] Generating a credential acquisition request may be to package the client identity and the verification password to obtain a data packet, and initiating a credential acquisition request to the server based on the data packet.

[0149] Step S320, sending the credential acquisition request to the server, and receiving credential feedback information from the server, wherein the credential feedback information includes the client identity authentication credential of the client and the signed blind verification password.

[0150] Among them, after sending the credential acquisition request, the credential feedback information from the server is received. The credential feedback information includes the client authentication credentials and the signed blind verification password. The client authentication credentials are obtained by encrypting the client private key with the signed registration password. The signed blind verification password is the blind verification password signed by the server private key. The server retrieves the client authentication credentials based on the client identity identifier, obtains the client authentication credentials, and signs the blind verification password, so that when the client obtains the credential feedback information, it can determine the authenticity of the credential feedback information based on the signature result, thereby enhancing the trust. Signing the verification password also means that the decryption of the client private key must be based on the signature of the server private key, further improving the security of registration and authentication between the client and the server.

[0151] Step S330: performing a second deblinding process on the signature blinded verification password to obtain the signature verification password.

[0152] Among them, the second deblinding process can be a deblinding process corresponding to the second blinding process to remove the original blinding result of the verification password, so as to obtain a signed verification password that only contains the server private key signature.

[0153] Step S340: decrypt the client identity authentication credentials based on the signed verification password to obtain the client private key.

[0154] Among them, the client authentication credentials are decrypted by signing the verification password, that is, symmetric encryption is adopted, and the signed registration password is used as the secret key for encrypting and decrypting the client authentication credentials. After the registration is completed, the client needs to obtain the client private key before it can verify the terminal identity and establish a long connection with the server. Therefore, if the input password is inconsistent with the registration password, the original client private key cannot be decrypted, thereby avoiding the storage of the registration password by both the client and the server. Even if the client or the server is hacked, it will not cause the leakage of the registration password.

[0155] Step S350: establishing a secure channel with the server based on the second terminal information signed by the client private key.

[0156] The second terminal information signed by the client private key can be used to verify the legitimacy of the source of the second terminal information, so that the server only needs to check whether the message of the second terminal information itself is legal, thereby establishing a secure channel for the server. The second terminal information can use the same or different content as the first terminal information, for example, it can also include client messages, timestamps, etc.

[0157] A client communication method provided in this embodiment can prevent the password from being known by the server by blinding the password, so that the server can process the registration request or credential acquisition request without knowing the password, thereby avoiding password leakage caused by the server being hacked; by deblinding the blinded password signed by the server, the password can be signed and authenticated by the server without being known by the server; the client identity authentication credential is decrypted by the signed verification password to obtain the client private key, so that the client private key can be decrypted only when the password is correct, thereby preventing the client private key from being stolen and used to reduce the communication security, thereby achieving the effect of improving the security of communication between the client and the server.

[0158] In some embodiments, the establishing of a secure channel with the server based on the second terminal information signed by the client private key includes:

[0159] Delete the client private key.

[0160] A client communication method provided in this embodiment not only reduces the amount of locally stored data by deleting the client private key after establishing a secure channel, but also makes it difficult for an attacker to obtain credentials that can be used to directly access the system even if the client device is compromised, thereby preventing the impact on the security of the server in the event of a client private key leakage, thereby achieving the effect of improving the security of communication between the client and the server.

[0161] In some embodiments, before generating the credential acquisition request based on the client identity of the client and the second blinded verification password, the step further includes:

[0162] Obtaining a verification password of the client;

[0163] generating a second blind signature parameter, wherein the second blind signature parameter includes a third random number and a fourth random number;

[0164] Based on the third random number, the fourth random number and the server public key of the server, the verification password is subjected to a second blinding process to obtain a registration password after the second blinding process.

[0165] The verification password of the client can be obtained by obtaining a verification password built into or generated by a terminal or a client, or by obtaining a verification password input by a user.

[0166] The second blind signature parameters are parameters generated by the blind signature protocol, including the third random number and the fourth random number generated by the pseudo-random algorithm. The third random number and the fourth random number are used to perform a second blinding process on the verification password, thereby obtaining a blinded verification password. The greatest common factor of the third random number and the fourth random number is 1, that is, the third random number and the fourth random number are mutually prime, thereby ensuring the accuracy of the blinding and deblinding process in the blind signature scheme. And when the greatest common factor of the third random number and the fourth random number is 1, the possibility of using the third random number to reversely deduce the fourth random number is greatly reduced, thereby improving the security of the blinded password.

[0167] Blind processing means transforming the original information based on the combination of a third random number and the server public key without revealing the original information. The transformed original password is converted into a seemingly random string, and the original password cannot be deduced.

[0168] In this embodiment, the first blind signature parameter may be the same as the second blind signature parameter, or may be a random number different from the first random number, so as to improve security during transmission.

[0169] A client communication method provided in this embodiment can protect the user's privacy and prevent the direct disclosure of the user password when it is intercepted during transmission by performing a second blinding process on the verification password based on the third random number, the fourth random number and the server public key of the server, thereby achieving the effect of improving the security of communication between the client and the server.

[0170] In some embodiments, performing a second unblinding process on the signature blinded verification password to obtain the signature verification password includes:

[0171] Based on the third random number, a second deblinding process is performed on the signature blinded verification password to obtain the signature verification password.

[0172] A client communication method provided in this embodiment performs a second blinding process on the verification password based on the third random number, the fourth random number and the server public key of the server, and performs a second unblinding process on the signed blinded verification password based on the third random number to obtain a signed verification password, thereby ensuring the integrity of data and the validity of the signature during the blinding and unblinding process, and improving the security of communication between the client and the server.

[0173] In some embodiments, establishing a secure channel with the server based on the second terminal information encrypted by the client private key includes:

[0174] Acquire second terminal information of the client; the second terminal information includes an IP address, a client message and a timestamp;

[0175] Generate a unilateral authentication package based on the client private key, the second terminal information and the client identity; the unilateral authentication package includes the client identity and the second terminal information signed by the client private key;

[0176] The unilateral authentication package is sent to the server, and an attempt is made to establish a secure channel with the server.

[0177] The IP address is an Internet Protocol address, and obtaining the second terminal information of the client may be obtaining the current IP address of the client, the client message and the timestamp.

[0178] A unilateral authentication package is generated based on the client private key, the second terminal information and the client identity. The second terminal information may be signed by the client private key, and a unilateral authentication package is generated based on the signed second terminal information and the client identity, so that the server can directly search for the corresponding client public key based on the client identity, thereby determining the legitimacy of the second terminal information.

[0179] The unilateral authentication package is sent to the server, and an attempt is made to establish a secure channel with the server. After sending the unilateral authentication package to the server, an attempt is made to establish a long connection with the server through a preset port of the server. If the server passes the authentication of the unilateral authentication package, the server will open the preset port to the IP address of the terminal to establish a long connection.

[0180] A client communication method provided in this embodiment can ensure that only legitimate clients can establish a connection with the server, and all data transmitted through this channel is encrypted and verified, thereby achieving the effect of improving the security of communication between the client and the server, by sending the unilateral authentication package to the server and attempting to establish a secure channel with the server.

[0181] In one embodiment, Figure 5 As shown, a client communication method is provided, which is applied to the server. Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0182] Step S410: receiving a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password.

[0183] The credential acquisition request and the client identity and blinded verification password therein may be the same as the embodiment of the client communication method applied to the client, and this embodiment is not limited here. Receiving the credential acquisition request sent by the client may be receiving the message data sent by the client and parsing the message data to obtain the credential.

[0184] Step S420, based on the client identity identifier, obtain credential feedback information, the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier, and the signed blinded verification password.

[0185] The credential feedback information is obtained based on the client identity, which can be performed by searching the database according to the client identity to obtain the client public key and client authentication credentials corresponding to the client identity, and signing the blinded verification password with the server private key to obtain the signed blinded verification password. Exemplarily, when the corresponding authentication credentials can be retrieved according to the client identity, it means that the client has completed the registration on the server and has stored the corresponding encrypted client private key, which is legitimate in the retrieval stage. Furthermore, when the client identity does not retrieve the corresponding authentication credentials, the credential feedback information can be forged according to the successful message to avoid attacks such as enumeration.

[0186] Step S430: sending the credential feedback information to the client.

[0187] Step S440: receiving the second terminal information of the client signed by the client private key, and establishing a secure channel with the client when the second terminal information is legal.

[0188] The second terminal information is signed by the client's private key, which can prove the legitimacy of the source of the second terminal information. When the source of the second terminal information and its own content are legal, the connection port to the client can be opened to connect, thereby establishing a secure channel.

[0189] A client communication method provided in this embodiment obtains a credential acquisition request through the server, queries the corresponding client identity authentication credential through the client identity identifier, and completes the signing of the password without knowing the content of the verification password. This can effectively reduce the risk of password theft and increase the defense capability against illegal access, thereby achieving the effect of improving the security of communication between the client and the server.

[0190] In some embodiments, establishing a secure channel with the client based on the second terminal information of the client encrypted by the client private key includes:

[0191] Obtaining a unilateral authentication package sent by the client; the unilateral authentication package includes a client identity and second terminal information signed by the client private key; the terminal information includes an IP address, a client message, and a timestamp;

[0192] Based on the client identity, obtaining a client public key corresponding to the client identity;

[0193] authenticating the client based on the client public key and the second terminal information;

[0194] If the identity authentication of the client is passed, the port is started to establish a secure channel with the server.

[0195] The identity authentication of the client may include verifying the signature, checking the timestamp, IP address and client message in the second terminal information, etc.

[0196] A client communication method provided in this embodiment authenticates the client based on the client public key and the second terminal information, and then starts a port to establish a secure channel with the server. This can effectively reduce the risk of password theft and increase the defense capability against illegal access, thereby achieving the effect of improving the security of communication between the client and the server.

[0197] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0198] Based on the same inventive concept, the embodiment of the present application also provides a terminal for implementing the client registration method and / or client communication method involved above. The implementation solution provided by the terminal to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more terminal embodiments provided below can refer to the limitations of the client registration method and / or client communication method above, and will not be repeated here.

[0199] In one embodiment, Figure 6As shown, a terminal is provided, the terminal comprising a client 110, a blinding module 120 and a deblinding module 130, wherein:

[0200] The blinding module 120 is used to perform blinding processing on the registration password;

[0201] The client 110 is used to generate a registration request based on the first terminal information of the client 110 and the first blinded registration password; send the registration request to the server, and receive registration feedback information from the server, the registration feedback information including the client identity of the client 110 and the signed blinded registration password;

[0202] The deblinding module 130 is used to perform a first deblinding process on the signed blinded registration password to obtain the signed registration password;

[0203] The client 110 is further configured to encrypt the client private key based on the signed registration password to generate a client identity authentication credential; and send the client identity authentication credential to the server.

[0204] Among them, the blinding module 120 and the unblinding module 130 can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0205] In some of these embodiments,

[0206] The blinding module 120 is also used to perform blinding processing on the verification password;

[0207] The client 110 is also used to generate a credential acquisition request based on the client identity of the client 110 and the second blinded verification password; send the credential acquisition request to the server, and receive credential feedback information from the server, the credential feedback information including the client identity authentication credential of the client 110 and the signed blinded verification password;

[0208] The deblinding module 130 is used to perform a second deblinding process on the signature blinded verification password to obtain the signature verification password;

[0209] The client 110 is also used to decrypt the client identity authentication credentials based on the signed verification password to obtain a client private key; and establish a secure channel with the server based on the terminal information encrypted by the client private key.

[0210] Based on the same inventive concept, the embodiment of the present application also provides a server for implementing the client registration method and / or client communication method involved above. The implementation solution provided by the server to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more server embodiments provided below can refer to the limitations of the client registration method and / or client communication method above, and will not be repeated here.

[0211] In one embodiment, Figure 7 As shown, a server is provided, the server includes a registration node and a management node, the registration node includes an access gateway and a terminal registration device 210, the management node includes an access gateway and a terminal management device 220, the terminal registration device 210 is connected to the terminal management device 220, the access gateway is used to open a port and forward the received data, wherein,

[0212] The terminal registration device 210 is used to receive a registration request sent by a client, the registration request including the first terminal information of the client and the first blinded registration password; determine whether the registration request is legal based on the terminal information; if the registration request is legal, forward the registration request to the terminal management device 220;

[0213] The terminal management device 220 is used to generate registration feedback information, which includes the client identity identifier and the signed blinded registration password of the client; send the registration feedback information to the client, and receive the client identity authentication credentials sent by the client and forwarded by the terminal registration device 210; store the client identity authentication credentials.

[0214] In some of these embodiments,

[0215] The terminal registration device 210 is further configured to receive a credential acquisition request sent by a client, the credential acquisition request including a client identity of the client and a second blinded verification password; and forward the credential acquisition request to the terminal management device 220;

[0216] The terminal management device 220 is also used to obtain credential feedback information based on the client identity identifier, and the credential feedback information includes the client identity authentication credentials corresponding to the client identity identifier, and a signed blind verification password; send the credential feedback information to the client; and establish a secure channel with the client based on the second terminal information of the client signed by the client private key.

[0217] In some embodiments, the server further includes a single packet authentication module 230, and the single packet authentication module 230 is connected to the terminal management device 220.

[0218] The single-packet authentication module 230 is used to obtain a unilateral authentication package sent by the client; the unilateral authentication package includes a client identity and second terminal information signed by the client private key; the terminal information includes an IP address, a client message and a timestamp; based on the client identity, obtain a client public key corresponding to the client identity; based on the client public key and the second terminal information, authenticate the client; if the client's identity authentication is passed, start a port to establish a secure channel between the terminal management device 220 and the server.

[0219] Each module in the above-mentioned terminal and server can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0220] In order to more clearly explain the technical solution of the present application, the present application also provides a detailed embodiment. This embodiment relates to a C / S (client / server) architecture system, in which the client software is installed on the terminal and a registration application is initiated. The registration process uses an inadvertent pseudo-random function to implement the key exchange between the client and the server. After the terminal is successfully registered, the server saves the terminal authentication credentials. The client uses the user password and the authentication credentials saved on the server to generate a private key, which can be used to authenticate the input of the key exchange protocol. The private key is used to encrypt the message during client authentication, and the server uses the public key generated during registration to decrypt the message to verify the terminal identity. After the authentication is passed, a secure channel is established, and the secure channel established in this way is also secure.

[0221] In one embodiment, Figure 8 As shown, a client registration communication system is provided, including a terminal and a server, the terminal is provided with a client, a blinding module and a deblinding module; the server includes a registration node and a management node, the registration node includes an access gateway and a terminal registration device, and the management node includes a single packet authentication module, an access gateway and a terminal management device.

[0222] The client sends a registration request to the registration node through the blinding module. The registration request includes the first terminal information and the blinded registration password that has been first blinded by the blinding module. The access gateway of the registration node receives the registration request through port 443 and forwards it to the terminal registration device through port 8443. The terminal registration device forwards the message to the management node through port 443. The access gateway forwards the message to the terminal management device through port 8085. The terminal management device obtains registration feedback information based on the registration request, that is, the registration response, and feeds it back to the terminal through the access gateway. The terminal's unblinding module receives the registration response and unblinds the signed blinded registration password to obtain the signed registration password. The client encrypts the client private key with the signed registration password to obtain the client identity authentication credentials, and sends the credentials to the registration node to complete the registration. In the management node, the terminal management device forwards the client identity authentication credentials to the management node, so that the single-packet authentication module updates the client identity and the client public key.

[0223] In this embodiment, SPA (Single Packet Authorization) technology is used, that is, during the authentication process, the client needs to send a UDP message to implement UDP knocking. After the authentication is passed, the single packet authentication module opens the TCP port, and the client can establish a TCP long connection with the server. In SPA open mode: the 443 port of the registration node is open to the outside world, and the 1445 port of the management node is not open by default. After the client authentication is passed, 1445, that is, the TCP port, is temporarily opened to the source IP.

[0224] In this embodiment, Fig. 9As shown, the construction and implementation of the blind pseudo-random function based on the Blind-RSA algorithm of blind signature is adopted. The client does not know the signature private key of the server, and the server cannot know the input data of the client. The performance is efficient and the security is ensured. The process based on the RSA blind signature and hash algorithm includes: the client obtains the input password X and generates random numbers r and n, the greatest common factor of r and n is 1, the server generates the server public key e and the server private key d, and sends the server public key e to the client. The client uses the random numbers r, n and the server public key e to blind the password X to obtain M, and sends M to the server. The server signs M with the private key d to obtain Z, and sends Z to the client. The client uses the random number r to unblind Z to obtain Y. Therefore, during the interaction between the client and the server, in addition to the server public key e, the sent password is encrypted by the blind signature. Therefore, even if it is eavesdropped during the transmission process, the third party cannot know the original text of the verification password. The verification password signed by the server private key, i.e., the signed verification password, can be referred to as an envelope. Specifically, the method of blinding X and obtaining M, Z, and Y can refer to the embodiment of the client registration method above, which will not be described in detail here.

[0225] The registration process requires server authentication and encrypted channel communication. The client needs to identify the server as a non-phishing website, and the server needs to identify the client. During the registration process, a blind signature protocol is used to generate an envelope to encrypt the client's private key, which can protect the security of the client's private key.

[0226] During the registration phase, Fig.10 As shown, the steps of the registration phase include:

[0227] 1. The user obtains the client installation package from the registration node, installs the client and fills in the registration node address to generate the client public and private keys.

[0228] 2. The user enters the user password, where the strength of the user password determines the difficulty of the secret key being cracked offline.

[0229] 3. The client collects terminal UUID, MAC, IP and other information to obtain the first terminal information, blindly processes the user password to generate a registration request, and submits the client registration request to the terminal registration device. The terminal registration device verifies that the registration request is legal. If it is illegal, the registration fails. If it is legal, the registration request is forwarded to the terminal management device.

[0230] 4. The terminal management device generates the public and private keys of the server, saves the client registration request, and prompts the administrator for approval; the administrator approves the client registration request through the terminal management device; determines whether the administrator's approval is passed. If the approval is passed, the client identity is generated, and the blinded user password is signed with the client private key to obtain the signature result, and the signature result and client identity are returned. The client performs deblinding based on the signature result and obtains an envelope, that is, the signed registration password.

[0231] 5. The client uses the envelope to encrypt the client private key, obtains the client authentication credentials, and returns the client authentication credentials and the client public key. The server saves the client identity, client authentication credentials, client public key and server private key to the database, and notifies the single-package authentication module to update the client identity and client public key.

[0232] 6. The client saves the client identity.

[0233] After completing the registration, the client needs to obtain the client's private key before establishing a secure channel with the server. At this time, the client's private key is stored in the server in an encrypted form, so a private key acquisition phase is required. Fig.11 As shown in the figure, the private key acquisition stage includes:

[0234] Open the client, enter the user password, the client blinds the user password, generates a key recovery material request, that is, a credential acquisition request, and the client sends the request to the terminal registration device. The terminal registration device verifies whether the request is legal. If it is not legal, the request fails; if it is legal, it is forwarded to the terminal management device, and the terminal management device uses the client identity to retrieve the client authentication credentials and the server private key. Determine whether the retrieval is successful. If the retrieval is successful, use the server private key to sign the blinded user password and return the signature result and the client authentication credentials to the client. The client unblinds the signature result to obtain an envelope, and uses the envelope to decrypt the client authentication credentials to obtain the client private key. As a result, the client can send the signed terminal information to the server through the client private key and establish a secure channel. In the above request, if the request is illegal or the retrieval fails, in order to prevent user enumeration attacks, the server can forge the response result according to the success message.

[0235] After the private key acquisition phase, the authentication phase begins. Fig.12 As shown, in the authentication phase, SPA technology is used to complete the identity authentication process through a single encrypted data packet, thereby improving security and efficiency. The steps include:

[0236] The client obtains the second terminal information: client identity, IP address, client message and timestamp, encrypts the authentication information (IP address, client information and timestamp) using the client private key, generates a UDP message, and sends the UDP message to the single-packet authentication module.

[0237] The single-packet authentication module captures and parses the UDP packet, uses the client identity to retrieve the client public key, and determines whether the retrieval is successful. If the retrieval fails, the authentication fails. If the retrieval is successful, the client public key is used to decrypt the authentication information; determine whether the decryption is successful. If the decryption fails, the authentication fails. If the decryption is successful, all fields are checked for specifications, including: 1. Verify whether the IP address is legal; 2. Verify whether the client segment message is legal; 3. Verify that the client has not initiated repeated identity authentication requests within a certain time range based on the timestamp. Determine whether the verification is successful. If the verification fails, the authentication fails. If the verification passes, the firewall is notified to open the TCP port for the IP address and forward it to the terminal management device through the WSS+HTTPS protocol.

[0238] After sending the unilateral authentication packet, the client attempts to establish a TCP connection. When the firewall opens the TCP port for the IP address, the connection is successfully established and a secure channel is established.

[0239] In the above stages, the client authentication is combined with the SPA single-packet authentication technology to authenticate the client identity first and then establish a secure connection, which can further improve the security of the client authentication. The authentication process is the same as the traditional authentication key exchange process. The restored private key and the public key stored on the server are used to implement asymmetric encryption and decryption to establish a secure channel. By adopting the RSA protocol based on blind signatures, the user password will not leave the client, thereby eliminating the security problems caused by password leakage. Since the client does not save the private key, but restores the private key according to the user password during authentication, it can effectively prevent the security problems caused by private key leakage. By using the oblivious pseudo-random function (OPRF) to implement password-based asymmetric key exchange, it can not only resist pre-calculation attacks, but also ensure the security of user credentials when the server is invaded or leaked, thereby achieving the effect of improving the security of client and server registration and authentication.

[0240] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the client registration method or the client communication method of any of the above embodiments is implemented:

[0241] When the computer program is executed by a processor, the client registration method of any of the above embodiments is implemented:

[0242] Generate a registration request based on the first terminal information of the client and the first blinded registration password;

[0243] Sending the registration request to the server, and receiving registration feedback information from the server, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0244] Performing a first unblinding process on the signed blinded registration password to obtain a signed registration password;

[0245] Encrypt the client private key based on the signed registration password to generate a client identity authentication credential;

[0246] Send the client authentication credentials to the server.

[0247] When the computer program is executed by a processor, the client communication method of any of the above embodiments is implemented:

[0248] Generate a credential acquisition request based on the client identity of the client and the second blinded verification password;

[0249] Sending the credential acquisition request to the server, and receiving credential feedback information from the server, the credential feedback information including the client identity authentication credential and the signed blind verification password of the client;

[0250] Performing a second unblinding process on the signature blinded verification password to obtain a signature verification password;

[0251] Decrypt the client identity authentication credentials based on the signed verification password to obtain the client private key;

[0252] A secure channel with the server is established based on the second terminal information signed by the client private key.

[0253] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the client registration method or the client communication method of any of the above embodiments is implemented:

[0254] When the computer program is executed by a processor, the client registration method of any of the above embodiments is implemented:

[0255] Receiving a registration request sent by a client, the registration request including first terminal information of the client and a first blinded registration password;

[0256] determining whether the registration request is legal based on the first terminal information;

[0257] If the registration request is legal, then generate registration feedback information, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0258] Sending the registration feedback information to the client, and receiving the client identity authentication credentials sent by the client;

[0259] The client identity authentication credentials are stored.

[0260] When the computer program is executed by a processor, the client communication method of any of the above embodiments is implemented:

[0261] Receive a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password;

[0262] Based on the client identity identifier, credential feedback information is obtained, wherein the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier and the signed blind verification password;

[0263] Sending the credential feedback information to the client;

[0264] The second terminal information of the client signed by the client private key is received, and when the second terminal information is legal, a secure channel is established with the client.

[0265] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the client registration method or the client communication method of any of the above embodiments:

[0266] When the computer program is executed by a processor, the client registration method of any of the above embodiments is implemented:

[0267] Receiving a registration request sent by a client, the registration request including first terminal information of the client and a first blinded registration password;

[0268] determining whether the registration request is legal based on the first terminal information;

[0269] If the registration request is legal, then generate registration feedback information, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0270] Sending the registration feedback information to the client, and receiving the client identity authentication credentials sent by the client;

[0271] The client identity authentication credentials are stored.

[0272] When the computer program is executed by a processor, the client communication method of any of the above embodiments is implemented:

[0273] Receive a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password;

[0274] Based on the client identity identifier, credential feedback information is obtained, wherein the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier and the signed blind verification password;

[0275] Sending the credential feedback information to the client;

[0276] The second terminal information of the client signed by the client private key is received, and when the second terminal information is legal, a secure channel is established with the client.

[0277] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the client registration method or the client communication method of any of the above embodiments:

[0278] When the computer program is executed by a processor, the client registration method of any of the above embodiments is implemented:

[0279] Receiving a registration request sent by a client, the registration request including first terminal information of the client and a first blinded registration password;

[0280] determining whether the registration request is legal based on the first terminal information;

[0281] If the registration request is legal, then generate registration feedback information, the registration feedback information including the client identity of the client and the signed blinded registration password;

[0282] Sending the registration feedback information to the client, and receiving the client identity authentication credentials sent by the client;

[0283] The client identity authentication credentials are stored.

[0284] When the computer program is executed by a processor, the client communication method of any of the above embodiments is implemented:

[0285] Receive a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password;

[0286] Based on the client identity identifier, credential feedback information is obtained, wherein the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier and the signed blind verification password;

[0287] Sending the credential feedback information to the client;

[0288] The second terminal information of the client signed by the client private key is received, and when the second terminal information is legal, a secure channel is established with the client.

[0289] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0290] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0291] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0292] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A client registration method, characterized in that: Applied to a client, the client registration method includes: Generate a registration request based on the first terminal information of the client and the first blinded registration password; Sending the registration request to the server, and receiving registration feedback information from the server, the registration feedback information including the client identity of the client and the signed blinded registration password; Performing a first unblinding process on the signed blinded registration password to obtain a signed registration password; Encrypt the client private key based on the signed registration password to generate a client identity authentication credential; Send the client authentication credentials to the server.

2. The client registration method according to claim 1, characterized in that: The sending of the client identity authentication credentials to the server includes: The client identity is stored, and the client private key is deleted.

3. The client registration method according to claim 1, characterized in that: Before generating the registration request based on the first terminal information and the first blinded registration password, the method further includes: Obtaining a registration password of the client; Generate a first blind signature parameter, wherein the first blind signature parameter includes a first random number and a second random number; the greatest common factor of the first random number and the second random number is 1; Based on the first random number, the second random number and the server public key of the server, a first blinding process is performed on the registration password to obtain a registration password after the first blinding process.

4. The client registration method according to claim 3, characterized in that: The performing a first unblinding process on the signed blinded registration password to obtain the signed registration password comprises: Based on the first random number, a first deblinding process is performed on the signed blinded registration password to obtain the signed registration password.

5. A client registration method, characterized in that: Applied to the server, the client registration method includes: Receiving a registration request sent by a client, the registration request including first terminal information of the client and a first blinded registration password; determining whether the registration request is legal based on the first terminal information; If the registration request is legal, then generate registration feedback information, the registration feedback information including the client identity of the client and the signed blinded registration password; Sending the registration feedback information to the client, and receiving the client identity authentication credentials sent by the client; The client identity authentication credentials are stored.

6. The client registration method according to claim 5, characterized in that: The first terminal information includes at least one of a universal unique identifier, a media access control address, and an Internet Protocol address, and the determining whether the registration request is legal based on the terminal information includes: Get the terminal whitelist; Based on the first terminal information, query the terminal whitelist; If the terminal whitelist includes the first terminal information, the registration request is legal.

7. A client communication method, characterized in that: Applied to a client, the client communication method includes: Generate a credential acquisition request based on the client identity of the client and the second blinded verification password; Sending the credential acquisition request to the server, and receiving credential feedback information from the server, the credential feedback information including the client identity authentication credential and the signed blind verification password of the client; Performing a second unblinding process on the signature blinded verification password to obtain a signature verification password; Decrypt the client identity authentication credentials based on the signed verification password to obtain the client private key; A secure channel with the server is established based on the second terminal information signed by the client private key.

8. The client communication method according to claim 7, characterized in that: The step of establishing a secure channel with the server based on the second terminal information signed by the client private key includes: Delete the client private key.

9. The client communication method according to claim 7, characterized in that: Before generating the credential acquisition request based on the client identity identifier of the client and the second blinded verification password, the method further includes: Obtaining a verification password of the client; Generate a second blind signature parameter, wherein the second blind signature parameter includes a third random number and a fourth random number; the greatest common factor of the third random number and the fourth random number is 1; Based on the third random number, the fourth random number and the server public key of the server, the verification password is subjected to a second blinding process to obtain a registration password after the second blinding process.

10. The client communication method according to claim 9, characterized in that: The performing a second deblinding process on the blinded signature verification password to obtain the signature verification password comprises: Based on the third random number, a second deblinding process is performed on the signature blinded verification password to obtain the signature verification password.

11. The client communication method according to claim 7, characterized in that: The establishing of a secure channel with the server based on the second terminal information encrypted by the client private key includes: Acquire second terminal information of the client; the second terminal information includes an IP address, a client message and a timestamp; Generate a unilateral authentication package based on the client private key, the second terminal information and the client identity; the unilateral authentication package includes the client identity and the second terminal information signed by the client private key; The unilateral authentication package is sent to the server, and an attempt is made to establish a secure channel with the server.

12. A client communication method, characterized in that: Applied to the server, the client communication method includes: Receive a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password; Based on the client identity identifier, credential feedback information is obtained, wherein the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier and the signed blind verification password; Sending the credential feedback information to the client; The second terminal information of the client signed by the client private key is received, and when the second terminal information is legal, a secure channel is established with the client.

13. The client communication method according to claim 12, characterized in that: The establishing of a secure channel with the client based on the second terminal information of the client encrypted by the client private key comprises: Obtaining a unilateral authentication package sent by the client; the unilateral authentication package includes a client identity and second terminal information signed by the client private key; the terminal information includes an IP address, a client message, and a timestamp; Based on the client identity, obtaining a client public key corresponding to the client identity; authenticating the client based on the client public key and the second terminal information; If the identity authentication of the client is passed, the port is started to establish a secure channel with the server.

14. A terminal, characterized in that: The terminal includes a client, a blinding module and a deblinding module, wherein: The blinding module is used to perform blinding processing on the registration password; The client is used to generate a registration request based on the first terminal information of the client and the first blinded registration password; send the registration request to the server, and receive registration feedback information from the server, the registration feedback information including the client identity of the client and the signed blinded registration password; The deblinding module is used to perform a first deblinding process on the signed blinded registration password to obtain the signed registration password; The client is also used to encrypt the client private key based on the signed registration password to generate a client identity authentication credential; and send the client identity authentication credential to the server.

15. The terminal according to claim 14, characterized in that: The blinding module is also used to perform blinding processing on the verification password; The client is also used to generate a credential acquisition request based on the client identity of the client and the second blinded verification password; send the credential acquisition request to the server, and receive credential feedback information from the server, the credential feedback information including the client identity authentication credential of the client and the signed blinded verification password; The deblinding module is used to perform a second deblinding process on the signature blinded verification password to obtain the signature verification password; The client is also used to decrypt the client identity authentication credentials based on the signature verification password to obtain the client private key; A secure channel with the server is established based on the terminal information encrypted by the client private key.

16. A server, characterized in that: The server includes a terminal registration device and a terminal management device, wherein the terminal registration device is in communication connection with the terminal management device, The terminal registration device is used to receive a registration request sent by a client, the registration request including the first terminal information of the client and the first blinded registration password; determine whether the registration request is legal based on the terminal information; if the registration request is legal, forward the registration request to the terminal management device; The terminal management device is used to generate registration feedback information, which includes the client identity identifier and the signed blinded registration password of the client; send the registration feedback information to the client, and receive the client identity authentication credentials sent by the client and forwarded by the terminal registration device; store the client identity authentication credentials.

17. The server according to claim 16, characterized in that The terminal registration device is further used to receive a credential acquisition request sent by a client, wherein the credential acquisition request includes a client identity of the client and a second blinded verification password; forwarding the credential acquisition request to the terminal management device; The terminal management device is further used to obtain credential feedback information based on the client identity identifier, wherein the credential feedback information includes the client identity authentication credential corresponding to the client identity identifier and the signed blind verification password; The credential feedback information is sent to the client; and a secure channel is established with the client based on the second terminal information of the client signed by the client private key.

18. The server according to claim 17, characterized in that: The server further includes a single packet authentication module, which is connected to the terminal management device. The single-packet authentication module is used to obtain a unilateral authentication package sent by the client; the unilateral authentication package includes a client identity and second terminal information signed by the client private key; the terminal information includes an IP address, a client message and a timestamp; based on the client identity, obtain a client public key corresponding to the client identity; authenticating the client based on the client public key and the second terminal information; If the identity authentication of the client is passed, a port is started to establish a secure channel between the terminal management device and the server.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 13 is implemented.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 13 is implemented.

Images