Identity authentication method and system, computer equipment and readable storage medium

Abstract

The invention provides an identity authentication method and system, computer equipment and a readable storage medium, and the method comprises the steps: a server side responds to a binding request sent by a first equipment side, generates an equipment feature code and a first communication credential of the first equipment side based on the equipment information of the first equipment side, and transmits the equipment feature code and the first communication credential to the first equipment side; carrying out binding request response based on the device feature code of the first device end and the first communication voucher; the second device end carries out abstract verification on the device feature code of the second device end and the device feature code of the first device end, and when the abstract verification result is that verification succeeds, the second device end stores the first communication voucher to complete identity binding; and the server side responds to an activation request sent by a third device side, and performs identity verification on the third device side based on the device information of the third device side and the second communication credential carried by the activation request. By adopting the method, the complexity and the cost of identity authentication are reduced.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an identity authentication method, system, computer equipment and readable storage medium. Background Art

[0002] Most of the existing network communication authentication methods are similar to HTTPS, that is, the client and server perform identity authentication by exchanging digital certificates to ensure the identity security of both parties and the credibility of the communication. This method is currently widely used in common network communications and has strong versatility.

[0003] However, the research found that when the client and server exchange digital certificates, both the client and the server need to request the required certificates from the authentication center to perform identity authentication. However, the deployment and operation of the authentication center requires manpower and material resources and occupies network resources, thereby increasing the complexity and cost of identity authentication. Summary of the invention

[0004] In view of this, an object of the present invention is to provide an identity authentication method, system, computer device and readable storage medium to reduce the complexity and cost of identity authentication.

[0005] In a first aspect, an embodiment of the present application provides an identity authentication method, which is applied to an identity authentication system. The system includes several device ends and a server end. The method includes:

[0006] The server generates, in response to the binding request sent by the first device, a device feature code and a first communication credential of the first device based on the device information of the first device, and responds to the binding request based on the device feature code and the first communication credential of the first device;

[0007] The second device performs digest verification on its own device feature code and the device feature code of the first device, and when the digest verification result is successful, the second device saves the first communication credential to complete identity binding;

[0008] The server responds to the activation request sent by the third device and authenticates the third device based on the device information of the third device and the second communication credential carried in the activation request.

[0009] Optionally, the generating the device feature code and the first communication credential of the first device end based on the device information of the first device end includes:

[0010] Generate a device feature code of the first device end according to the device information of the first device end and a feature code generation algorithm;

[0011] The first communication credential is generated according to the device ID of the first device end and the device feature code of the first device end.

[0012] Optionally, before the second device performs digest verification on its own device feature code and the device feature code of the first device, the method further includes:

[0013] The second device generates its own device feature code according to its own device information and a feature code generation algorithm.

[0014] Optionally, the performing digest verification on the device feature code of the device itself and the device feature code of the first device end includes:

[0015] Perform M5 digest processing on its own device feature code and the device feature code of the first device end to obtain first summary data and second summary data respectively;

[0016] determining whether the first summary data and the second summary data are the same;

[0017] If the first summary data and the second summary data are the same, the summary verification result is determined as verification success.

[0018] Optionally, the authenticating the third device end based on the device information of the third device end and the second communication credential carried in the activation request includes:

[0019] Determine whether the device information of the third device end is the same as the device ID of the first device end, and determine whether the second communication credential is the same as the first communication credential;

[0020] If the device information of the third device is the same as the device ID of the first device, and the second communication credential is the same as the first communication credential, the identity authentication result of the third device is determined as successful authentication.

[0021] Optionally, after determining whether the device information of the third device end is the same as the device ID of the first device end, and determining whether the second communication credential is the same as the first communication credential, the method further includes:

[0022] If the device information of the third device end is different from the device ID of the first device end, or the second communication credential is different from the first communication credential, the identity authentication result of the third device end is determined as verification failure.

[0023] Optionally, the method further comprises:

[0024] The third device determines whether its second communication certificate has exceeded the validity period of the certificate;

[0025] If the second communication credential exceeds the validity period of the credential, the third device sends a credential update request to the server;

[0026] The server generates a new communication credential based on the device information of the third device in response to the credential update request, and returns the new communication credential to the third device.

[0027] In a second aspect, an embodiment of the present application provides an identity authentication system, the system comprising several device ends and a server end:

[0028] The server is configured to respond to a binding request sent by a first device, generate a device feature code and a first communication credential of the first device based on device information of the first device, and respond to the binding request based on the device feature code and the first communication credential of the first device;

[0029] The second device end is used to perform digest verification on its own device feature code and the device feature code of the first device end, and when the digest verification result is successful, the second device end saves the first communication credential to complete identity binding;

[0030] The server is used to respond to the activation request sent by the third device and authenticate the third device based on the device information of the third device and the second communication credential carried in the activation request.

[0031] Optionally, the generating the device feature code and the first communication credential of the first device end based on the device information of the first device end includes:

[0032] Generate a device feature code of the first device end according to the device information of the first device end and a feature code generation algorithm;

[0033] The first communication credential is generated according to the device ID of the first device end and the device feature code of the first device end.

[0034] Optionally, the second device end is further used to generate its own device feature code according to its own device information and feature code generation algorithm before performing digest verification on its own device feature code and the device feature code of the first device end.

[0035] Optionally, the performing digest verification on the device feature code of the device itself and the device feature code of the first device end includes:

[0036] Perform M5 digest processing on its own device feature code and the device feature code of the first device end to obtain first summary data and second summary data respectively;

[0037] determining whether the first summary data and the second summary data are the same;

[0038] If the first summary data and the second summary data are the same, the summary verification result is determined as verification success.

[0039] Optionally, the authenticating the third device end based on the device information of the third device end and the second communication credential carried in the activation request includes:

[0040] Determine whether the device information of the third device end is the same as the device ID of the first device end, and determine whether the second communication credential is the same as the first communication credential;

[0041] If the device information of the third device is the same as the device ID of the first device, and the second communication credential is the same as the first communication credential, the identity authentication result of the third device is determined as successful authentication.

[0042] Optionally, after determining whether the device information of the third device end is the same as the device ID of the first device end, and determining whether the second communication credential is the same as the first communication credential, if the device information of the third device end is not the same as the device ID of the first device end, or the second communication credential is not the same as the first communication credential, the identity authentication result of the third device end is determined as verification failure.

[0043] Optionally, the third device is used to determine whether its second communication credential exceeds the validity period of the credential;

[0044] The third device is configured to send a credential update request to the server if the second communication credential exceeds the validity period of the credential;

[0045] The server responds to the credential update request, generates a new communication credential based on the device information of the third device, and returns the new communication credential to the third device.

[0046] In a third aspect, an embodiment of the present application provides a computer device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the identity authentication method described in any optional implementation manner of the first aspect above are performed.

[0047] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the identity authentication method described in any optional implementation manner in the above-mentioned first aspect are executed.

[0048] The technical solution provided by this application includes but is not limited to the following beneficial effects:

[0049] This application adopts an identity authentication system. The server responds to the binding request sent by the first device, generates the device feature code and the first communication credential of the first device based on the device information of the first device, and responds to the binding request based on the device feature code and the first communication credential of the first device. The second device performs a summary verification on its own device feature code and the device feature code of the first device. When the summary verification result is successful, the second device saves the first communication credential to complete the identity binding. Through the above steps, the identity binding of the complete device and the server can be achieved without the need for the authentication center as a medium. Then, the server responds to the activation request sent by the third device, and authenticates the identity of the third device based on the device information of the third device and the second communication credential carried in the activation request. The device and the server can authenticate the identity of the device without requesting a certificate from the authentication center, thereby reducing the complexity of identity authentication and deployment and maintenance costs.

[0050] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 A flow chart of an identity authentication method provided by Embodiment 1 of the present invention is shown;

[0053] Figure 2 A flow chart of a method for generating a first communication credential provided in Embodiment 1 of the present invention is shown;

[0054] Figure 3 A flow chart of a method for calculating a device characteristic code provided in the first embodiment of the present invention is shown;

[0055] Figure 4A flow chart of a device feature code verification method provided by Embodiment 1 of the present invention is shown;

[0056] Figure 5 A flow chart of a method for determining identity authentication on a device provided in the first embodiment of the present invention is shown;

[0057] Figure 6 A flow chart of a communication credential updating method provided in Embodiment 1 of the present invention is shown;

[0058] Figure 7 A schematic diagram showing a communication credential update process provided by Embodiment 1 of the present invention is shown;

[0059] Figure 8 A schematic diagram showing a specific identity authentication process provided by the first embodiment of the present invention;

[0060] Fig. 9 A schematic diagram of the structure of an identity authentication system provided by Embodiment 2 of the present invention is shown;

[0061] Fig.10 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention is shown. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

[0063] Embodiment 1

[0064] To facilitate understanding of this application, Figure 1 The flowchart of an identity authentication method provided in the first embodiment of the present invention is shown to describe the contents of the first embodiment of the present application in detail.

[0065] See also Figure 1 As shown, Figure 1 A flowchart of an identity authentication method provided by Embodiment 1 of the present invention is shown, wherein the method is applied to an identity authentication system, the system includes several device ends and a server end, and the method includes steps S101 to S105:

[0066] S101: The server generates a device feature code and a first communication credential of the first device based on device information of the first device in response to a binding request sent by the first device, and responds to the binding request based on the device feature code and the first communication credential of the first device.

[0067] Specifically, before identity authentication, the device information needs to be registered and bound on the server. At this time, the first device sends a binding request to the server to initiate binding. The binding request carries the device information of the first device. The device information includes device ID, device parameters, feature code generation algorithm, timestamp and data summary.

[0068] The server responds to the binding request sent by the first device end and generates a device feature code of the first device end according to the device parameters and feature code generation algorithm carried in the binding request. Then, the first communication credential is generated according to the device ID carried in the binding request and the device feature code of the first device end. The server then returns information such as the device feature code of the first device end, the first communication credential, the timestamp, the credential validity period, and the data summary to several device ends including the first device end in response to the binding.

[0069] S102: The second device performs digest verification on its own device feature code and the device feature code of the first device. When the digest verification result is successful, the second device saves the first communication credential to complete identity binding.

[0070] Specifically, the device end (referred to as the second device end) that receives the binding request response performs digest verification on its own device feature code and the device feature code of the first device end to determine whether its own device feature code and the device feature code of the first device end are the same. If they are the same, it means that the second device end is the first device end that initiated the binding to the server end, and the second device end saves the first communication credential to complete the identity binding.

[0071] S103: The server, in response to the activation request sent by the third device, authenticates the third device based on the device information of the third device and the second communication credential carried in the activation request.

[0072] Specifically, when the identity of the device is to be authenticated, the device for identity authentication (referred to as the third device) sends an activation request to the server, and the activation request carries the device information of the third device and the communication credentials stored in the third device (referred to as the second communication credentials). The server responds to the activation request sent by the third device and authenticates the third device based on the device information carried in the activation request and the second communication credentials carried in the activation request.

[0073] In an alternative embodiment, see Figure 2 As shown, Figure 2 A flowchart of a method for generating a first communication credential provided in Embodiment 1 of the present invention is shown, wherein the method for generating a device feature code and a first communication credential of the first device end based on the device information of the first device end includes steps S201 to S202:

[0074] S201: Generate a device feature code of the first device end according to the device information of the first device end and a feature code generation algorithm.

[0075] S202: Generate the first communication credential according to the device ID of the first device and the device feature code of the first device.

[0076] Specifically, the device ID is associated with the device parameters and stored, and then the device feature code of the first device is generated according to the feature code generation algorithm and the device parameters, and then associated with the device ID and saved. Then the device ID, the device feature code of the first device and the timestamp are used to generate the first communication credential by performing an MD5 digest, and the communication credential validity period is generated based on the preset validity period.

[0077] At the same time, the data can also be encrypted in the above process to ensure data security. Specifically, the device and the server have the same symmetric encryption key. The device obtains the device parameters, device ID and feature code generation algorithm sequence number to form a binding frame, which is uploaded to the server after symmetric encryption. After the server decrypts, it obtains the frame information and synthesizes the device feature code based on the frame information, which is saved and used for subsequent verification.

[0078] In an optional implementation, before the second device performs digest verification on its own device feature code and the device feature code of the first device, the method further includes:

[0079] The second device generates its own device feature code according to its own device information and a feature code generation algorithm.

[0080] Specifically, the second device end obtains the device parameters in its device information, and uses a pre-configured feature code generation algorithm, that is, a device feature code algorithm, to calculate and obtain the device feature code of the second device end.

[0081] The feature code generation algorithm provided in this application can obtain a feature value based on the hardware information of the device through a custom mathematical calculation process. Figure 3 As shown, Figure 3A flow chart of a device feature code calculation method provided in the first embodiment of the present invention is shown, wherein device parameters are input, the device parameters include a unique identification code of a TCU billing control module, a unique identification code of a PSU power control module, a unique identification code of a PCU switch control module, and a unique identification code of a CCU charging control module, and then an algorithm serial number (for example, the number 1) is input, the algorithm serial number and the obtained identification code are interspersed to generate a character string, and a serial number is included between every two identification codes, and the serial number and the identification code are separated by a space (for example, unique identification code of TCU 1 unique identification code of PSU 1 unique identification code of PCU 1 unique identification code of CCU), and finally the combined character string is summarized by methods such as SM3 / SHA / MD5 to obtain a feature code.

[0082] In an alternative embodiment, see Figure 4 As shown, Figure 4 A flow chart of a device feature code verification method provided by the first embodiment of the present invention is shown, wherein the digest verification of the device feature code of the device itself and the device feature code of the first device end includes steps S401 to S403:

[0083] S401: Perform M5 digest processing on its own device feature code and the device feature code of the first device end to obtain first summary data and second summary data respectively.

[0084] S402: Determine whether the first summary data and the second summary data are the same.

[0085] S403: If the first summary data and the second summary data are the same, determine the summary verification result as successful verification.

[0086] Specifically, MD5 digest processing is performed on the device feature code of the second device end and the device feature code of the first device end respectively. When the digest data obtained by processing are the same, it means that the second device end is the first device end that initiated the binding, and the digest verification result is determined to be successful verification; if the first summary data and the second summary data are different, it means that the second device end is not the first device end that initiated the binding, and the digest verification result is determined to be failed verification. At this time, the binding initiated by the first device end fails.

[0087] In an alternative embodiment, see Figure 5 As shown, Figure 5 A flow chart of a method for determining a device identity authentication provided by a first embodiment of the present invention is shown, wherein the authentication of the third device end based on the device information of the third device end and the second communication credential carried in the activation request includes steps S501 to S502:

[0088] S501: Determine whether the device information of the third device end is the same as the device ID of the first device end, and determine whether the second communication credential is the same as the first communication credential.

[0089] S502: If the device information of the third device is the same as the device ID of the first device, and the second communication credential is the same as the first communication credential, the identity authentication result of the third device is determined as successful authentication.

[0090] Specifically, the criterion for successful identity authentication is that the device ID of the device end and the communication credentials stored thereon are the same as the device ID and communication credentials bound to the server end. Therefore, if the device information of the third device end is the same as the device ID of the first device end, and the second communication credential is the same as the first communication credential, the identity authentication result of the third device end is determined to be successful.

[0091] In an optional implementation, after determining whether the device information of the third device end is the same as the device ID of the first device end, and determining whether the second communication credential is the same as the first communication credential, the method further includes:

[0092] If the device information of the third device end is different from the device ID of the first device end, or the second communication credential is different from the first communication credential, the identity authentication result of the third device end is determined as verification failure.

[0093] Specifically, on the contrary, if the device information of the third device end is different from the device ID of the first device end, or the second communication credential is different from the first communication credential, it means that the device end that initiated the identity authentication has not completed the binding on the server end, then the identity authentication result of the third device end is determined as verification failure.

[0094] In an alternative embodiment, see Figure 6 As shown, Figure 6 A flow chart of a communication credential updating method provided in the first embodiment of the present invention is shown, wherein the method further comprises steps S601 to S603:

[0095] S601: The third device determines whether its second communication credential has exceeded the validity period of the credential.

[0096] S602: If the second communication credential exceeds the validity period of the credential, the third device sends a credential update request to the server.

[0097] S603: The server generates a new communication credential based on the device information of the third device in response to the credential update request, and returns the new communication credential to the third device.

[0098] Specifically, during normal communication, the device and the platform need to periodically determine whether the communication credential is within the validity period. If it is exceeded, the credential needs to be updated. The third device determines whether the second communication credential stored by it exceeds the credential validity period. If the second communication credential exceeds the credential validity period, the device will initiate the credential update process. Figure 7 As shown, Figure 7 A schematic diagram of a communication credential update process provided by a first embodiment of the present invention is shown, wherein the device side requests a new credential from the server side, and the request includes the device unique ID and the previous communication credential (i.e., the second communication credential). After summarizing the two, the two and the summary are encrypted (encryption can be selected according to actual needs) and sent to the server side. The server side verifies the summary information and the previous communication credential included, and after generating a new credential based on the device information of the third device side, returns the credential, timestamp, validity period, and data summary to the device side to respond to the new credential request. After receiving the response, the device side returns the device ID, new credential, and data summary to the server side to activate the credential.

[0099] Generate a new communication credential based on the device information of the third device, including: generate a device feature code of the third device according to the device information of the third device and a feature code generation algorithm; generate a new communication credential according to the device ID of the third device and the device feature code of the third device.

[0100] This application provides an identity authentication method for use in the identity authentication between a charging pile (equivalent to a device) and a network platform (equivalent to a server). Figure 8 As shown, Figure 8 A schematic diagram of a specific identity authentication process provided by the first embodiment of the present invention is shown, wherein the specific identity authentication process includes:

[0101] After the charging pile device is powered on, the built-in program runs to obtain the device information of the device, including the device unique ID, device parameters, feature code generation algorithm, timestamp and data summary, hardware version number, software version number, etc. The device information is sent to the platform to initiate binding. Specifically, the device side summarizes and signs the device parameters and feature generation algorithm serial number, the timestamp of the current time and the unique identifier of the device (uuid) through algorithms such as SM3 / SHA / MD5, and then composes the summary, timestamp, device unique identifier and device parameters collected in step 1 into a binding frame, which is encrypted and sent to the target platform.

[0102] The server parses the device information, reads the serial number of the feature generation algorithm specified in the configuration file, and selects the specified feature generation algorithm according to the serial number to calculate the aforementioned collected device parameters to obtain the device feature code. That is, the device unique ID is associated with the device parameters and stored, and the device feature code is generated according to the feature code generation algorithm and device parameters, and managed and saved with the device unique ID. The device unique ID, device feature code and timestamp are processed with MD5 digest to generate communication credentials, and the validity period of the communication credentials is generated. The communication credentials, timestamp, credential validity period, and data summary are sent back to the device to respond to the binding. Specifically, the target platform receives the message sent in step three, first decrypts it, and parses out the feature generation algorithm serial number, device parameters, timestamp, and device unique identifier, and then selects the corresponding algorithm according to the feature generation algorithm serial number to calculate the device parameters to obtain the device feature code. Then, the device feature code and the message content (excluding summary information) received and decrypted in step three are summarized by algorithms such as SM3 / SHA / MD5, and compared with the summary information in the message. If the two summaries are the same, the platform determines whether it has been bound according to the device unique identifier; if the two summaries are not the same, an error message is generated and sent to the device after encryption. If it has been bound, the platform generates a communication credential, associates and saves the communication credential with the device unique identifier, then binds the communication credential with the device unique identifier, timestamp, and credential validity period, and summarizes and signs it by algorithms such as SM3 / SHA / MD5, then composes a binding response frame with the original data, and encrypts and sends it to the device. If it has not been bound, the platform associates and saves the device unique identifier with the device parameters, then generates a communication credential, associates and saves the communication credential with the device unique identifier, then summarizes and signs the communication credential with the device unique identifier, timestamp, credential validity period and device feature code by algorithms such as SM3 / SHA / MD5, then composes a binding response frame with the original data that does not contain the device feature code, and encrypts and sends it to the device.

[0103] The device side regenerates the device signature code and performs summary verification. After the verification is passed, the communication credentials and validity period are saved, and the unique device ID and credentials (new credentials if updated) and data summary are sent to the platform side to activate the credentials. Specifically, the device receives the binding response frame from the target platform, decrypts and parses the message content, and then uses the device signature code to calculate the non-summary information in the message through algorithms such as SM3 / SHA / MD5, and compares the summary information in the message with the calculated summary information. If the comparison is successful, the new communication credentials are saved for subsequent communication. If the comparison fails, the binding request is re-initiated. After the binding is successful, the target platform will have the device parameters of the device initiating the binding and the specified device feature generation algorithm. The target platform and the device can generate the same device signature code through the feature generation algorithm and device parameters. In subsequent communications, both parties will summarize this device signature code with the frame data to verify the source of the information.

[0104] The server digests the received device unique ID and new credentials, and compares them based on the received digest to ensure that the data has not been changed. It then compares the device unique ID and new credentials with the bound device unique ID and credentials. If they are the same, activation is completed, otherwise it fails.

[0105] During the communication process after binding, the device detects in real time whether the communication credentials are within the validity period. If so, the communication is normal. If not, the device calculates the device unique identification code (uuid) and the existing communication credentials through algorithms such as M3 / SHA / MD5 to obtain a digest, and combines the digest with the device unique identification code (uuid) and the existing communication credentials to form an authentication frame, which is then encrypted and sent.

[0106] Embodiment 2

[0107] See also Fig. 9 As shown, Fig. 9 The structure diagram of an identity authentication system provided by the second embodiment of the present invention is shown, wherein the system includes several device ends 901 and a server end 902:

[0108] The server is configured to respond to a binding request sent by a first device, generate a device feature code and a first communication credential of the first device based on device information of the first device, and respond to the binding request based on the device feature code and the first communication credential of the first device;

[0109] The second device end is used to perform digest verification on its own device feature code and the device feature code of the first device end, and when the digest verification result is successful, the second device end saves the first communication credential to complete identity binding;

[0110] The server is used to respond to the activation request sent by the third device and authenticate the third device based on the device information of the third device and the second communication credential carried in the activation request.

[0111] In an optional implementation, the generating the device feature code and the first communication credential of the first device end based on the device information of the first device end includes:

[0112] Generate a device feature code of the first device end according to the device information of the first device end and a feature code generation algorithm;

[0113] The first communication credential is generated according to the device ID of the first device end and the device feature code of the first device end.

[0114] Optionally, the second device end is further used to generate its own device feature code according to its own device information and feature code generation algorithm before performing digest verification on its own device feature code and the device feature code of the first device end.

[0115] Optionally, the performing digest verification on the device feature code of the device itself and the device feature code of the first device end includes:

[0116] Perform M5 digest processing on its own device feature code and the device feature code of the first device end to obtain first summary data and second summary data respectively;

[0117] determining whether the first summary data and the second summary data are the same;

[0118] If the first summary data and the second summary data are the same, the summary verification result is determined as verification success.

[0119] Optionally, the authenticating the third device end based on the device information of the third device end and the second communication credential carried in the activation request includes:

[0120] Determine whether the device information of the third device end is the same as the device ID of the first device end, and determine whether the second communication credential is the same as the first communication credential;

[0121] If the device information of the third device is the same as the device ID of the first device, and the second communication credential is the same as the first communication credential, the identity authentication result of the third device is determined as successful authentication.

[0122] Optionally, after determining whether the device information of the third device end is the same as the device ID of the first device end, and determining whether the second communication credential is the same as the first communication credential, if the device information of the third device end is not the same as the device ID of the first device end, or the second communication credential is not the same as the first communication credential, the identity authentication result of the third device end is determined as verification failure.

[0123] Optionally, the third device is used to determine whether its second communication credential exceeds the validity period of the credential;

[0124] The third device is configured to send a credential update request to the server if the second communication credential exceeds the validity period of the credential;

[0125] The server responds to the credential update request, generates a new communication credential based on the device information of the third device, and returns the new communication credential to the third device.

[0126] Embodiment 3

[0127] Based on the same application concept, see Fig.10 As shown, Fig.10 FIG. 4 shows a schematic diagram of the structure of a computer device provided by Embodiment 3 of the present invention, wherein: Fig.10 As shown, a computer device 1000 provided in Embodiment 3 of the present application includes:

[0128] A processor 1001, a memory 1002 and a bus 1003, wherein the memory 1002 stores machine-readable instructions executable by the processor 1001. When the computer device 1000 is running, the processor 1001 communicates with the memory 1002 via the bus 1003, and the machine-readable instructions are executed by the processor 1001 to execute the steps of the identity authentication method shown in the above-mentioned embodiment 1.

[0129] Embodiment 4

[0130] Based on the same application concept, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the identity authentication method described in any one of the above embodiments are executed.

[0131] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0132] The computer program product for identity authentication provided in the embodiment of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be found in the method embodiment and will not be repeated here.

[0133] The identity authentication system provided in the embodiment of the present invention can be specific hardware on the device or software or firmware installed on the device. The system provided in the embodiment of the present invention has the same implementation principle and technical effects as the aforementioned method embodiment. For the sake of brief description, for the parts not mentioned in the system embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. It can be clearly understood by technicians in the relevant field that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0134] In the embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. The system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some communication interface, device or unit, which can be electrical, mechanical or other forms.

[0135] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0136] In addition, each functional unit in the embodiment provided by the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0137] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0138] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0139] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can still modify the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or perform equivalent replacements on some of the technical features thereof; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. They should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An identity authentication method, characterized in that: Applied to an identity authentication system, the system includes several device ends and a server end, and the method includes: The server generates, in response to the binding request sent by the first device, a device feature code and a first communication credential of the first device based on the device information of the first device, and responds to the binding request based on the device feature code and the first communication credential of the first device; The second device performs digest verification on its own device feature code and the device feature code of the first device, and when the digest verification result is successful, the second device saves the first communication credential to complete identity binding; The server responds to the activation request sent by the third device and authenticates the third device based on the device information of the third device and the second communication credential carried in the activation request.

2. The method according to claim 1, characterized in that The generating the device feature code and the first communication credential of the first device end based on the device information of the first device end includes: Generate a device feature code of the first device end according to the device information of the first device end and a feature code generation algorithm; The first communication credential is generated according to the device ID of the first device end and the device feature code of the first device end.

3. The method according to claim 1, characterized in that Before the second device performs digest verification on its own device feature code and the device feature code of the first device, the method further includes: The second device generates its own device feature code according to its own device information and a feature code generation algorithm.

4. The method according to claim 1, characterized in that: The performing digest verification on the device feature code of the device itself and the device feature code of the first device end includes: Perform M5 digest processing on its own device feature code and the device feature code of the first device end to obtain first summary data and second summary data respectively; determining whether the first summary data and the second summary data are the same; If the first summary data and the second summary data are the same, the summary verification result is determined as verification success.

5. The method according to claim 1, characterized in that The authenticating the third device end based on the device information of the third device end and the second communication credential carried in the activation request includes: Determine whether the device information of the third device end is the same as the device ID of the first device end, and determine whether the second communication credential is the same as the first communication credential; If the device information of the third device is the same as the device ID of the first device, and the second communication credential is the same as the first communication credential, the identity authentication result of the third device is determined as successful authentication.

6. The method according to claim 5, characterized in that After determining whether the device information of the third device end is the same as the device ID of the first device end, and determining whether the second communication credential is the same as the first communication credential, the method further includes: If the device information of the third device end is different from the device ID of the first device end, or the second communication credential is different from the first communication credential, the identity authentication result of the third device end is determined as verification failure.

7. The method according to claim 1, characterized in that The method further comprises: The third device determines whether its second communication certificate has exceeded the validity period of the certificate; If the second communication credential exceeds the validity period of the credential, the third device sends a credential update request to the server; The server generates a new communication credential based on the device information of the third device in response to the credential update request, and returns the new communication credential to the third device.

8. An identity authentication system, characterized in that: The system includes several device ends and service ends: The server is configured to respond to a binding request sent by a first device, generate a device feature code and a first communication credential of the first device based on device information of the first device, and respond to the binding request based on the device feature code and the first communication credential of the first device; The second device end is used to perform digest verification on its own device feature code and the device feature code of the first device end, and when the digest verification result is successful, the second device end saves the first communication credential to complete identity binding; The server is used to respond to the activation request sent by the third device and authenticate the third device based on the device information of the third device and the second communication credential carried in the activation request.

9. A computer device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the identity authentication method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the identity authentication method as claimed in any one of claims 1 to 7.

Images