Identity authentication method and device, electronic equipment and computer readable storage medium

Abstract

The embodiment of the invention relates to the technical field of data security, and discloses an identity authentication method and device, electronic equipment and a computer readable storage medium, the method is applied to terminal equipment, and the method comprises the following steps: acquiring website login information corresponding to an accessed target website; obtaining a target voucher identifier corresponding to the website login information; a first authentication request is sent to the target authenticator, the first authentication request comprises the target certificate identifier, the first authentication request is used for indicating the target authenticator to perform identity authentication, and the identity authentication result is signed according to a first key corresponding to the target certificate identifier to obtain a signature value; and receiving an identity authentication result and a signature value fed back by the target authenticator, wherein the signature value is used for verifying whether the identity authentication result is legal. By implementing the embodiment of the invention, the risk of leakage of the certificate identifier in transmission can be reduced, and the login security is improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and specifically to an identity authentication method and device, an electronic device, and a computer-readable storage medium. Background Art

[0002] When a user registers an account on a website, the authenticator (e.g. fingerprint module, face recognition module, etc.) will generate a corresponding credential identifier and store it in the website's website server. In the subsequent identity verification process, the website server first sends the credential identifier to the terminal device, and then the terminal device forwards the registration credential to the authenticator to assist in verifying whether the identity of the logged-in user is legitimate.

[0003] In practice, it is found that credential identification can be easily intercepted and leaked during transmission between multiple devices, thereby reducing the security of login. Summary of the invention

[0004] The embodiments of the present application disclose an identity authentication method and device, an electronic device, and a computer-readable storage medium, which can reduce the risk of credential identification leakage during transmission and improve login security.

[0005] In a first aspect, an embodiment of the present application discloses an identity authentication method, which is applied to a terminal device. The method includes:

[0006] Get the website login information corresponding to the target website visited;

[0007] Obtaining a target credential identifier corresponding to the website login information;

[0008] Sending a first authentication request to a target authenticator, the first authentication request including the target credential identifier, the first authentication request being used to instruct the target authenticator to perform identity authentication, and signing the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value;

[0009] The identity authentication result and the signature value fed back by the target authenticator are received, and the signature value is used to verify whether the identity authentication result is legal.

[0010] A second aspect of an embodiment of the present application discloses an identity authentication method, which is applied to a target authenticator. The method includes:

[0011] Receiving a first authentication request sent by a terminal device, wherein the first authentication request includes a target credential identifier, and the target credential identifier is a credential identifier corresponding to website login information of a target website to be visited;

[0012] Performing identity authentication according to the first authentication request to obtain an identity authentication result, and signing the identity authentication result according to the first key corresponding to the target credential identifier to obtain a signature value;

[0013] The identity authentication result and the signature value are sent to the terminal device, and the signature value is used to verify whether the identity authentication result is legal.

[0014] A third aspect of the present application discloses an identity authentication device, which is applied to a terminal device. The device includes:

[0015] A first acquisition unit is used to acquire website login information corresponding to the visited target website;

[0016] A second acquisition unit, configured to acquire a target credential identifier corresponding to the website login information;

[0017] a first sending unit, configured to send a first authentication request to a target authenticator corresponding to the target authenticator identifier, wherein the first authentication request includes the target credential identifier, and the first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value;

[0018] The first receiving unit is used to receive the identity authentication result and the signature value fed back by the target authenticator, where the signature value is used to verify whether the identity authentication result is legal.

[0019] A fourth aspect of the present application discloses an identity authentication device, which is applied to a target authenticator. The device includes:

[0020] A second receiving unit is configured to receive a first authentication request sent by a terminal device, wherein the first authentication request includes a target credential identifier, and the target credential identifier is a credential identifier corresponding to website login information of a target website to be visited;

[0021] a signing unit, configured to perform identity authentication according to the first authentication request to obtain an identity authentication result, and sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value;

[0022] The second sending unit is used to send the identity authentication result and the signature value to the terminal device, and the signature value is used to verify whether the identity authentication result is legal.

[0023] A fifth aspect of the present application discloses an electronic device, including:

[0024] A memory storing executable program code;

[0025] a processor coupled to the memory;

[0026] The processor calls the executable program code stored in the memory to execute the identity authentication method disclosed in the first aspect of the embodiment of the present application, or the identity authentication method disclosed in the second aspect.

[0027] The sixth aspect of the embodiments of the present application discloses a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the identity authentication method disclosed in the first aspect of the embodiments of the present application, or the identity authentication method disclosed in the second aspect.

[0028] Compared with the related art, the embodiments of the present application have the following beneficial effects:

[0029] In the embodiment of the present application, the terminal device can obtain the website login information corresponding to the target website to be visited, and only obtain the target credential identifier corresponding to the website login information, and then send the first authentication request including the target credential identifier to the target authenticator, so that the target authenticator signs the identity authentication result of the target authenticator according to the first key corresponding to the target credential identifier to obtain the signature value. It can be seen that compared with the terminal device in the related art that needs to obtain all credential identifiers from the website server, the embodiment of the present application only needs to obtain a target credential identifier corresponding to the website login information, thereby avoiding the leakage of other credential identifiers that are not necessary for this login during the transmission process, and improving the security of the login; in addition, in the embodiment of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 It is a schematic diagram of an application scenario disclosed in an embodiment of the present application;

[0032] Figure 2 It is a timing diagram disclosed in the embodiment of the present application;

[0033] Figure 3 It is a flowchart of an identity authentication method disclosed in an embodiment of the present application;

[0034] Figure 4 It is a flowchart of another identity authentication method disclosed in an embodiment of the present application;

[0035] Figure 5 It is a flowchart of another identity authentication method disclosed in the embodiment of the present application;

[0036] Figure 6 It is a flowchart of another identity authentication method disclosed in the embodiment of the present application;

[0037] Figure 7 It is a structural diagram of an identity authentication device disclosed in an embodiment of the present application;

[0038] Figure 8 It is a structural diagram of another identity authentication device disclosed in an embodiment of the present application;

[0039] Fig. 9 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] It should be noted that the terms "first", "second", "third" and "fourth" in the specification and claims of the present application are used to distinguish different objects rather than to describe a specific order. The terms "including" and "having" in the embodiments of the present application and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device including a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0042] The embodiments of the present application disclose an identity authentication method and device, an electronic device, and a computer-readable storage medium, which can reduce the risk of credential identification leakage during transmission and improve login security.

[0043] The technical solution of the present application will be described in detail below in conjunction with specific embodiments.

[0044] In order to more clearly explain the identity authentication method disclosed in the embodiment of the present application, the application scenarios applicable to the method are first introduced. Figure 1 , Figure 1It is a schematic diagram of an application scenario disclosed in an embodiment of the present application. Optionally, the method can be applied to a terminal device 110, which may include a device capable of running a client of a user agent (use agent), including but not limited to portable electronic devices such as mobile phones and tablet computers, and desktop electronic devices such as desktop computers and desktop televisions, which are not limited here. Specifically, the method can be applied to a client of a user agent (use agent) running on the terminal device 110, and the user agent may include a browser or other proxy system, which is not limited here.

[0045] Optionally, the terminal device 110 may be communicatively connected to the website server 120 and the target authenticator 130 respectively. Among them, the website server 120 may be the server corresponding to the target website currently visited by the terminal device 110; the target authenticator 130 includes devices for identity authentication, such as various devices that can perform biometric recognition, including but not limited to: fingerprint recognition devices, face recognition devices or iris recognition devices, etc., which are not limited here. Optionally, the target authenticator 130 may be set in the terminal device 110, for example: a mobile phone may include a fingerprint recognition device, or a face recognition device, etc.; in another optional embodiment, the target authenticator 130 may also be an external device associated with the terminal device 110, for example, the terminal device 110 is a warehouse management terminal, and the target authenticator 130 is a fingerprint recognition module arranged on the warehouse door and communicatively connected to the warehouse management terminal, which is not limited here. It should be noted that Figure 1 In the figure, the target authenticator 130 is an external device associated with the terminal device 110, which is only for the convenience of explanation. Figure 1 This should not be construed as limiting the embodiments of the present application.

[0046] The webauthn (web identity authentication) solution is a solution that provides users with biometrics, PIN (Personal Identification Number, personal identification code) identification and other methods to replace the traditional website login method of entering an account and password. The general process of this solution is: when a user registers a webauthn credential on a website, the target authenticator 130 generates a pair of public and private key pairs for the user's website account. Among them, each account on each website can correspond to a different pair of public and private key pairs. Generally, the website server 120 holds the public key and the target authenticator 130 holds the private key. Then, when the user logs in to the website account, the website server 120 requests the target authenticator 130 to perform biometrics and other authentication processes on the user. After the target authenticator 130 authenticates the user, it uses the private key to sign the authentication result, and sends the authentication result and the signature value to the website server 120. After receiving the authentication result and the signature value, the website server 120 uses the public key to verify the signature. If the signature verification is successful, it is believed that the identity authentication result of the target authenticator 130 on the user is legal, and then it is determined whether to allow the user account to log in based on the identity authentication result.

[0047] In the related art, the target authenticator 130 can also use the symmetric key held by itself to encrypt the generated private key and the related information of the registered webauthn credential (for example, the corresponding public key identifier, the website identifier corresponding to the visited website, etc.) to obtain the credential identifier; then send the credential identifier and the generated public key to the website server 120 for storage. In the subsequent identity authentication process, the website server 120 can send the credential identifier to the target authenticator 130, and the target authenticator 130 decrypts the credential identifier according to the symmetric key held by itself to obtain the private key, and then perform subsequent signing operations through the private key. However, it is found in practice that in the Webauthn scheme, the same user is allowed to register multiple credentials with different authenticators for the same account on the same website, which may result in the website server 120 storing multiple credential identifiers corresponding to different authenticators. In the subsequent identity authentication process, the website server 120 needs to send multiple credential identifiers to the target authenticator 130, but because only one of the target credential identifiers is ultimately required, other credential identifiers that are not needed for this login may be leaked during the transmission process, reducing the security of the login.

[0048] In this regard, the present application embodiment provides an identity authentication method to solve the technical problems existing in the related technology. Figure 2 , Figure 2 This is a timing diagram disclosed in the embodiment of the present application.

[0049] 202. When the terminal device 110 detects an access operation to a target website, it may obtain website login information corresponding to the target website, wherein the website login information may include a website identifier of the target website, a target user account to be logged in, and a target authenticator identifier corresponding to a target authenticator to be used;

[0050] 204. The terminal device 110 determines a target mapping value that matches the website login information from among the mapping values ​​corresponding to the one or more stored credential identifiers, and sends the target mapping value to the website server 120.

[0051] 206. The website server 120 feeds back to the terminal device 110 the target credential identifier corresponding to the target mapping value and the verification value randomly generated by the website server 120 according to the target mapping value;

[0052] 208. The terminal device 110 forwards the received target credential identifier and verification value to the target authenticator 130;

[0053] 210; the target authenticator 130 obtains an identity authentication result according to the identity authentication, and signs the identity authentication result and the verification value according to the first key (ie, the private key) corresponding to the target credential identifier to obtain a signature value;

[0054] 212. The target authenticator 130 sends the identity authentication result and the signature value to the terminal device 110;

[0055] 214. The terminal device 110 forwards the target credential identifier and the received identity authentication result and signature value to the website server 120;

[0056] 216. The website server 120 verifies whether the signature value is legal based on the second key (i.e., the public key) corresponding to the target credential identifier, and verifies whether the received verification value is consistent with the previously sent verification value to determine whether the identity authentication result and the signature value are legal; and if the identity authentication result is legal, determines whether to allow the user account to log in based on the identity authentication result.

[0057] It can be seen that compared with the related art in which the terminal device 110 needs to obtain all credential identifiers from the website server 120, in the embodiment of the present application, the terminal device 110 can first store the mapping values ​​corresponding to each credential identifier, and then determine the target mapping value corresponding to the target credential identifier required for this login according to the website login information, and send the target mapping value to the website server 120, so that the website server 120 only needs to feedback a target credential identifier corresponding to a target mapping value, thereby avoiding the leakage of other credential identifiers that are not necessary for this login during the transmission process, thereby improving the security of the login; in addition, in the embodiment of the present application, the target authenticator 130 only needs to decrypt the target credential identifier, thereby reducing the decryption workload of the target authenticator 130 and reducing the power consumption of the target authenticator 130.

[0058] Based on this, the identity authentication method and device, electronic device, and computer-readable storage medium disclosed in the embodiments of the present application are introduced below.

[0059] See also Figure 3 , Figure 3 This is a flowchart of an identity authentication method disclosed in an embodiment of the present application. Optionally, the method can be applied to the above-mentioned terminal device or other execution subjects. The present embodiment of the application is described by taking the terminal device as an example, which should not be limited to the present embodiment of the application. Optionally, the method may include the following steps:

[0060] 302. Obtain website login information corresponding to the target website being visited.

[0061] In the embodiment of the present application, when the terminal device detects an access operation to the target website, it can obtain the website login information corresponding to the target website being accessed. Optionally, the website login information may include: the website identifier corresponding to the target website, the target user account to be logged in, and the target authenticator identifier of the target authenticator to be used, which is not limited here.

[0062] Among them, the website identifier may include various information used to identify the target website, including but not limited to the name of the target website, the website address or the characteristic value of the website, etc., which are not limited here; the target user account may include the user's registered account, account name and other information, which are not limited here; the target authenticator identifier may include various information used to identify the target authenticator, including but not limited to the name of the target authenticator, product number and other characteristic values, which are not limited here.

[0063] 304. Obtain a target credential identifier corresponding to the website login information.

[0064] As described above, the credential identifier is obtained by encrypting the generated private key and the related information of the registered webauthn credentials using the symmetric key held by the target authenticator, that is, the credential identifier includes the private key and other credential information required by the subsequent target authenticator when performing identity authentication. In the embodiment of the present application, one or more credential identifiers generated by the target authenticator can be stored in the website server.

[0065] In the related art, during the identity authentication process, the website server needs to send all the stored multiple credential identifiers to the terminal device, so that the terminal device forwards the multiple credential identifiers to the target authenticator, and then the target authenticator can decrypt the multiple credential identifiers in turn until the private key and credential information required for this identity authentication process are obtained. It can be seen that in the related art, multiple credential identifiers are transmitted together, which increases the risk of leakage of other credential identifiers that are not necessary for this login during the transmission process, and the target authenticator may need to decrypt multiple credential identifiers before obtaining the private key and credential information required in the end, and the decryption workload is large.

[0066] In this regard, in an embodiment of the present application, the terminal device can obtain only the target credential identifier corresponding to the website login information from the website server, thereby reducing the risk of leakage of other credential identifiers that are not necessary for this login during transmission; in addition, the subsequent target authenticator only needs to decrypt the target credential identifier, which reduces the decryption workload of the target authenticator and reduces the power consumption of the target authenticator.

[0067] As an optional implementation, the terminal device may store mapping values ​​corresponding to multiple credential identifiers included in the website server, one mapping value may be uniquely matched with one credential identifier, and the mapping value may be used to index the corresponding credential identifier in the website server. Optionally, the mapping value may include a hash value, which is determined by mapping and calculating each credential identifier according to a hash algorithm, and the hash algorithm is an algorithm that maps a binary value of any length to a smaller binary value of a fixed length. The smaller binary value obtained by mapping is called a hash value.

[0068] It is understandable that the data volume of the credential identifier is large, so storing multiple credential identifiers in the terminal device will occupy too much storage space of the terminal device. In this regard, each credential identifier can be mapped to a mapping value with a smaller data volume and stored in the terminal device to save storage space of the terminal device.

[0069] Optionally, when the terminal device obtains the website login information corresponding to the target website, it can determine the target mapping value that matches the website login information from the mapping values ​​corresponding to one or more credential identifiers stored in the terminal device, and send the target mapping value to the website server. The website server can then search for the target credential identifier corresponding to the target mapping value from the multiple credential identifiers stored in the website server, and send the target credential identifier to the terminal device.

[0070] By implementing the above method, a certain credential identifier can be indexed by a mapping value between the terminal device and the website server, so that the terminal device can accurately obtain only one or several credential identifiers from the website server, thereby reducing the risk of leakage of other credential identifiers that are not necessary for the current login during the transmission process; in addition, each credential identifier is mapped to a mapping value with a smaller data volume and stored in the terminal device, which can also save storage space of the terminal device.

[0071] 306. Send a first authentication request to the target authenticator, where the first authentication request includes a target credential identifier. The first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value.

[0072] In the embodiment of the present application, the website login information at least includes a target authenticator identifier corresponding to the target authenticator to be used for this identity authentication, so that the terminal device can determine the target authenticator to be used according to the target authenticator identifier included in the website login information.

[0073] Furthermore, after the terminal device obtains the target credential identifier from the website server, it can send a first authentication request to the target authenticator, and the first authentication request at least includes the target credential identifier. Then, when the target authenticator receives the first authentication request, it can decrypt the target credential identifier by using the symmetric key previously used to encrypt the credential identifier to obtain the first key (i.e., private key); then, it can sign the identity authentication result of the target authenticator by using the first key to obtain the signature value; and then feed back the identity authentication result and the signature value to the terminal device. Among them, the signature value is used to verify whether the identity authentication result is legal.

[0074] Optionally, the target authenticator may perform an identity authentication operation (for example, fingerprint recognition, face recognition, etc., not limited here) upon receiving the first authentication request to obtain an identity authentication result; in another optional embodiment, the target authenticator may also perform an identity authentication operation before receiving the first authentication request, not limited here.

[0075] 308. Receive the identity authentication result and signature value fed back by the target authenticator. The signature value is used to verify whether the identity authentication result is legal.

[0076] In an embodiment of the present application, when the terminal device receives the identity authentication information and signature value fed back by the target authenticator, it can forward the identity authentication result and signature value to the website server; then the website server can verify whether the identity authentication result is legal based on the signature value, and if it is determined that the identity authentication result is legal, it can determine whether to allow the user account to log in based on the identity authentication result.

[0077] By implementing the methods disclosed in the above embodiments, the terminal device can obtain the website login information corresponding to the target website to be visited, and only obtain the target credential identifier corresponding to the website login information, and then send the first authentication request including the target credential identifier to the target authenticator, so that the target authenticator signs the identity authentication result of the target authenticator according to the first key corresponding to the target credential identifier to obtain the signature value. It can be seen that compared with the related art in which the terminal device needs to obtain all credential identifiers from the website server, the embodiment of the present application only needs to obtain a target credential identifier corresponding to the website login information, thereby avoiding the leakage of other credential identifiers that are not necessary for this login during the transmission process, thereby improving the security of the login; in addition, in the embodiment of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator.

[0078] See also Figure 4 , Figure 4 : is a flowchart of another identity authentication method disclosed in the embodiment of the present application. Optionally, the method can be applied to the above-mentioned terminal device or other execution subjects. The embodiment of the present application is described by taking the terminal device as an example, which should not be limited to the embodiment of the present application. Optionally, the method can include the following steps:

[0079] 402. Obtain a website identifier corresponding to the target website to be visited, and determine a target user account to be logged in and a target authenticator identifier corresponding to the target authenticator to be used according to the website identifier, and determine the website identifier, the target user account and the target authenticator identifier as website login information.

[0080] In the embodiment of the present application, the terminal device can first obtain the website identifier corresponding to the target website to be visited, and search for the registration information corresponding to the website identifier, and then the terminal device can determine the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used in the registration information. The registration information includes the account and authenticator information registered by the user on the target website.

[0081] Optionally, one or more registration information may be stored in the terminal device, and each registration information may include a website identifier corresponding to a website, a user account registered by a user in the website corresponding to the website identifier, and one or more identity authenticator identifiers corresponding to each user account, which are not limited here. Furthermore, optionally, the corresponding target registration information may be determined from the multiple registration information according to the website identifier of the target website to be visited, and then the corresponding target user account to be logged in and the target authenticator identifier of the target authenticator to be used may be determined according to the target registration information as the website login information.

[0082] By implementing the above method, the terminal device can first obtain the website identifier corresponding to the target website, and then search for the registration information corresponding to the website identifier to narrow the search scope of subsequent account and authenticator information searches, thereby improving the accuracy and search efficiency of searching for the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used.

[0083] As an optional implementation, the terminal device may determine target registration information matching the website identifier from the registration information stored in the terminal device. The target registration information may include one or more user accounts and one or more authenticator identifiers corresponding to each user account.

[0084] Furthermore, the terminal device may output the target registration information for the user to select. The user may select the target user account to be logged in and the target authenticator identifier of the target authenticator to be used in the target registration information, and input the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used based on the selection result. Optionally, the terminal device may output the target registration information through a floating window, a drop-down list, etc., which is not limited here.

[0085] Furthermore, when the terminal device detects the user's selection operation on the target registration information, it can determine the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used based on the selection operation, and determine the website identifier, and the received target user account and target authenticator identifier as the website login information.

[0086] By implementing the above method, the terminal device can output target registration information including the registered user account and the authenticator identifier for the user to select, thereby improving the controllability and flexibility of the method and improving the user experience.

[0087] As another optional implementation, if it is determined that there is no usable target authenticator, the terminal device can output the first guidance information and / or the second guidance information. The first guidance information is used to guide the user to use other login methods, and other login methods are other login methods other than logging in through the authenticator, for example: logging in through an account and password. It is understandable that if there is no target authenticator available, identity authentication cannot be performed. In this regard, the terminal device can guide the user to use other login methods to avoid the user being stuck in a state where they cannot log in, thereby improving the efficiency of login.

[0088] Optionally, the second guidance information may be used to guide the user to re-register for a currently available authenticator, or to guide the user to use another authenticator that has been registered and is associated with the terminal device.

[0089] Optionally, the situation where there is no usable target authenticator includes: the terminal device does not find the target authenticator identifier corresponding to the target user account in the registration information stored in the terminal device; or the target authenticator corresponding to the target authenticator identifier is in an unassociated state with the terminal device; or the target authenticator is in a damaged state, etc., which are not limited here. The unassociated state is the state where the terminal device is disconnected.

[0090] By implementing the above method, when there is no usable target authenticator, the user can be guided to adopt other login methods or reselect other authenticators, thereby avoiding the user being stuck in a state where they cannot log in, thereby improving the flexibility and compatibility of the identity authentication method and improving the efficiency of login.

[0091] 404. Obtain a target credential identifier corresponding to the website login information.

[0092] 406. Send a first authentication request to the target authenticator corresponding to the target authenticator identifier, where the first authentication request includes a target credential identifier. The first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value.

[0093] 408. Receive the identity authentication result and signature value fed back by the target authenticator. The signature value is used to verify whether the identity authentication result is legal.

[0094] By implementing the methods disclosed in the above embodiments, compared with the related art in which the terminal device needs to obtain all the credential identifiers from the website server, the embodiments of the present application only need to obtain a target credential identifier corresponding to the website login information, thereby preventing other credential identifiers that are not necessary for the current login from being leaked during the transmission process, thereby improving the security of the login; in addition, in the embodiments of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator; and, the website identifier corresponding to the target website can be obtained first, and then the registration information corresponding to the website identifier can be searched, This can narrow the search scope for subsequent account and authenticator information searches, thereby improving the accuracy and search efficiency of searching for the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used; and, the target registration information including the registered user account and the authenticator identifier can be output for the user to choose, thereby improving the controllability and flexibility of the method and improving the user's usage experience; and, when there is no usable target authenticator, the user can be guided to adopt other login methods or reselect other authenticators, thereby avoiding the user being stuck in a state where they cannot log in, thereby improving the flexibility and compatibility of the identity authentication method and improving the login efficiency.

[0095] See also Figure 5 , Figure 5 This is a flowchart of another identity authentication method disclosed in the embodiment of the present application. Optionally, the method can be applied to the above-mentioned terminal device or other execution subjects. The embodiment of the present application is described by taking the terminal device as an example, which should not be limited to the embodiment of the present application. Optionally, the method can include the following steps:

[0096] 502. Obtain website login information corresponding to the target website being visited.

[0097] 504. Obtain a target credential identifier corresponding to the website login information.

[0098] 506. Send a first authentication request to the target authenticator, where the first authentication request includes a target credential identifier. The first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value.

[0099] 508. Receive the identity authentication result and signature value fed back by the target authenticator, and send a second authentication request to the website server corresponding to the target website. The second authentication request includes the target credential identifier, the identity authentication result and the signature value. The second authentication request is used to instruct the website server to verify whether the signature value is legal according to the second key corresponding to the target credential identifier.

[0100] In an embodiment of the present application, upon receiving the identity authentication result and signature value fed back by the target authenticator, the terminal device may send a second authentication request to the website server corresponding to the target website, wherein the second authentication request includes at least the target credential identifier, the identity authentication result and the signature value.

[0101] Then, the website server can determine the second key (i.e., public key) corresponding to the target credential identifier based on the second authentication request; then, the website server can verify whether the received signature value is legal based on the public key. If the signature value is determined to be legal, then it can be determined that the identity authentication result is also legal; then, the website server can determine whether to allow the user account to log in based on the identity authentication result; optionally, if the identity authentication result indicates that the target authenticator has authenticated the user as a legal user, then the user account is allowed to log in; otherwise, if the identity authentication result indicates that the user is an illegal user, then the user account is not allowed to log in.

[0102] By implementing the above method, the terminal device, the target authenticator and the website server can agree to verify whether the identity authentication result is legal through the signature value. If the identity authentication result is determined to be legal, it can be determined whether to allow the user account to log in based on the identity authentication result, thereby avoiding the situation where the website server allows illegal users to log in to the user account based on illegal identity authentication results, thereby improving the security of login.

[0103] As another optional implementation, the first authentication request may also include a verification value, which is randomly generated by the website server and sent to the terminal device. Optionally, the website server may feedback the randomly generated verification value together with the target credential identifier to the terminal device. The verification value may include a challenge value, which may be a randomly generated number or a group of numbers or characters, which are not limited here. Then, the target authenticator may perform identity authentication according to the first authentication request, and sign the identity authentication result and the verification value according to the first key corresponding to the target credential identifier to obtain a signature value; then the identity authentication result, the signed verification value and the signature value are fed back to the terminal device.

[0104] Furthermore, the second authentication request sent by the terminal device to the website server may also include a signed verification value; further, the website server may also verify whether the signed verification value is consistent with the verification value sent previously based on the second authentication request, and determine whether the identity authentication result and the signature value are legal based on the verification result.

[0105] By implementing the above method, a verification value can be agreed upon between the terminal device, the target authenticator and the website server, so that the website server can determine whether the sources of the identity authenticator and the signature value are legal based on whether the verification values ​​sent and received are consistent, thereby avoiding the situation where the website server allows illegal users to log in to the user account based on illegal identity authentication results, thereby improving the security of login.

[0106] By implementing the methods disclosed in the above embodiments, compared with the related art in which the terminal device needs to obtain all the credential identifiers from the website server, the embodiment of the present application only needs to obtain a target credential identifier corresponding to the website login information, thereby preventing other credential identifiers that are not necessary for this login from being leaked during the transmission process, thereby improving the security of the login; in addition, in the embodiment of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator; and, the terminal device, the target authenticator and the website server can agree to verify whether the identity authentication result is legal through the signature value, and then if the identity authentication result is determined to be legal, it can be determined whether the user account is allowed to log in based on the identity authentication result, thereby avoiding the situation where the website server allows an illegal user to log in to the user account based on an illegal identity authentication result, thereby improving the security of the login; and, the terminal device, the target authenticator and the website server can agree on a verification value, so that the website server can determine whether the source of the identity authenticator and the signature value is legal based on whether the sent and received verification values ​​are consistent, thereby avoiding the situation where the website server allows an illegal user to log in to the user account based on an illegal identity authentication result, thereby improving the security of the login.

[0107] See also Figure 6 , Figure 6 This is a flowchart of another identity authentication method disclosed in the embodiment of the present application. Optionally, the method can be applied to the above-mentioned target authenticator or other execution entities. The embodiment of the present application is described by taking the target authenticator as an example, which should not be limited to the embodiment of the present application. Optionally, the method may include the following steps:

[0108] 602. Receive a first authentication request sent by a terminal device, where the first authentication request includes a target credential identifier, and the target credential identifier is a credential identifier corresponding to website login information of a target website to be visited.

[0109] 604. Perform identity authentication according to the first authentication request to obtain an identity authentication result, and sign the identity authentication result according to the first key corresponding to the target credential identifier to obtain a signature value.

[0110] As an optional implementation, the first authentication request may also include a verification value, which is randomly generated by the website server and sent to the terminal device. Optionally, the target authenticator may sign the identity authentication result and the verification value according to the first key corresponding to the target credential identifier to obtain a signature value; wherein the verification value is used to verify whether the identity authentication result and the signature value are legal.

[0111] By implementing the above method, a verification value can be agreed upon between the terminal device, the target authenticator and the website server, so that the website server can determine whether the sources of the identity authenticator and the signature value are legal based on whether the verification values ​​sent and received are consistent, thereby avoiding the situation where the website server allows illegal users to log in to the user account based on illegal identity authentication results, thereby improving the security of login.

[0112] 606. Send the identity authentication result and the signature value to the terminal device. The signature value is used to verify whether the identity authentication result is legal.

[0113] By implementing the methods disclosed in the above-mentioned embodiments, compared with the related art in which the terminal device needs to obtain all credential identifiers from the website server, the embodiments of the present application only need to obtain a target credential identifier corresponding to the website login information, thereby avoiding the leakage of other credential identifiers that are not necessary for this login during the transmission process, thereby improving the security of the login; in addition, in the embodiments of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator.

[0114] See also Figure 7 , Figure 7 : is a schematic diagram of the structure of an identity authentication device disclosed in an embodiment of the present application. Optionally, the device can be applied to the above-mentioned terminal device or other execution entities. The embodiment of the present application is described by taking the terminal device as an example, which should not be limited to the embodiment of the present application. Optionally, the device may include a first acquisition unit 702, a second acquisition unit 704, a first sending unit 706 and a first receiving unit 708, wherein:

[0115] The first acquisition unit 702 is used to acquire website login information corresponding to the visited target website;

[0116] The second acquisition unit 704 is used to acquire a target credential identifier corresponding to the website login information;

[0117] A first sending unit 706 is used to send a first authentication request to a target authenticator corresponding to the target authenticator identifier, where the first authentication request includes a target credential identifier, and the first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value;

[0118] The first receiving unit 708 is used to receive the identity authentication result and the signature value fed back by the target authenticator, where the signature value is used to verify whether the identity authentication result is legal.

[0119] By implementing the above-mentioned device, the terminal device can obtain the website login information corresponding to the target website to be visited, and only obtain the target credential identifier corresponding to the website login information, and then send the first authentication request including the target credential identifier to the target authenticator, so that the target authenticator signs the identity authentication result of the target authenticator according to the first key corresponding to the target credential identifier to obtain the signature value. It can be seen that compared with the related art in which the terminal device needs to obtain all credential identifiers from the website server, the embodiment of the present application only needs to obtain a target credential identifier corresponding to the website login information, thereby avoiding the leakage of other credential identifiers that are not necessary for this login during the transmission process, thereby improving the security of the login; in addition, in the embodiment of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator.

[0120] As an optional implementation, the first acquisition unit 702 is also used to obtain a website identifier corresponding to a target website being visited, and determine a target user account to be logged in, and a target authenticator identifier corresponding to a target authenticator to be used based on the website identifier; and, determine the website identifier, the target user account, and the target authenticator identifier as website login information.

[0121] By implementing the above-mentioned device, the terminal device can first obtain the website identifier corresponding to the target website, and then search for the registration information corresponding to the website identifier, so as to narrow the search scope of subsequent account and authenticator information searches, thereby improving the accuracy and search efficiency of searching for the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used.

[0122] As an optional implementation, the first acquisition unit 702 is also used to determine target registration information that matches the website identifier in the registration information stored in the terminal device, the target registration information including one or more user accounts and one or more authenticator identifiers corresponding to each user account; and, output the target registration information, and receive the target user account to be logged in, and the target authenticator identifier corresponding to the target authenticator to be used, which is input by the user according to the target registration information.

[0123] By implementing the above device, the terminal device can output target registration information including the registered user account and the authenticator identifier for the user to select, thereby improving the controllability and flexibility of the method and improving the user experience.

[0124] As an optional implementation, Figure 7 The device shown may also include an output unit not shown, wherein:

[0125] An output unit is used to output the first guidance information and / or the second guidance information when there is no usable target authenticator; wherein the first guidance information is used to guide the user to use other login methods, and the other login methods are other login methods other than logging in through the authenticator; the second guidance information is used to guide the user to re-register for the currently usable authenticator, or to guide the user to use other registered authenticators that are associated with the terminal device.

[0126] By implementing the above device, when there is no usable target authenticator, the user can be guided to adopt other login methods or reselect other authenticators, thereby avoiding the user being stuck in a state where they cannot log in, improving the flexibility and compatibility of the identity authentication method and improving the efficiency of login.

[0127] As an optional implementation, the situation where there is no usable target authenticator includes: the target authenticator identifier corresponding to the target user account is not found in the registration information stored in the terminal device, or the target authenticator corresponding to the target authenticator identifier is in an unassociated state with the terminal device.

[0128] By implementing the above device, when there is no usable target authenticator, the user can be guided to adopt other login methods or reselect other authenticators, thereby avoiding the user being stuck in a state where they cannot log in, improving the flexibility and compatibility of the identity authentication method and improving the efficiency of login.

[0129] As an optional implementation, the second acquisition unit 704 is also used to determine a target mapping value that matches the website login information from the mapping values ​​corresponding to one or more credential identifiers stored in the terminal device, and send the target mapping value to the website server corresponding to the target website; and, receive the target credential identifier corresponding to the target mapping value sent by the website server.

[0130] By implementing the above-mentioned device, a certain credential identifier can be indexed by a mapping value between the terminal device and the website server, so that the terminal device can accurately obtain only one or several credential identifiers from the website server, thereby reducing the risk of leakage of other credential identifiers that are not necessary for the current login during the transmission process; in addition, by mapping each credential identifier to a mapping value with a smaller data volume and storing it in the terminal device, the storage space of the terminal device can also be saved.

[0131] As an optional implementation, Figure 7 The device shown may further include a third sending unit not shown, wherein:

[0132] The third sending unit is used to send a second authentication request to the website server corresponding to the target website after receiving the identity authentication result and signature value fed back by the target authenticator. The second authentication request includes the target credential identifier, the identity authentication result and the signature value. The second authentication request is used to instruct the website server to verify whether the signature value is legal according to the second key corresponding to the target credential identifier.

[0133] By implementing the above-mentioned device, the terminal device, the target authenticator and the website server can agree to verify whether the identity authentication result is legal through the signature value. If the identity authentication result is determined to be legal, it can be determined whether to allow the user account to log in based on the identity authentication result, thereby avoiding the situation where the website server allows illegal users to log in to the user account based on illegal identity authentication results, thereby improving the security of login.

[0134] As an optional implementation, the first authentication request also includes a verification value, which is randomly generated by the website server and sent to the terminal device. The first authentication request is used to instruct the target authenticator to perform identity authentication, and sign the identity authentication result and the verification value according to the first key corresponding to the target credential identifier to obtain a signature value; the second authentication request also includes the signed verification value, and the second authentication request is also used to instruct the website server to verify whether the signed verification value is consistent with the verification value sent previously, and determine whether the identity authentication result and the signature value are legal based on the verification result.

[0135] By implementing the above-mentioned device, a verification value can be agreed upon between the terminal device, the target authenticator and the website server, so that the website server can determine whether the sources of the identity authenticator and the signature value are legal based on whether the verification values ​​sent and received are consistent, thereby avoiding the situation where the website server allows illegal users to log in to the user account based on illegal identity authentication results, thereby improving the security of login.

[0136] See also Figure 8 , Figure 880 is a schematic diagram of the structure of another identity authentication device disclosed in an embodiment of the present application. Optionally, the device can be applied to the above-mentioned target authenticator or other execution entities. The embodiment of the present application is described by taking the target authenticator as an example, which should not be limited to the embodiment of the present application. Optionally, the device may include a second receiving unit 802, a signature unit 804, and a second sending unit 806, wherein:

[0137] The second receiving unit 802 is configured to receive a first authentication request sent by a terminal device, wherein the first authentication request includes a target credential identifier, and the target credential identifier is a credential identifier corresponding to website login information of a target website to be visited;

[0138] The signing unit 804 is used to perform identity authentication according to the first authentication request to obtain an identity authentication result, and sign the identity authentication result according to the first key corresponding to the target credential identifier to obtain a signature value;

[0139] The second sending unit 806 is used to send the identity authentication result and the signature value to the terminal device, and the signature value is used to verify whether the identity authentication result is legal.

[0140] By implementing the above-mentioned device, compared with the related art in which the terminal device needs to obtain all credential identifiers from the website server, the embodiment of the present application only needs to obtain a target credential identifier corresponding to the website login information, thereby avoiding the leakage of other credential identifiers that are not necessary for this login during the transmission process, thereby improving the security of the login; in addition, in the embodiment of the present application, the target authenticator only needs to decrypt the target credential identifier to obtain the first key corresponding to the target credential identifier, thereby reducing the decryption workload of the target authenticator and reducing the power consumption of the target authenticator.

[0141] As an optional implementation, the first authentication request also includes a verification value, which is randomly generated by the website server and sent to the terminal device; the signature unit 804 is also used to sign the identity authentication result and the verification value according to the first key corresponding to the target credential identifier to obtain a signature value, and the verification value is used to verify whether the identity authentication result and the signature value are legal.

[0142] By implementing the above-mentioned device, a verification value can be agreed upon between the terminal device, the target authenticator and the website server, so that the website server can determine whether the sources of the identity authenticator and the signature value are legal based on whether the verification values ​​sent and received are consistent, thereby avoiding the situation where the website server allows illegal users to log in to the user account based on illegal identity authentication results, thereby improving the security of login.

[0143] See also Fig. 9 , Fig. 9 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application.

[0144] like Fig. 9 As shown, the electronic device may include:

[0145] A memory 901 storing executable program codes;

[0146] A processor 902 coupled to the memory 901;

[0147] The processor 902 calls the executable program code stored in the memory 901 to execute the identity authentication method applied to the terminal device or the identity authentication method applied to the target authenticator disclosed in the above embodiments.

[0148] An embodiment of the present application discloses a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the identity authentication method applied to a terminal device or the identity authentication method applied to a target authenticator disclosed in the above embodiments.

[0149] The embodiments of the present application also disclose an application publishing platform, wherein the application publishing platform is used to publish a computer program product, wherein when the computer program product runs on a computer, the computer executes part or all of the steps of the method in the above method embodiments.

[0150] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. Those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required for the present application.

[0151] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the above-mentioned processes does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0152] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0153] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0154] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-accessible memory. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several requests for a computer device (which can be a personal computer, a server or a network device, etc., specifically a processor in a computer device) to perform some or all of the steps of the above-mentioned methods of various embodiments of the present application.

[0155] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0156] The identity authentication method and device, electronic device, and computer-readable storage medium disclosed in the embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An identity authentication method, characterized in that: Applied to a terminal device, the method comprises: Get the website login information corresponding to the target website visited; Obtaining a target credential identifier corresponding to the website login information; Sending a first authentication request to a target authenticator, the first authentication request including the target credential identifier, the first authentication request being used to instruct the target authenticator to perform identity authentication, and signing the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value; The identity authentication result and the signature value fed back by the target authenticator are received, and the signature value is used to verify whether the identity authentication result is legal.

2. The method according to claim 1, characterized in that The obtaining of website login information corresponding to the target website to be visited includes: Obtaining a website identifier corresponding to the target website to be visited, and determining a target user account to be logged in and a target authenticator identifier corresponding to the target authenticator to be used according to the website identifier; The website identifier, the target user account and the target authenticator identifier are determined as website login information.

3. The method according to claim 2, characterized in that The step of determining the target user account to be logged in and the target authenticator identifier corresponding to the target authenticator to be used according to the website identifier includes: Determine, from the registration information stored in the terminal device, target registration information that matches the website identifier, the target registration information including one or more user accounts and one or more authenticator identifiers corresponding to each of the user accounts; Outputting the target registration information; In response to the selection operation, a target user account to be logged in selected from the target registration information and a target authenticator identifier corresponding to a target authenticator to be used are determined.

4. The method according to claim 3, characterized in that The method further comprises: In the absence of an available target authenticator, output the first guidance information and / or the second guidance information; wherein the first guidance information is used to guide the user to use other login methods, and the other login methods are other login methods other than logging in through the authenticator; the second guidance information is used to guide the user to re-register for the currently available authenticator, or to guide the user to use other registered authenticators that are associated with the terminal device.

5. The method according to claim 4, characterized in that The situation where there is no usable target authenticator includes: the authenticator identifier corresponding to the target user account is not found in the registration information stored in the terminal device, or the target authenticator corresponding to the target authenticator identifier is not associated with the terminal device.

6. The method according to claim 1, characterized in that The obtaining of a target credential identifier corresponding to the website login information includes: Determine a target mapping value that matches the website login information from among the mapping values ​​corresponding to the one or more credential identifiers stored in the terminal device, and send the target mapping value to a website server corresponding to the target website, so that the website server searches for a target credential identifier corresponding to the target mapping value; Receive the target credential identifier sent by the website server.

7. The method according to any one of claims 1 to 6, characterized in that: After receiving the identity authentication result and the signature value fed back by the target authenticator, the method further includes: A second authentication request is sent to the website server corresponding to the target website, wherein the second authentication request includes the target credential identifier, the identity authentication result and the signature value, and the second authentication request is used to instruct the website server to verify whether the identity authentication result is legal based on the second key corresponding to the target credential identifier and the signature value.

8. The method according to claim 7, characterized in that Before sending the first authentication request to the target authenticator, the method further includes: receiving a verification value sent by the website server, wherein the verification value is randomly generated by the website server; the first authentication request also includes the verification value, and the first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result and the verification value according to the first key corresponding to the target credential identifier to obtain a signature value; Furthermore, the second authentication request also includes a signed verification value, and the second authentication request is also used to instruct the website server to verify whether the signed verification value is consistent with the verification value sent previously, and determine whether the identity authentication result and the signature value are legal based on the verification result.

9. An identity authentication method, characterized in that: Applied to a target authenticator, the method comprises: Receiving a first authentication request sent by a terminal device, the first authentication request including a target credential identifier, the target credential identifier corresponding to website login information of a target website accessed by the terminal device; Performing identity authentication according to the first authentication request to obtain an identity authentication result, and signing the identity authentication result according to the first key corresponding to the target credential identifier to obtain a signature value; The identity authentication result and the signature value are sent to the terminal device, and the signature value is used to verify whether the identity authentication result is legal.

10. The method according to claim 9, characterized in that The first authentication request also includes a verification value, which is randomly generated by the website server and sent to the terminal device; and the identity authentication result is signed according to the first key corresponding to the target credential identifier to obtain a signature value, including: The identity authentication result and the verification value are signed according to the first key corresponding to the target credential identifier to obtain a signature value, and the verification value is used to verify whether the identity authentication result and the signature value are legal.

11. The method according to claim 9 or 10, characterized in that: The step of signing the identity authentication result according to the first key corresponding to the target credential identifier to obtain a signature value includes: Decrypting the target credential identifier to obtain a first key; The identity authentication result is signed by using the first key to obtain a signature value.

12. An identity authentication device, characterized in that: Applied to a terminal device, the device comprises: A first acquisition unit is used to acquire website login information corresponding to the visited target website; A second acquisition unit, configured to acquire a target credential identifier corresponding to the website login information; a first sending unit, configured to send a first authentication request to a target authenticator corresponding to the target authenticator identifier, wherein the first authentication request includes the target credential identifier, and the first authentication request is used to instruct the target authenticator to perform identity authentication, and to sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value; The first receiving unit is used to receive the identity authentication result and the signature value fed back by the target authenticator, where the signature value is used to verify whether the identity authentication result is legal.

13. An identity authentication device, characterized in that: Applied to a target authenticator, the device comprises: A second receiving unit is configured to receive a first authentication request sent by a terminal device, wherein the first authentication request includes a target credential identifier, and the target credential identifier is a credential identifier corresponding to website login information of a target website to be visited; a signing unit, configured to perform identity authentication according to the first authentication request to obtain an identity authentication result, and sign the identity authentication result according to a first key corresponding to the target credential identifier to obtain a signature value; The second sending unit is used to send the identity authentication result and the signature value to the terminal device, and the signature value is used to verify whether the identity authentication result is legal.

14. An electronic device, characterized in that: It comprises a memory storing executable program code and a processor coupled to the memory; wherein the processor calls the executable program code stored in the memory to execute the method according to any one of claims 1 to 8 or 9 to 11.

15. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 or 9 to 11 is implemented.

Images