Identity authentication method, authentication platform, server, terminal and related equipment

Abstract

The invention discloses an identity authentication method, an authentication platform, a server, a terminal and related equipment, and belongs to the technical field of communication. The method is applied to an authentication platform, and comprises the following steps: obtaining personal information request information sent by a service provider server; target personal information request information in the personal information request information is sent to the target terminal, and authorization confirmation information returned by the target terminal based on the target personal information request information is obtained; determining that the authorization confirmation information passes verification, and obtaining pre-stored target user identity information corresponding to the personal information request information; and sending the target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information. Through the mode, the operation that the user fills in a large number of forms during registration can be reduced, the user experience degree is improved, personal privacy can be prevented from being leaked, and the safety of identity authentication can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an identity authentication method, an authentication platform, a server, a terminal and related equipment. Background Art

[0002] Currently, many Internet service providers require users to register in order to better manage user information. During the registration process, users need to set up an account and password according to the requirements of the Internet service provider and fill in a large amount of personal information, such as avatar, nickname, phone number, email address, real-name information and interest tags. This information will be stored in the Internet service provider's server, and users will authenticate their identities through their account and password when logging in.

[0003] However, the registration process is cumbersome and requires a lot of information, which often causes users to give up registration when they just want to try a service, which is not conducive to the business promotion of network service providers. In addition, with the increase in the number of network service providers, users often choose the same account and password for easy memory. If the account and password of a service provider are leaked during the login process, it is easy to be attacked by a database collision, resulting in the leakage of personal privacy information. Summary of the invention

[0004] The embodiments of the present application provide an identity authentication method, an authentication platform, a server, a terminal and related equipment to at least solve the problems in the prior art of complicated registration process and easy leakage of user personal privacy information.

[0005] In order to solve the above technical problems, this application is implemented as follows: In a first aspect, an embodiment of the present application provides an identity authentication method, which is applied to an authentication platform, comprising: obtaining personal information request information sent by a service provider server, wherein the personal information request information is sent by the service provider server based on a registration request of a target terminal; obtaining authorization confirmation information returned by the target terminal based on the target personal information request information by sending target personal information request information in the personal information request information to the target terminal; determining that the authorization confirmation information is verified, and obtaining pre-stored target user identity information corresponding to the personal information request information; sending the target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

[0006] In a second aspect, an embodiment of the present application provides an identity authentication method, which is applied to a service provider server, including: obtaining a registration request sent by a target terminal; determining personal information request information based on the registration request; obtaining target user identity information by sending the personal information request information to an authentication platform; and authenticating the user identity based on the target user identity information.

[0007] In a third aspect, an embodiment of the present application provides an identity authentication method, which is applied to a target terminal, comprising: in response to a registration request sent by the target terminal, obtaining target personal information request information sent by an authentication platform; obtaining authorization confirmation information returned based on the target personal information request information by displaying the target personal information request information; sending the authorization confirmation information to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information is verified, and send the pre-stored target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

[0008] In a fourth aspect, an embodiment of the present application provides an authentication platform, including: a registration response module, used to obtain personal information request information sent by a service provider server, wherein the personal information request information is sent by the service provider server based on a registration request of a target terminal; an authorization confirmation module, used to obtain authorization confirmation information returned by the target terminal based on the target personal information request information by sending the target personal information request information in the personal information request information to the target terminal; an information acquisition module, used to determine whether the authorization confirmation information is verified, and obtain pre-stored target user identity information corresponding to the personal information request list; a first sending module, used to send the target user identity information to the service provider server, so that the service provider server authenticates the user identity based on the target user identity information.

[0009] In a fifth aspect, an embodiment of the present application provides a service provider server, comprising: a request acquisition module, used to obtain a registration request sent by a target terminal; an information determination module, used to determine personal information request information based on the registration request; a second sending module, used to obtain the target user identity information corresponding to the personal information request information by sending the personal information request information to an authentication platform; an identity authentication module, used to authenticate the user identity based on the target user identity information.

[0010] In a sixth aspect, an embodiment of the present application provides a terminal, comprising: a registration response module, used to respond to a registration request sent by a target terminal to a service provider server, and obtain target personal information request information sent by an authentication platform; an information display module, used to obtain authorization confirmation information returned based on the target personal information request information by displaying the target personal information request information; a third sending module, used to send the authorization confirmation information to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information has been verified, and send the pre-stored target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

[0011] In the seventh aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect, the second aspect, or the third aspect above are implemented.

[0012] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect, the second aspect, or the third aspect are implemented.

[0013] In the ninth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer performs the steps of the method described in the first aspect, the second aspect, or the third aspect above.

[0014] In an embodiment of the present application, the authentication platform obtains the personal information request information sent by the service provider server; obtains the authorization confirmation information returned by the target terminal based on the target personal information request information by sending the target personal information request information in the personal information request information to the target terminal; determines that the authorization confirmation information is verified, and obtains the pre-stored target user identity information corresponding to the personal information request information; sends the target user identity information to the service provider server, so that the service provider server authenticates the user identity based on the target user identity information. In this way, during the identity authentication process, the user provides the target user identity information corresponding to the personal information request information to the service provider server through the authorization authentication platform, which can reduce the user's operation of filling out a large number of forms when registering, and improve the user experience. At the same time, after the authorization confirmation information is verified, the authentication platform provides the corresponding user identity information to the service provider server, which can effectively prevent personal privacy leakage or unauthorized access and improve the security of identity authentication.

[0015] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] Figure 1 A schematic diagram of the structure of the identity authentication system provided in an embodiment of the present application is shown; Figure 2 A schematic diagram of a process flow of an identity authentication method provided in an embodiment of the present application is shown; Figure 3 A schematic diagram showing a user registering on an authentication platform provided by an embodiment of the present application is shown; Figure 4 A schematic diagram showing the authentication platform provided in an embodiment of the present application obtaining a user agreement; Figure 5 A schematic diagram of initial user registration authentication provided by an embodiment of the present application is shown; Figure 6 A schematic diagram of user login authentication provided by an embodiment of the present application is shown; Figure 7 Another schematic diagram of the process of the identity authentication method provided in the embodiment of the present application is shown; Figure 8 Another schematic diagram of the process of the identity authentication method provided in the embodiment of the present application is shown; Fig. 9 A schematic diagram of the structure of the authentication platform provided in the embodiment of the present application is shown; Fig.10 A schematic diagram showing the structure of a service provider server provided in an embodiment of the present application is shown; Fig.11 A schematic diagram of the structure of a terminal provided in an embodiment of the present application is shown; Fig.12 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0018] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0019] At present, many Internet service providers require users to register in order to better manage user information. During the registration process, users need to set up their account and password according to the requirements of the Internet service provider and fill in personal information such as avatar, nickname, phone number, email address, etc. The registration process is cumbersome and users' personal privacy information is easily leaked.

[0020] In view of the problems existing in the above-mentioned user registration process, the present application embodiment provides an identity authentication system, such as Figure 1 As shown in , the identity authentication system includes a target terminal 110, a service provider server 120 and an authentication platform 130; the target terminal 110 initiates a registration request to the service provider server 120, and the service provider server 120 returns the corresponding personal information request information; the authentication platform 130 obtains the personal information request information, and obtains the authorization confirmation information returned by the target terminal 110 based on the target personal information request information by sending the target personal information request information in the personal information request information to the target terminal 110; it is determined that the authorization confirmation information is verified, and the pre-stored target user identity information corresponding to the personal information request information is obtained; the target user identity information is sent to the service provider server 120, so that the service provider server 120 performs user identity authentication based on the target user identity information. In this way, during the identity authentication process, the user provides the target user identity information corresponding to the personal information request information to the service provider server 120 through the authorization authentication platform 130, which can reduce the user's operation of filling out a large number of forms when registering, and improve the user experience. At the same time, after the authorization confirmation information is verified, the authentication platform 130 provides the corresponding target user identity information to the service provider server, which can effectively prevent personal privacy leakage or unauthorized access and improve the security of identity authentication.

[0021] Figure 2 A flow chart of an identity authentication method provided in an embodiment of the present application is shown. The execution subject of the method may be an authentication platform 130. As shown in the figure, the identity authentication method 200 may include the following steps: Step 201: Acquire personal information request information sent by a service provider server, wherein the personal information request information is sent by the service provider server based on a registration request of a target terminal.

[0022] In a specific implementation, the target terminal 110 may be installed with an application (Application, APP) of a network service provider. The user sends a registration request to the corresponding service provider server 120 through the APP of the network service provider. The service provider server 120 generates personal information request information based on the registration request. Specifically, the personal information request information may be in a list form, or in a graph structure form, a tree structure form, or other data structure forms. The authentication platform 130 also includes a software development kit (Software Development Kit, SDK) of the authentication platform 130 installed on the target terminal 110. The APP of the network service provider may call the SDK of the authentication platform 130, send the registration request and the personal information request information to the authentication platform 130, and request the authentication platform 130 to generate and send user identity information such as user ID, initial personal information, etc. In response to the registration request sent by the target terminal 110, the service provider server 120 returns the personal information request information based on the registration request, and the authentication platform 130 obtains the personal information request information to determine the user identity information that the user needs to provide to the service provider server when registering.

[0023] In an exemplary embodiment, a user opens the registration page of an online payment platform on a mobile phone and submits a registration request. The backend server of the online payment platform generates a personal information request list containing necessary information, such as name, mobile phone number, address, etc., based on the registration request. The online payment platform sends the registration request and the personal information request list to the authentication platform 130 by calling the SDK of the authentication platform. After the user authorizes, the authentication platform 130 provides the corresponding user identity information to the online payment platform.

[0024] Step 202: Obtain authorization confirmation information returned by the target terminal based on the target personal information request information by sending the target personal information request information to the target terminal.

[0025] In a specific implementation, the authentication platform 130 sends a confirmation authorization request to the target terminal 110 according to the registration requirements of the service provider server 120. The confirmation authorization request includes the target personal information request information in the personal information request information. The target terminal 110 returns the authorization confirmation information based on the target personal information request list. For example, the personal information request information sent by the service provider server to the authentication platform includes information A, information B and information C, among which information A does not involve privacy and does not require user authorization. Information B and information C have higher privacy and require user authorization. At this time, only information B and information C can be sent to the user as target personal information request information for authorization confirmation.

[0026] In this way, after the authentication platform has screened the personal information request information to a certain extent, it will send the target personal information request information with high privacy to the user for authorization confirmation, which can reduce the amount of data transmission, and at the same time reduce the user's authorization burden and increase the probability of user authorization.

[0027] Among them, the target terminal 110 can query the International Mobile Subscriber Identity (IMSI) of the SIM card, the International Mobile Equipment Identity (IMEI) of the target terminal, etc., and return the IMSI code and IMEI code of the SIM card as authorization confirmation information to the authentication platform 130.

[0028] Optionally, the target terminal 110 may also display a personal information request list to the user through a preset display window. When the user browses the personal information request list through the display window and confirms that it is correct, the user enters corresponding biometric information, such as fingerprint data, face data, voice data, etc. The target terminal 110 returns the biometric information entered by the user to the authentication platform 130 as authorization confirmation information.

[0029] Optionally, after obtaining the biometric information input by the user, the target terminal 110 may also query the IMSI code of the SIM card and the IMEI code of the target terminal, and return the biometric information, the IMSI code of the SIM card and the IMEI code of the terminal as authorization confirmation information to the authentication platform 130; the biometric information, the IMSI code of the SIM card and the IMEI code of the target terminal may also be encrypted, hashed, etc. and then returned to the authentication platform 130.

[0030] Step 203: Determine whether the authorization confirmation information is verified, and obtain the pre-stored target user identity information corresponding to the personal information request list.

[0031] In a specific implementation, the authentication platform 130 can verify the authorization confirmation information returned by the target terminal 110 according to the pre-stored information, and when it is determined that the authorization confirmation information is verified successfully, obtain the pre-stored target user identity information corresponding to the personal information request list.

[0032] In an exemplary embodiment, if the authorization confirmation information is fingerprint data input by the user, the authentication platform 130 can determine whether the authorization confirmation information is verified by comparing the pre-stored fingerprint feature with the fingerprint data input by the user; if the authorization confirmation information is voice data input by the user, the authentication platform 130 can determine whether the authorization confirmation information is verified by comparing the pre-stored voiceprint feature with the voice data input by the user; if the authorization confirmation information is biometric information, the IMSI code of the SIM card and the IMEI code of the terminal, a summary can be generated based on the biometric information, the IMSI code of the SIM card and the IMEI code of the terminal, and the authentication platform 130 can determine whether the authorization confirmation information is verified by comparing the summary with the pre-stored target summary, where the target summary can be generated based on the pre-stored target biometric information, target IMSI code and target IMEI code.

[0033] Step 204: Send the target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

[0034] In a specific implementation, the target user identity information corresponding to the personal information request list is sent to the service provider server 120, and the service provider server 120 performs user identity authentication according to the target user identity information and completes the registration process.

[0035] Through the above steps, during the identity authentication process, the user identity information corresponding to the personal information request information is provided to the service provider server through the authorization authentication platform, without having to fill in a large number of forms, which can improve the user experience. At the same time, after the authorization confirmation information is verified, the authentication platform provides the corresponding user identity information to the service provider server, which can effectively prevent personal privacy leakage or unauthorized access.

[0036] In a possible implementation, the authorization confirmation information includes at least one of the first biometric information, the first identity information, and the first device serial number; In the above step 202, determining that the authorization confirmation information is verified successfully includes: Generate a first digest based on at least one of the first biometric information, the first identity identification information and the first device serial number; when it is determined that the first digest is the same as a pre-stored second digest, determine that the authorization confirmation information verification is successful, wherein the second digest is generated based on at least one of the pre-stored target biometric information, the target identity identification information and the target device serial number.

[0037] In the embodiment of the present application, the first biometric information may be biometric information such as fingerprint data, face data, and voice data input by the user through the target terminal, the first identity information may be the IMSI code of the SIM card carried by the target terminal 110, and the first device serial number may be the IMEI code of the target terminal 110. The SDK of the authentication platform may perform logical encryption on the fingerprint data, the IMSI code of the SIM card of the target terminal, and the IMEI code of the target terminal, and then use SHA256 to generate a first summary, and then send the first summary to the authentication platform. The authentication platform 130 compares the first summary with the pre-stored second summary, and when the two are consistent, determines that the authorization confirmation information verification is passed. The second summary can be generated based on the target biometric information, target identity information, and target device serial number obtained when the user registers on the authentication platform.

[0038] In this way, the authentication platform 130 verifies the authorization confirmation information through the first biometric information, the first identity identification information and the first device serial number, which can ensure the consistency of the user, terminal and SIM card, prevent risks such as identity forgery, terminal abuse or SIM card theft, and further improve the security of identity authentication.

[0039] In a possible implementation manner, before determining that the first summary is the same as the pre-stored second summary, the method further includes: Obtain user registration information corresponding to the target terminal, the user registration information including at least one of target biometric information, target identity identification information and target device serial number; perform logical encryption on the user registration information to obtain encrypted data; perform hash processing on the encrypted data to generate a second summary.

[0040] In the embodiment of the present application, the user can register the user on the authentication platform 130 using the biometric information and the terminal information, and provide the corresponding information in the mobile phone list of the personal information on the authentication platform. Figure 3 As shown in , the APP of the authentication platform installed on the target terminal 110 obtains the user registration information corresponding to the target terminal 110, and the user registration information includes the target biometric information, the target identity information and the target device serial number. The target biometric information can be the user's fingerprint data, the target identity information can be the IMSI code of the SIM card, and the target device serial number can be the IMEI code of the target terminal. After the fingerprint data, IMSI code and IMEI code are logically encrypted, SHA256 is used to generate the second summary. Among them, logical encryption is to encrypt the data by adjusting the preset algorithm or mathematical logic operation such as sorting and insertion.

[0041] In order to ensure security and data consistency, the fingerprint data can be stored locally in the target terminal 210. After the target terminal 110 compares the fingerprint data for similarity locally, it outputs the unique ID of the fingerprint data. The ID, IMSI, and IMEI of the fingerprint data are all unique. Therefore, the second digest generated after encryption according to the established strategy is fixed. Subsequently, a new first digest is generated to compare with the second digest to see if they are the same, so as to achieve consistency between the person, the card, and the machine.

[0042] The authentication platform APP sends the second summary H (fingerprint + IMSI + IMEI) to the authentication platform 130. The authentication platform 130 generates a unique ID for the user and stores the second summary to register the user's fingerprint data, the IMSI code of the SIM card, and the IMEI code of the terminal. Optionally, during the above registration process, the target terminal 110 can also provide personal information to the authentication platform 130.

[0043] In this way, users can pre-register for the authentication platform on the authentication platform's APP and provide corresponding personal information to the authentication platform.

[0044] In a possible implementation, in the above step 203, before obtaining the pre-stored target user identity information corresponding to the personal information request information, the following is further included: Acquire business information and personal information in user agreements of multiple service providers; cluster the multiple service providers according to the business information of each of the service providers to obtain at least one target class; select a target service provider from the service providers corresponding to each of the target classes; determine a collection list according to the union of the personal information of the target service providers; store the collection list, which includes the target user identity information.

[0045] In the embodiment of the present application, the user agreement is a user agreement downloaded from a public channel and signed by each network service provider when providing services. Figure 4 As shown in , the authentication platform 130 obtains user agreements of multiple service providers and pre-processes the user agreements. The pre-processing mainly includes normalization processing, uniformly expressing personal information, and extracting the business information of the network service provider and the personal information to be obtained from the user agreement. For example, if the network service provider is a game manufacturer, its business information includes terminal games, mobile games, web games, etc. Then, according to the business information of each service provider, the multiple service providers are clustered to obtain at least one target class. The network service providers in the same target class provide the same or similar services; select the target service provider from the service providers corresponding to each target class; and determine the collection list according to the union of the personal information of the target service provider.

[0046] The clustering of the plurality of service providers according to the business information of each of the service providers to obtain at least one target class includes: Acquire characteristic words in the service information; encode the characteristic words to obtain characteristic vectors of the service information; and cluster the multiple service providers according to the characteristic vectors of the service information to obtain at least one target class.

[0047] In an embodiment of the present application, feature words are extracted from business information, and Word2vec is used to encode the feature words of all network service providers to obtain feature vectors of the business information; K-means is called to cluster multiple network service providers using the feature vectors of the business information to obtain K target classes.

[0048] The above-mentioned selecting a target service provider from the service providers corresponding to each of the target categories includes: For each target class, the service capability of the service provider corresponding to the target class is evaluated according to the preset service capability evaluation rules to obtain a service capability estimate; the service capability estimate is used to indicate the service capability of the service provider; the service provider whose service capability estimate meets the preset threshold is determined as the target service provider corresponding to the target class.

[0049] In an embodiment of the present application, N typical target service providers are screened out for each target class. Specifically, the service capabilities of the service providers corresponding to the target class can be evaluated according to preset service capability evaluation rules to obtain service capability estimates. Service providers whose service capability estimates exceed a preset threshold are determined as typical target service providers, wherein the preset threshold can be selected based on an empirical value, or the service providers corresponding to the target class can be sorted in descending order of the service capability estimates, and the service capability estimate of the service provider ranked m is determined as the preset threshold.

[0050] The above-mentioned evaluation of the service capability of the service provider corresponding to the target class according to the preset service capability evaluation rule to obtain the service capability estimate includes: Taking a weighted sum of the first estimated value, the second estimated value, and the third estimated value to obtain a service capacity estimated value corresponding to the service provider; Among them, the first estimated value is the first number of messages sent by the service provider within a preset time period; the second estimated value is the sum of the user scale level and the active user ratio of the service provider; and the third estimated value is the second number of user reply messages of the service provider within the preset time period.

[0051] In the embodiment of the present application, the service capability of the service provider can be evaluated using the following formula, and N target service providers with the highest estimated service capabilities are selected from the K target categories.

[0052] ; in, Score Estimate service capacity; P is a first estimated value, which may be a first number of messages sent by the service provider within a preset time period. The preset time period may be selected based on experience, for example, the number of text messages sent by the service provider in the last three months. The first estimated value is used to measure the overall operational capacity of the service provider; is the user scale level of the service provider, N The number of messages with the same content sent to a service provider at one time, for example, sending marketing SMS to all registered users in a certain period of time. This value can measure the user scale of the network service provider to a certain extent. X is the number of users; is the proportion of active users, M The number of users who sent messages exceeding the threshold within a preset time period of the service provider. This value can measure the scale of active users of the network service provider to a certain extent. Q The second number of user replies to messages sent by the service provider within a preset time period. In specific applications, most messages sent by the service provider are verification codes, notifications, advertisements, etc., with almost no actual interactive content. If the user replies, most of them indicate unsubscription, which can be used as a penalty item; The weight is adjustable.

[0053] The above-mentioned collection list includes a public information list and an extended information list; Based on the union of the personal information of the target service provider, a collection list is determined, including: The intersection of the personal information of the target service provider is determined as the public information list; and the personal information in the collection list except the public information list is determined as the extended information list.

[0054] In the embodiment of the present application, the collection list can be divided into a public information list and an extended information list; both the public information list and the extended information list record the user's personal information, and the public information list is personal information with a high frequency of use and a low degree of privacy. For example, user avatars, user nicknames, phone numbers, email addresses, interest tags, etc. Users centrally authorize the use of personal information in the public information list, and network service providers can directly request personal information in the public information list from the authentication platform.

[0055] The extended information list is personal information with low frequency of use or high privacy, such as bank card information, real-name information, etc. If a service provider wants to apply to use this personal information, the user needs to authorize the network service provider separately.

[0056] After determining the union of the personal information of the target service provider as the collection list, the authentication platform 130 may determine the intersection of the personal information of the target service provider as the public information list; and determine the personal information in the collection list except the public information list as the extended information list.

[0057] In a possible implementation, in the above step 204, sending the target user identity information to the provider server includes: When it is determined that the target user identity information is personal information in the extended information list, an authorization verification request is sent to the target terminal; a confirmation operation returned by the target terminal based on the authorization verification request is received, and the target user identity information is sent to the provider server.

[0058] In the embodiment of the present application, the authentication platform 130 determines whether the target user identity information (e.g., name, ID number, mobile phone number, etc.) is included in the extended information list, and if the target user identity information is personal information in the extended information list, sends an authorization verification request to the target terminal 110. After the user completes the authorization verification on the target terminal 110, the target terminal 110 returns the confirmation operation to the authentication platform 130, and the authentication platform 130 sends the target user identity information to the provider server 120, so that the service provider server 120 performs user identity authentication based on the target user identity information.

[0059] In a possible implementation, in the above step 204, sending the target user identity information to the provider server includes: Generate a first digital certificate based on the target user identity information; encrypt the first digital certificate using the target private key to obtain a first digital signature; send the first digital certificate, the first digital signature and the target public key to the provider server, wherein the target private key corresponds to the target public key.

[0060] In the present application embodiment, Figure 5As shown in , the authentication platform 130 generates a digital certificate based on the target user identity information, wherein the digital certificate may include information of the authentication platform 130, information of the network service provider corresponding to the service provider server 120, the user's personal information (the target user identity information corresponding to the user ID and the personal information request list authorized by the user) and the validity period; the digital certificate is encrypted by the target private key S to obtain a digital signature; the digital certificate, digital signature and target public key S are returned to the target terminal 110, and provided to the service provider server 120 through the target terminal 110, wherein the target private key corresponds to the target public key.

[0061] In a possible implementation, in the above step 204, after sending the first digital certificate, the first digital signature and the target public key to the provider server, the step further includes: Obtain a login request sent by the service provider server; send the login request to the target terminal, and obtain login authorization information returned by the target terminal based on the login request; if it is determined that the login authorization information is verified, authorize the service provider server to perform identity authentication based on the user identification information in the digital certificate.

[0062] In the present application embodiment, Figure 6 As shown in , when the user uses the network service provider's APP in the target terminal 110 but not for the first time, the network service provider's APP sends a login request to the authentication platform 130 by calling the authentication platform's SDK; the authentication platform 130 sends the login request to the target terminal 110, and obtains the login authorization information returned by the target terminal 110 based on the login request. The login authorization information may include the fingerprint data input by the user, the IMSI code of the current terminal SIM card, and the IMEI code of the terminal; when it is determined that the login authorization information verification has passed, the authorization service provider server 120 performs identity authentication based on the user identification information in the digital certificate.

[0063] In one possible implementation, the login authorization information includes the second biometric information, the second identity information, and the second device serial number; The above-mentioned determination that the login authorization information verification is passed includes: Generate a third digest based on the second biometric information, the second identity information and the second device serial number; when it is determined that the third digest is the same as the pre-stored second digest, determine that the login authorization information verification is successful, wherein the second digest is generated based on the pre-stored target biometric information, the target identity information and the target device serial number.

[0064] In an embodiment of the present application, the target terminal 110 can display a login request in a preset area, and obtain the second biometric information input by the user based on the login request, wherein the second biometric information can be fingerprint data. The SDK of the authentication platform queries the IMSI code of the current terminal SIM card and the IMEI code of the terminal, and generates a third digest using SHA256 after logical encryption with the fingerprint data, takes out the user ID from the digital certificate, and sends the third digest and the user ID to the authentication platform. The authentication platform compares the third digest with the pre-stored second digest. When the two are consistent, it is determined that the login authorization information verification is successful.

[0065] In a possible implementation, before the above-mentioned obtaining the login authorization information returned by the target terminal based on the login request, the method further includes: Decrypting the first digital signature using the target public key to obtain first authentication data, and performing hash encryption on the first digital certificate to obtain second authentication data; In a case where the first authentication data is the same as the second authentication data, the login authorization information returned by the target terminal based on the login request is obtained.

[0066] In an embodiment of the present application, the SDK of the authentication platform uses the target public key S to symmetrically decrypt the first digital signature to obtain the first authentication data value1, and hash-encrypts the first digital certificate to obtain the second authentication data value2. When value1 and value2 are the same, the SDK of the authentication platform obtains the login authorization information returned by the target terminal based on the login request.

[0067] In a possible implementation, after sending the first digital certificate, the first digital signature and the target public key to the provider server, the method further includes: In response to a request for newly added personal information sent by a service provider server, the request for newly added personal information is sent to the target terminal to obtain newly added authorization information returned by the target terminal based on the request for newly added personal information; when it is determined that the verification of the newly added authorization information is passed, the newly added personal information corresponding to the target terminal is obtained, and the newly added personal information is sent to the service provider server, wherein the newly added personal information is personal information outside the digital certificate.

[0068] In the embodiment of the present application, when using personal information, the APP of the network service provider corresponding to the service provider server 120 calls the SDK of the authentication platform to request the use of personal information (including requirements). At this time, the SDK of the authentication platform uses the public key S to symmetrically decrypt the digital signature to obtain value3, and hash-encrypts the digital certificate to obtain value4. When value3 and value4 are the same, it queries whether the personal information is located in the digital certificate.

[0069] If the personal information is in the digital certificate, the personal information will be requested directly from the authentication platform (including requirements). Regardless of whether the personal information is in the public information list or the extended information list, the authentication platform will directly return the personal information.

[0070] If the personal information is located outside the digital certificate, that is, newly added personal information, in most cases, the personal information is located in the extended information list. The SDK of the authentication platform responds to the request for newly added personal information sent by the service provider server 120, obtains the identity information of the target terminal 110, and when it is determined that the identity information verification is passed, obtains the newly added personal information corresponding to the target terminal 110, and sends the newly added personal information to the service provider server 120.

[0071] The identity information includes third biometric information, third identity information and third device serial number; The above-mentioned determination that the identity information verification is passed includes: Generate a fourth summary based on the third biometric information, the third identity information and the third device serial number; and determine that the identity information verification is successful when the fourth summary is the same as the pre-stored second summary.

[0072] In an exemplary embodiment, the SDK of the authentication platform queries the IMSI code and IMEI code of the SIM card of the target terminal 110, generates a fourth digest using SHA256 after logical encryption with the fingerprint data, and sends the fourth digest and the user ID to the authentication platform. The authentication platform compares the fourth digest with the pre-stored second digest. When the two are consistent, it is determined that the identity information verification has passed.

[0073] In a possible implementation manner, the above-mentioned obtaining the newly added personal information corresponding to the target terminal includes: When it is determined that the collection list includes the newly added personal information corresponding to the target terminal, the newly added personal information corresponding to the target terminal is obtained from the collection list; when it is determined that the collection list does not include the newly added personal information corresponding to the target terminal, a newly added personal information entry request is sent to the target terminal, and the newly added personal information corresponding to the target terminal is obtained from the entry information returned by the target terminal based on the newly added personal information entry request.

[0074] In the embodiment of the present application, if the authentication platform 130 determines that the pre-acquired collection list includes the newly added personal information, the newly added personal information corresponding to the target terminal is obtained from the collection list. If it is determined that the collection list does not include the newly added personal information corresponding to the target terminal, that is, the user has not entered the newly added personal information, a request for entering the newly added personal information is sent to the target terminal to prompt the user to enter the personal information. The user returns the entry information based on the request for entering the newly added personal information, and the newly added personal information corresponding to the target terminal is obtained from the entry information.

[0075] In a possible implementation, the sending of the newly added personal information to the service provider server includes: Generate a second digital certificate based on the newly added personal information; encrypt the second digital certificate using the target private key to obtain a second digital signature; send the second digital certificate, the second digital signature and the target public key to the provider server, wherein the target private key corresponds to the target public key.

[0076] In the embodiment of the present application, the authentication platform 130 regenerates a digital certificate, a digital signature, and a public key for the network service provider, adds the newly added personal information in the digital certificate, and sends the regenerated second digital certificate, the second digital signature, and the target public key to the provider server 120. When the provider server 120 receives the user's ID, it maps the user ID provided by the authentication platform to its own user ID, realizes registration and login, and opens corresponding business permissions to the user according to the obtained personal information.

[0077] Figure 7 Another flow chart of the identity authentication method provided in the embodiment of the present application is shown. The execution subject of the method is the service provider server 120. As shown in the figure, the identity authentication method 700 may include the following steps: Step 701: Obtain a registration request sent by a target terminal.

[0078] In a specific implementation, a network service provider APP may be installed on the target terminal 110 , and the user sends a registration request to the corresponding service provider server 120 through the network service provider APP, and the service provider server 120 obtains the registration request.

[0079] Step 702: Determine personal information request information according to the registration request.

[0080] In a specific implementation, the service provider server 120 determines the personal information request information according to the registration request, for example, the target user identity information such as user ID, account name, account password, nickname, mobile phone number, email address, etc. required for registration.

[0081] Step 703: Obtain the target user identity information corresponding to the personal information request information by sending the personal information request information to the authentication platform.

[0082] In a specific implementation, the network service provider's APP can call the authentication platform SDK, send the personal information request information to the authentication platform 130, request the authentication platform 130 to generate and issue user identity information such as user ID, initial personal information, etc., and obtain the target user identity information corresponding to the personal information request information returned by the authentication platform 130.

[0083] Step 704: Authenticate the user identity based on the target user identity information.

[0084] In a specific implementation, the service provider server 120 performs user identity authentication based on the target user identity information returned by the authentication platform 130 .

[0085] Through the above steps, the service provider server sends personal information request information to the authentication platform, and the user provides the target user identity information corresponding to the personal information request information to the service provider server through the authorized authentication platform, which can reduce the user's operation of filling out a large number of forms when registering and improve the user experience.

[0086] In a possible implementation, in the above step 703, obtaining the target user identity information by sending the personal information request information to the authentication platform includes: By sending the personal information request information to the authentication platform, the first digital certificate, the first digital signature and the target public key returned by the authentication platform are obtained; the first digital signature is decrypted by the target public key to obtain the decrypted information; when the decrypted information is consistent with the information in the first digital certificate, the target user identity information is determined according to the first digital certificate.

[0087] In a specific implementation, the service provider server 120 uses the target public key S to symmetrically decrypt the first digital signature to obtain decrypted information, hash-encrypts the first digital certificate to obtain verification information, and when the decrypted information is consistent with the verification information, queries the target user identity information in the first digital certificate.

[0088] In this way, the legitimacy of the target user's identity information can be ensured, man-in-the-middle attacks and certificate forgery can be prevented, and the security of identity authentication can be further improved.

[0089] In a possible implementation, after the user identity is authenticated based on the target user identity information in step 704, the following further includes: In response to the login request sent by the target terminal, a login authorization request corresponding to the login request is sent to the authentication platform; and a login authorization response returned by the authentication platform is obtained, wherein the login authorization response is used to instruct the service provider server to perform identity authentication based on the user identification information in the first digital certificate.

[0090] In a specific implementation, when the target terminal is not logging into the service provider server 120 for the first time, in response to the login request sent by the target terminal, the authentication platform SDK is called to send a login authorization request to the authentication platform 130, and the login authorization response returned by the authentication platform 130 is obtained. The service provider server 120 performs identity authentication based on the user identification information in the first digital certificate.

[0091] In a possible implementation, after the user identity is authenticated based on the target user identity information in step 704, the following further includes: Send a request for adding personal information to the authentication platform, where the added personal information is personal information outside the first digital certificate; and obtain the added personal information corresponding to the target terminal returned by the authentication platform.

[0092] In a specific implementation, the service provider server 120 may also request the authentication platform 130 to send newly added personal information to further improve the user registration information.

[0093] Figure 8 Another flow chart of the identity authentication method provided in the embodiment of the present application is shown. The execution subject of the method is the target terminal 110. As shown in the figure, the identity authentication method 800 may include the following steps: Step 801: In response to a registration request sent by a target terminal to a service provider server, target personal information request information sent by an authentication platform is obtained.

[0094] In a specific implementation, the target terminal 110 may be installed with an APP of a network service provider, and the user sends a registration request to the corresponding service provider server 120 through the APP of the network service provider, and the service provider server 120 generates personal information request information based on the registration request. The APP of the network service provider calls the authentication platform SDK, sends the target personal information request information to the authentication platform 130, and requests the authentication platform 130 to generate and send target user identity information such as user ID and initial personal information. The authentication platform 130 responds to the registration request sent by the target terminal 110, obtains the personal information request information returned by the service provider server 120 based on the registration request, and sends the target personal information request information in the personal information request information that requires user authorization confirmation to the target terminal 110, and the target terminal 110 obtains the target personal information request information corresponding to the registration request.

[0095] Step 802: Obtain authorization confirmation information returned based on the target personal information request information by displaying the target personal information request information.

[0096] In a specific implementation, the target terminal 110 can display the target personal information request information sent by the authentication platform 130 in a preset display area. The user browses the personal information request list through the display area. When confirming that the personal information request list can be provided to the provider server 120, the user enters biometric information such as face data, fingerprint data, and voice data in the target area. The target terminal 110 obtains the authorization confirmation information returned based on the personal information request list. The authorization confirmation information may include biometric information, identity identification information, device serial number, etc.

[0097] Step 803: Send the authorization confirmation information to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information is verified, and send the pre-stored target user identity information to the service provider server, so that the service provider server authenticates the user identity based on the target user identity information.

[0098] In a specific implementation, the target terminal 110 sends the obtained authorization confirmation information to the authentication platform 130, and the authentication platform 130 determines that the authorization confirmation information is verified, and sends the target user identity information corresponding to the personal information request information to the service provider server 120. The service provider server 120 authenticates the user identity based on the target user identity information.

[0099] Through the above steps, during the identity authentication process, the target terminal provides the user identity information corresponding to the personal information request information to the service provider server through the authorization authentication platform, without having to fill out a large number of forms, which can improve the user experience. At the same time, after the authorization confirmation information is verified, the authentication platform provides the corresponding user identity information to the service provider server, which can effectively prevent personal privacy leakage or unauthorized access.

[0100] In a possible implementation, in the above step 802, obtaining the authorization confirmation information returned based on the target personal information request information includes: Obtain the first biometric information returned based on the personal information request information, and obtain the first identity recognition information and the first device serial number corresponding to the target terminal; determine the authorization confirmation information based on the first biometric information, the first identity recognition information and the first device serial number.

[0101] In a possible implementation, after sending the authorization confirmation information to the authentication platform in step 803, the method further includes: Obtaining an authorization verification request sent by the authentication platform, wherein the authorization verification request is sent by the authentication platform when determining that the target user identity information is personal information in an extended information list; In response to a confirmation operation based on the authorization verification request, the confirmation operation is sent to the authentication platform, and the target user identity information is sent to the service provider server through the authentication platform.

[0102] In a possible implementation, after sending the authorization confirmation information to the authentication platform in step 803, the method further includes: In response to a login request sent by the target terminal to the service provider server, a login authorization request sent by the authentication platform is obtained; based on the login authorization request, login authorization information is determined; the login authorization information is sent to the authentication platform, and the authentication platform is used to send a login authorization response to the service provider server when it is determined that the login authorization information has been verified.

[0103] The step of determining the login authorization information according to the login authorization request includes: Acquire the second biometric information returned based on the login authorization request, and acquire the second identity information and the second device serial number corresponding to the target terminal; determine the login authorization information according to the second biometric information, the second identity information and the second device serial number.

[0104] In a possible implementation, after sending the authorization confirmation information to the authentication platform in step 803, the method further includes: In response to a request for newly added personal information sent by a service provider server, the identity information of the target terminal is sent to the authentication platform, wherein the authentication platform is used to obtain the newly added personal information corresponding to the target terminal when it is determined that the identity information verification has passed, and send the newly added personal information to the service provider server, wherein the newly added personal information is personal information outside the digital certificate.

[0105] In a possible implementation, after sending the authorization confirmation information to the authentication platform in step 803, the method further includes: Obtaining a request for entering newly added personal information sent by the authentication platform; wherein the request for entering newly added personal information is sent by the authentication platform when it is determined that the collection list does not include the newly added personal information corresponding to the target terminal; Based on the newly added personal information entry request, the entry information is returned to the authentication platform, so that the authentication platform obtains the newly added personal information corresponding to the target terminal from the entry information.

[0106] In a possible implementation, after sending the authorization confirmation information to the authentication platform in step 803, the method further includes: A registration response sent by the service provider server is obtained, where the registration response is used to indicate an authentication result of a user identity corresponding to the target user identity information.

[0107] In a specific implementation, the registration response sent by the service provider server 120 can be displayed in a preset display area of ​​the target terminal 110. The registration response can be a flag or a status code, which is used to indicate the authentication result of the user identity corresponding to the target user identity information, for example, authentication passed, authentication failed, etc., so as to timely know the status of user identity authentication and perform corresponding subsequent operations according to the authentication result, for example, continue registration, obtain related services, etc.

[0108] Fig. 9 The schematic diagram of the structure of the authentication platform provided by the embodiment of the present application is shown. The authentication platform can implement the following Figure 2 In the embodiment shown, all or part of the content, the authentication platform 900, includes: A registration response module 910 is used to obtain personal information request information sent by a service provider server, wherein the personal information request information is sent by the service provider server based on a registration request of a target terminal; The authorization confirmation module 920 is used to obtain authorization confirmation information returned by the target terminal based on the target personal information request information by sending the target personal information request information in the personal information request information to the target terminal; Information acquisition module 930, used to determine that the authorization confirmation information is verified, and obtain the pre-stored target user identity information corresponding to the personal information request list; The first sending module 940 is configured to send the target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

[0109] In a possible implementation, the authorization confirmation information includes at least one of the first biometric information, the first identity information, and the first device serial number; The authorization confirmation module 920, when used to determine that the authorization confirmation information is verified, is specifically used to: generating a first summary based on at least one of the first biometric information, the first identity information, and the first device serial number; When it is determined that the first digest is the same as a pre-stored second digest, it is determined that the authorization confirmation information verification is passed, wherein the second digest is generated based on at least one of pre-stored target biometric information, target identity information, and target device serial number.

[0110] In a possible implementation, the authorization confirmation module 920 is further configured to: Acquire user registration information corresponding to the target terminal, the user registration information including at least one of target biometric information, target identity information, and target device serial number; Performing logical encryption on the user registration information to obtain encrypted data; The encrypted data is hashed to generate a second summary.

[0111] In a possible implementation, the information acquisition module 930 is further configured to: Obtain business information and personal information from user agreements with multiple service providers; Clustering the multiple service providers according to the business information of each of the service providers to obtain at least one target class; Selecting a target service provider from the service providers corresponding to each of the target categories; Determine a collection list based on the union of personal information of the target service provider; The collection list is stored, wherein the collection list includes target user identity information.

[0112] In a possible implementation, the information acquisition module 930, when used to cluster the multiple service providers according to the business information of each of the service providers to obtain at least one target class, is specifically used to: Acquire characteristic words in the business information; Encoding the characteristic words to obtain a characteristic vector of the business information; Clustering is performed on the multiple service providers according to the feature vector of the service information to obtain at least one target class.

[0113] In a possible implementation, the information acquisition module 930, when used to select a target service provider from the service providers corresponding to each of the target categories, is specifically used to: For each target class, the service capability of the service provider corresponding to the target class is evaluated according to a preset service capability evaluation rule to obtain a service capability estimate; the service capability estimate is used to indicate the service capability of the service provider; A service provider whose service capability estimate meets a preset threshold is determined as a target service provider corresponding to the target class.

[0114] In a possible implementation, the information acquisition module 930, when used to evaluate the service capability of the service provider corresponding to the target class according to a preset service capability evaluation rule to obtain a service capability estimate, is specifically used to: Taking a weighted sum of the first estimated value, the second estimated value, and the third estimated value to obtain a service capacity estimated value corresponding to the service provider; Among them, the first estimated value is the first number of messages sent by the service provider within a preset time period; the second estimated value is the sum of the user scale level and the active user ratio of the service provider; and the third estimated value is the second number of user reply messages of the service provider within the preset time period.

[0115] In a possible implementation, the collection list includes a public information list and an extended information list; The information acquisition module 930 is further used for: Determine the intersection of the personal information of the target service provider as the public information list; The personal information in the collection list except the public information list is determined as the extended information list.

[0116] In a possible implementation, the first sending module 940, when used to send the target user identity information to the service provider server, is specifically used to: In the case where it is determined that the target user identity information is the personal information in the extended information list, sending an authorization verification request to the target terminal; A confirmation operation returned by the target terminal based on the authorization verification request is received, and the target user identity information is sent to the service provider server.

[0117] In a possible implementation, the first sending module 940, when used to send the target user identity information to the provider server, is specifically used to: Generate a first digital certificate according to the target user identity information; Encrypting the first digital certificate by using the target private key to obtain a first digital signature; The first digital certificate, the first digital signature, and the target public key are sent to the provider server, wherein the target private key corresponds to the target public key.

[0118] In a possible implementation, the first sending module 940 is further configured to: Obtaining a login request sent by the service provider server; Sending the login request to the target terminal, and obtaining login authorization information returned by the target terminal based on the login request; When it is determined that the login authorization information verification is passed, the service provider server is authorized to perform identity authentication according to the user identification information in the first digital certificate.

[0119] The login authorization information includes the second biometric information, the second identity information, and the second device serial number; The first sending module 940, when used to determine that the login authorization information is verified, is specifically used to: generating a third summary based on the second biometric information, the second identity information, and the second device serial number; When it is determined that the third digest is the same as a pre-stored second digest, it is determined that the login authorization information verification is passed, wherein the second digest is generated based on the pre-stored target biometric information, target identity information and target device serial number.

[0120] In a possible implementation, the first sending module 940 is further configured to: Decrypting the first digital signature using the target public key to obtain first authentication data, and performing hash encryption on the first digital certificate to obtain second authentication data; In a case where the first authentication data is the same as the second authentication data, the login authorization information returned by the target terminal based on the login request is obtained.

[0121] In a possible implementation, the first sending module 940 is further configured to: In response to a request for adding personal information sent by a service provider server, obtaining identity information of the target terminal; When it is determined that the identity information verification is passed, newly added personal information corresponding to the target terminal is obtained, and the newly added personal information is sent to the service provider server, wherein the newly added personal information is personal information outside the digital certificate.

[0122] The identity information includes third biometric information, third identity information and third device serial number; In a possible implementation, the first sending module 940, when used to determine whether the identity information verification is passed, is specifically used to: generating a fourth summary according to the third biometric information, the third identity identification information and the third device serial number; When the fourth digest is identical to the pre-stored second digest, it is determined that the identity information verification is successful.

[0123] In a possible implementation, the first sending module 940, when used to obtain the newly added personal information corresponding to the target terminal, is specifically used to: In a case where it is determined that the collection list includes the newly added personal information corresponding to the target terminal, acquiring the newly added personal information corresponding to the target terminal from the collection list; When it is determined that the collection list does not include the newly added personal information corresponding to the target terminal, a newly added personal information entry request is sent to the target terminal, and the newly added personal information corresponding to the target terminal is obtained from the entry information returned by the target terminal based on the newly added personal information entry request.

[0124] In a possible implementation, the first sending module 940, when used to send the newly added personal information to the service provider server, is specifically used to: Generate a second digital certificate based on the newly added personal information; Encrypting the second digital certificate by using the target private key to obtain a second digital signature; The second digital certificate, the second digital signature and the target public key are sent to the provider server, wherein the target private key corresponds to the target public key.

[0125] The embodiment of the present application provides an authentication platform, including a registration response module, an authorization confirmation module, an information acquisition module and a first sending module; the registration response module acquires the personal information request information sent by the service provider server, and the personal information request information is sent by the service provider server based on the registration request of the target terminal; the authorization confirmation module acquires the authorization confirmation information returned by the target terminal based on the target personal information request information by sending the target personal information request information in the personal information request information to the target terminal; the information acquisition module determines that the authorization confirmation information is verified, and acquires the target user identity information corresponding to the personal information request list in the pre-stored collection list; the first sending module sends the target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information. In this way, in the identity authentication process, the user identity information corresponding to the personal information request list is provided to the service provider server through the authorization authentication platform, without filling in a large number of forms, which can improve the user experience. At the same time, after the authorization confirmation information is verified, the authentication platform provides the corresponding user identity information to the service provider server, which can effectively prevent personal privacy leakage or unauthorized access.

[0126] Fig.10 The schematic diagram of the structure of the service provider server provided in the embodiment of the present application is shown. The service provider server can implement the following Figure 7 In the embodiment shown, all or part of the content, the service provider server 1000 includes: The request acquisition module 1010 is used to acquire the registration request sent by the target terminal; An information determination module 1020, configured to determine personal information request information according to the registration request; The second sending module 1030 is used to obtain the target user identity information corresponding to the personal information request information by sending the personal information request information to the authentication platform; The identity authentication module 1040 is used to authenticate the user identity based on the target user identity information.

[0127] In a possible implementation, the second sending module 1030, when used to obtain the target user identity information by sending the personal information request information to the authentication platform, is specifically used to: By sending the personal information request information to the authentication platform, obtaining the first digital certificate, the first digital signature and the target public key returned by the authentication platform; Decrypting the first digital signature using the target public key to obtain decrypted information; When the decrypted information is consistent with the information in the first digital certificate, the target user identity information is determined according to the first digital certificate.

[0128] In a possible implementation, the service provider server 1000 further includes: A login authorization module, configured to respond to a login request sent by the target terminal and send a login authorization request corresponding to the login request to the authentication platform; Obtain a login authorization response returned by the authentication platform, wherein the login authorization response is used to instruct the service provider server to perform identity authentication according to the user identification information in the first digital certificate.

[0129] In a possible implementation, the service provider server 1000 further includes: A new request module, used to send a request for new personal information to the authentication platform, where the new personal information is personal information outside the first digital certificate; Acquire the newly added personal information corresponding to the target terminal returned by the authentication platform.

[0130] The embodiment of the present application provides a service provider server, including a request acquisition module, an information determination module, a second sending module and an identity authentication module; the request acquisition module acquires a registration request sent by a target terminal; the information determination module determines personal information request information according to the registration request; the second sending module acquires the target user identity information corresponding to the personal information request information by sending the personal information request information to an authentication platform; the identity authentication module authenticates the user identity based on the target user identity information. In this way, the service provider server sends the personal information request information to the authentication platform, and the user provides the target user identity information corresponding to the personal information request information to the service provider server through the authorization authentication platform, which can reduce the user's operation of filling out a large number of forms when registering and improve the user experience.

[0131] Fig.11 The schematic diagram of the structure of the terminal provided in the embodiment of the present application is shown. The terminal can implement the following Figure 8 In the embodiment shown, all or part of the contents, the terminal 1100 includes: A registration response module 1110, configured to respond to a registration request sent by a target terminal to a service provider server and obtain target personal information request information sent by an authentication platform; The information display module 1120 is used to obtain the authorization confirmation information returned based on the target personal information request information by displaying the target personal information request information; The third sending module 1130 is used to send the authorization confirmation information to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information is verified, and send the pre-stored target user identity information to the service provider server, so that the service provider server authenticates the user identity based on the target user identity information.

[0132] In a possible implementation, the terminal 1100 further includes: An authorization verification module, used to obtain an authorization verification request sent by the authentication platform, wherein the authorization verification request is sent by the authentication platform when it is determined that the target user identity information is personal information in an extended information list; In response to a confirmation operation based on the authorization verification request, the confirmation operation is sent to the authentication platform, and the target user identity information is sent to the service provider server through the authentication platform.

[0133] In a possible implementation, the terminal 1100 further includes: A login verification module, configured to obtain a login authorization request sent by the authentication platform in response to a login request sent by the target terminal to the service provider server; Determining login authorization information according to the login authorization request; The login authorization information is sent to the authentication platform, and the authentication platform is used to send a login authorization response to the service provider server when it is determined that the login authorization information is verified.

[0134] In a possible implementation, the terminal 1100 further includes: The registration response module is used to obtain a registration response sent by the service provider server, wherein the registration response is used to indicate an authentication result of a user identity corresponding to the target user identity information.

[0135] The embodiment of the present application provides a terminal, including a registration response module, an information display module and a second sending module; the registration response module responds to the registration request sent by the target terminal to the service provider server, and obtains the target personal information request information sent by the authentication platform; the information display module obtains the authorization confirmation information returned based on the target personal information request information by displaying the target personal information request information; the third sending module sends the authorization confirmation information to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information is verified, and sends the pre-stored target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information. In this way, the terminal provides the target user identity information corresponding to the personal information request information to the service provider server through the authorization authentication platform, without the user having to fill in a large number of forms, which can improve the user experience. At the same time, after the authorization confirmation information is verified, the authentication platform provides the corresponding user identity information to the service provider server, which can effectively prevent personal privacy leakage or unauthorized access.

[0136] Fig.12 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 1200 includes a processor 1210, and optionally, includes an internal bus 1220, a network interface 1230, and a memory 1240. Among them, the memory 1240 may include a memory 1241, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 1242 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 1200 may also include hardware required for other services.

[0137] The processor 1210, the network interface 1230 and the memory may be interconnected via an internal bus 1220, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0138] The memory 1240 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 1240 may include a memory 1241 and a non-volatile memory 1242 , and provide instructions and data to the processor 1210 .

[0139] The processor 1210 reads the corresponding computer program from the non-volatile memory 1242 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 1210 executes the program stored in the memory and specifically performs: Figure 2 or Figure 7 or Figure 8 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0140] The above application Figure 2 or Figure 7 or Figure 8 The method disclosed in the illustrated embodiment can be applied to the processor 1210, or implemented by the processor 1210. The processor 1210 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1210. The above processor 1210 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0141] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0142] Of course, in addition to software implementation, the electronic device 1200 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0143] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 2 or Figure 7 or Figure 8 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0144] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0145] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 2 or Figure 7 or Figure 8 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0146] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.

[0147] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0148] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0149] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0150] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0151] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. An identity authentication method, applied to an authentication platform, characterized in that: include: Acquire personal information request information sent by a service provider server, wherein the personal information request information is sent by the service provider server based on a registration request of a target terminal; By sending the target personal information request information in the personal information request information to the target terminal, obtaining the authorization confirmation information returned by the target terminal based on the target personal information request information; Determining that the authorization confirmation information is verified, and obtaining the pre-stored target user identity information corresponding to the personal information request information; The target user identity information is sent to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

2. The method according to claim 1, characterized in that: The authorization confirmation information includes at least one of first biometric information, first identity identification information and first device serial number; The determining that the authorization confirmation information is verified to be successful includes: generating a first summary based on at least one of the first biometric information, the first identity information, and the first device serial number; When it is determined that the first digest is the same as a pre-stored second digest, it is determined that the authorization confirmation information verification is passed, wherein the second digest is generated based on at least one of pre-stored target biometric information, target identity information, and target device serial number.

3. The method according to claim 2, characterized in that Before determining that the first summary is the same as the pre-stored second summary, the method further includes: Acquire user registration information corresponding to the target terminal, the user registration information including at least one of target biometric information, target identity information, and target device serial number; Performing logical encryption on the user registration information to obtain encrypted data; The encrypted data is hashed to generate a second summary.

4. The method according to claim 1, characterized in that Before obtaining the pre-stored target user identity information corresponding to the personal information request information, the method further includes: Obtain business information and personal information from user agreements with multiple service providers; Clustering the multiple service providers according to the business information of each of the service providers to obtain at least one target class; Selecting a target service provider from the service providers corresponding to each of the target categories; Determine a collection list based on the union of personal information of the target service provider; The collection list is stored, wherein the collection list includes target user identity information.

5. The method according to claim 4, characterized in that The selecting a target service provider from the service providers corresponding to each of the target categories includes: For each target class, the service capability of the service provider corresponding to the target class is evaluated according to a preset service capability evaluation rule to obtain a service capability estimate; the service capability estimate is used to indicate the service capability of the service provider; A service provider whose service capability estimate meets a preset threshold is determined as a target service provider corresponding to the target class.

6. The method according to claim 5, characterized in that The step of evaluating the service capability of the service provider corresponding to the target class according to a preset service capability evaluation rule to obtain an estimated service capability value includes: Taking a weighted sum of the first estimated value, the second estimated value, and the third estimated value to obtain a service capacity estimated value corresponding to the service provider; Among them, the first estimated value is the first number of messages sent by the service provider within a preset time period; the second estimated value is the sum of the user scale level and the active user ratio of the service provider; and the third estimated value is the second number of user reply messages of the service provider within the preset time period.

7. The method according to claim 4, characterized in that The collection list includes a public information list and an extended information list; The step of determining a collection list based on the union of the personal information of the target service provider includes: Determine the intersection of the personal information of the target service provider as the public information list; The personal information in the collection list except the public information list is determined as the extended information list.

8. The method according to claim 7, characterized in that The sending the target user identity information to the service provider server includes: In the case where it is determined that the target user identity information is the personal information in the extended information list, sending an authorization verification request to the target terminal; A confirmation operation returned by the target terminal based on the authorization verification request is received, and the target user identity information is sent to the service provider server.

9. The method according to claim 1, characterized in that: The sending the target user identity information to the provider server includes: Generate a first digital certificate according to the target user identity information; Encrypting the first digital certificate by using the target private key to obtain a first digital signature; The first digital certificate, the first digital signature, and the target public key are sent to the provider server, wherein the target private key corresponds to the target public key.

10. The method according to claim 9, characterized in that After sending the first digital certificate, the first digital signature and the target public key to the provider server, the method further includes: Obtaining a login authorization request sent by the service provider server; Sending the login authorization request to the target terminal, and obtaining login authorization information returned by the target terminal based on the login request; When it is determined that the login authorization information verification is passed, a login authorization response is sent to the service provider server, where the login authorization response is used to instruct the service provider server to perform identity authentication according to the user identification information in the first digital certificate.

11. The method according to claim 10, characterized in that The login authorization information includes second biometric information, second identity information, and second device serial number; The step of determining that the login authorization information verification is successful includes: generating a third summary based on the second biometric information, the second identity information, and the second device serial number; When it is determined that the third digest is the same as a pre-stored second digest, it is determined that the login authorization information verification is passed, wherein the second digest is generated based on the pre-stored target biometric information, target identity information and target device serial number.

12. The method according to claim 10, characterized in that Before acquiring the login authorization information returned by the target terminal based on the login request, the method further includes: Decrypting the first digital signature using the target public key to obtain first authentication data, and performing hash encryption on the first digital certificate to obtain second authentication data; In a case where the first authentication data is the same as the second authentication data, the login authorization information returned by the target terminal based on the login request is obtained.

13. The method according to claim 9, characterized in that After sending the first digital certificate, the first digital signature and the target public key to the provider server, the method further includes: In response to a request for adding personal information sent by a service provider server, obtaining identity information of the target terminal; When it is determined that the identity identification information verification is passed, newly added personal information corresponding to the target terminal is obtained, and the newly added personal information is sent to the service provider server, wherein the newly added personal information is personal information outside the first digital certificate.

14. The method according to claim 13, characterized in that The identity identification information includes third biometric information, third identity identification information and a third device serial number; The determining that the identity information verification is passed includes: generating a fourth summary according to the third biometric information, the third identity identification information and the third device serial number; When the fourth digest is identical to the pre-stored second digest, it is determined that the identity information verification is successful.

15. The method according to claim 13, characterized in that The acquiring of the newly added personal information corresponding to the target terminal includes: In a case where it is determined that the collection list includes the newly added personal information corresponding to the target terminal, acquiring the newly added personal information corresponding to the target terminal from the collection list; When it is determined that the collection list does not include the newly added personal information corresponding to the target terminal, a newly added personal information entry request is sent to the target terminal, and the newly added personal information corresponding to the target terminal is obtained from the entry information returned by the target terminal based on the newly added personal information entry request.

16. The method according to claim 13, characterized in that The sending the newly added personal information to the service provider server includes: Generate a second digital certificate based on the newly added personal information; Encrypting the second digital certificate by using the target private key to obtain a second digital signature; The second digital certificate, the second digital signature and the target public key are sent to the provider server, wherein the target private key corresponds to the target public key.

17. An identity authentication method, applied to a service provider server, characterized in that: include: Obtain the registration request sent by the target terminal; Determine the personal information request information based on the registration request; By sending the personal information request information to the authentication platform, the target user identity information corresponding to the personal information request information is obtained; The user identity is authenticated based on the target user identity information.

18. The method according to claim 17, characterized in that The step of obtaining the target user's identity information by sending the personal information request information to the authentication platform includes: By sending the personal information request information to the authentication platform, obtaining the first digital certificate, the first digital signature and the target public key returned by the authentication platform; Decrypting the first digital signature using the target public key to obtain decrypted information; When the decrypted information is consistent with the information in the first digital certificate, the target user identity information is determined according to the first digital certificate.

19. The method according to claim 18, characterized in that After the user identity is authenticated based on the target user identity information, the method further includes: In response to the login request sent by the target terminal, sending a login authorization request corresponding to the login request to the authentication platform; Obtain a login authorization response returned by the authentication platform, wherein the login authorization response is used to instruct the service provider server to perform identity authentication according to the user identification information in the first digital certificate.

20. The method according to claim 17, characterized in that After the user identity is authenticated based on the target user identity information, the method further includes: Sending a request for adding new personal information to the authentication platform, wherein the new personal information is personal information outside the first digital certificate; Acquire the newly added personal information corresponding to the target terminal returned by the authentication platform.

21. An identity authentication method, applied to a target terminal, characterized in that: include: In response to a registration request sent by the target terminal to the service provider server, obtaining target personal information request information sent by the authentication platform; By displaying the target personal information request information, obtaining the authorization confirmation information returned based on the target personal information request information; The authorization confirmation information is sent to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information is verified, and send the pre-stored target user identity information to the service provider server, so that the service provider server authenticates the user identity based on the target user identity information.

22. The method according to claim 21, characterized in that After sending the authorization confirmation information to the authentication platform, the method further includes: Obtaining an authorization verification request sent by the authentication platform, wherein the authorization verification request is sent by the authentication platform when determining that the target user identity information is personal information in an extended information list; In response to a confirmation operation based on the authorization verification request, the confirmation operation is sent to the authentication platform, and the target user identity information is sent to the service provider server through the authentication platform.

23. The method according to claim 21, characterized in that After sending the authorization confirmation information to the authentication platform, the method further includes: In response to a login request sent by the target terminal to the service provider server, obtaining a login authorization request sent by the authentication platform; Determining login authorization information according to the login authorization request; The login authorization information is sent to the authentication platform, and the authentication platform is used to send a login authorization response to the service provider server when it is determined that the login authorization information is verified.

24. The method according to any one of claims 21 to 23, characterized in that After sending the authorization confirmation information to the authentication platform, the method further includes: A registration response sent by the service provider server is obtained, where the registration response is used to indicate an authentication result of a user identity corresponding to the target user identity information.

25. An authentication platform, characterized in that: include: A registration response module, used to obtain personal information request information sent by a service provider server, wherein the personal information request information is sent by the service provider server based on a registration request of a target terminal; An authorization confirmation module, configured to obtain authorization confirmation information returned by the target terminal based on the target personal information request information by sending the target personal information request information in the personal information request information to the target terminal; An information acquisition module, used to determine whether the authorization confirmation information is verified, and to acquire the pre-stored target user identity information corresponding to the personal information request list; The first sending module is used to send the target user identity information to the service provider server, so that the service provider server performs user identity authentication based on the target user identity information.

26. A service provider server, characterized in that: include: A request acquisition module, used to acquire a registration request sent by a target terminal; An information determination module, used to determine personal information request information according to the registration request; A second sending module is used to obtain the target user identity information corresponding to the personal information request information by sending the personal information request information to the authentication platform; The identity authentication module is used to authenticate the user identity based on the target user identity information.

27. A terminal, characterized in that: include: A registration response module, used to respond to a registration request sent by the target terminal to the service provider server and obtain the target personal information request information sent by the authentication platform; An information display module, used to obtain authorization confirmation information returned based on the target personal information request information by displaying the target personal information request information; The third sending module is used to send the authorization confirmation information to the authentication platform, wherein the authentication platform is used to determine that the authorization confirmation information is verified, and send the pre-stored target user identity information to the service provider server, so that the service provider server authenticates the user identity based on the target user identity information.

28. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method described in any one of claims 1 to 24 are implemented.

29. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 24 are implemented.

30. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer is caused to perform the steps of the method according to any one of claims 1 to 24.

Images