An identity authentication method, system, device and medium

Abstract

The present invention provides an identity authentication method, system, device and medium, relating to the technical field of information security. The method includes: the client signs the information to be verified using a first signature private key to obtain first signature data; encrypts the first signature data and the information to be verified using a first symmetric key to obtain first encrypted information; signs the first encrypted information using a second signature private key to obtain second signature data; sends the first encrypted information and the second signature data to the server; the server verifies the second signature data using a second signature public key; decrypts the first encrypted information using the first symmetric key to obtain the first signature data and the information to be verified; verifies the first signature data using a first signature public key and extracts the first signature public key certificate to determine the user identity information; the client determines whether the information to be verified matches the user identity information, and if it matches, determines that the authentication is passed. This application improves the security of identity authentication.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular, to an identity authentication method, system, device and medium. Background Art

[0002] Identity authentication technology is an important means to ensure information security. Traditional identity authentication technologies include: knowledge-based identity authentication, such as password authentication; ownership-based identity authentication, such as tokens, IC cards, etc. The security of this authentication method in the prior art is relatively low. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to overcome the deficiencies in the prior art and provide an identity authentication method, system, device and medium. The present invention provides the following technical solutions:

[0004] In a first aspect, the present application provides an identity authentication method, which is applied to an identity authentication system. The system includes: a client and a server. The method includes:

[0005] The client obtains the information to be verified, signs the information to be verified using the first signature private key to obtain the first signature data; symmetrically encrypts the first signature data and the information to be verified using the first symmetric key to obtain the first encrypted information; signs the first encrypted information using the second signature private key to obtain the second signature data; and sends the first encrypted information and the second signature data to the server.

[0006] The server verifies the second signature data using the second signature public key; if the verification passes, symmetrically decrypts the first encrypted information using the first symmetric key to obtain the first signature data and the information to be verified; verifies the first signature data using the first signature public key, and if the verification passes, extracts the first signature public key certificate from the first signature data; determines the user identity information according to the first signature public key certificate, and sends the user identity information to the client.

[0007] The client determines whether the information to be verified matches the user identity information. If they match, the authentication is determined to pass.

[0008] In an embodiment, before symmetrically encrypting the first signature data and the information to be verified using the first symmetric key, it further includes: splicing the first signature data and the information to be verified according to a preset splicing rule.

[0009] In one embodiment, determining the user identity information according to the first signature public key certificate includes: querying a preset information database according to the first signature public key certificate to obtain the user identity information. Multiple different user identity information are prestored in the preset information database, and each user identity information corresponds to a different first signature public key certificate.

[0010] In one embodiment, sending the user identity information to the client further includes: symmetrically encrypting the user identity information with a second symmetric key to obtain second encrypted information; signing the second encrypted information with the second signature private key to obtain third signature data; and sending the second encrypted information and the third signature data to the client.

[0011] In one embodiment, before determining whether the information to be verified matches the user identity information, it further includes: verifying the third signature data with the second signature public key; if the verification passes, symmetrically decrypting the second encrypted information with the second symmetric key to obtain the user identity information.

[0012] In one embodiment, before determining whether the information to be verified matches the user identity information, it further includes: determining whether the user identity information is in a preset data format.

[0013] In one embodiment, before the client obtains the information to be verified, it further includes: obtaining a login password and logging in to the smart password key based on the login password; and obtaining key information based on the smart password key, where the key information includes: the first signature public key and the first signature private key.

[0014] In a second aspect, the present application provides an identity authentication system, and the system includes:

[0015] A client, configured to obtain information to be verified, sign the information to be verified with a first signature private key to obtain first signature data;

[0016] Symmetrically encrypt the first signature data and the information to be verified with a first symmetric key to obtain first encrypted information;

[0017] Sign the first encrypted information with a second signature private key to obtain second signature data;

[0018] Send the first encrypted information and the second signature data to the server;

[0019] The server is configured to verify the second signature data with the second signature public key;

[0020] If the verification passes, use the first symmetric key to perform symmetric decryption on the first encrypted information to obtain the first signature data and the information to be verified;

[0021] Use the first signature public key to verify the first signature data. If the verification passes, extract the first signature public key certificate from the first signature data;

[0022] Determine the user identity information according to the first signature public key certificate;

[0023] Send the user identity information to the client;

[0024] The client is further configured to determine whether the information to be verified matches the user identity information. If they match, it is determined that the authentication passes.

[0025] In a third aspect, the present application provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the computer program runs on the processor, it executes the identity authentication method described in the first aspect.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the identity authentication method described in the first aspect.

[0027] The identity authentication method, system, device, and medium provided by the embodiments of the present application. The method includes: the client obtains the information to be verified, signs the information to be verified using the first signature private key to obtain the first signature data; symmetrically encrypts the first signature data and the information to be verified using the first symmetric key to obtain the first encrypted information; signs the first encrypted information using the second signature private key to obtain the second signature data; sends the first encrypted information and the second signature data to the server; the server uses the second signature public key to verify the second signature data; if the verification passes, uses the first symmetric key to perform symmetric decryption on the first encrypted information to obtain the first signature data and the information to be verified; uses the first signature public key to verify the first signature data. If the verification passes, extracts the first signature public key certificate from the first signature data; determines the user identity information according to the first signature public key certificate, and sends the user identity information to the client; the client determines whether the information to be verified matches the user identity information. If they match, it is determined that the authentication passes. The present application realizes multiple encryptions of data in the identity authentication process, improving the security of identity authentication.

[0028] To make the above objects, features, and advantages of the present invention more obvious and understandable, the following specifically enumerates preferred embodiments and, in conjunction with the accompanying drawings, makes a detailed description as follows. Brief Description of the Drawings

[0029] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings.

[0030] Figure 1 Fig. shows a schematic flowchart of an identity authentication method provided by an embodiment of the present application;

[0031] Figure 2 Fig. shows a schematic structural diagram of an identity authentication system provided by an embodiment of the present application;

[0032] Figure 3 Fig. shows another schematic flowchart of an identity authentication method provided by an embodiment of the present application;

[0033] Figure 4 Fig. shows a schematic structural diagram of an electronic device provided by an embodiment of the present application.

[0034] Main Element Symbol Description:

[0035] 200 - Identity authentication system; 210 - Client; 220 - Server; 400 - Electronic device; 401 - Transceiver; 402 - Processor; 403 - Memory. Detailed Embodiments

[0036] The embodiments of the present invention will be described in detail below. Examples of the embodiments are shown in the drawings, where the same or similar reference numerals represent the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the present invention and should not be construed as limiting the present invention.

[0037] In addition, the terms "first" and "second" are only used for descriptive purposes and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the present invention, "a plurality" means two or more unless otherwise specifically defined.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terms used in the description of the template herein are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more of the related listed items.

[0039] Embodiment 1

[0040] Traditional identity authentication methods have relatively low security. For this, please refer to Figure 1 , this application proposes an identity authentication method, which is applied to an identity authentication system 200 as shown in Figure 2 . The identity authentication system 200 includes: a client 210 and a server 220. The identity authentication method includes steps S110 to S190.

[0041] Step S110, the client 210 obtains the information to be verified, signs the information to be verified using the first signature private key, and obtains the first signature data.

[0042] In this embodiment, the information to be verified includes: the obtained user identity information to be verified, and the first signature private key is the private key of the intelligent password key (UKey). Specifically, after the client 210 obtains the information to be verified, it uses the private key in the UKey to sign the information to be verified, and generates a signature value that conforms to the PKCS7 standard, that is, the first signature data. This signature value includes information such as the signature value itself, the signature algorithm identifier, and the signer's certificate, and can be sent to the server 220 for verification.

[0043] In an implementation manner, please refer to Figure 3 . Before the client 210 obtains the information to be verified, it further includes: steps S101 to S102.

[0044] Step S101, obtain the login password and log in to the intelligent password key based on the login password.

[0045] It can be understood that verifying the legitimacy of the accessing user through the login password improves the security of the key.

[0046] Step S102, based on the intelligent password key, obtain the key information, and the key information includes: the first signature public key and the first signature private key.

[0047] In this embodiment, the first signature public key and the first signature private key are used for subsequent signature operations on the information to be verified to ensure the authenticity and integrity of the information to be verified.

[0048] For example, for logging in to an online bank using a UKey and signing a transfer request, first, the PIN code of the UKey, such as "1234", needs to be entered. After logging in to the intelligent password key based on the login password, the keys and certificates inside the UKey are accessed to obtain key information, and the key information includes a first signature public key and a first signature private key.

[0049] Step S120: Use the first symmetric key to perform symmetric encryption on the first signature data and the information to be verified to obtain first encrypted information.

[0050] In this embodiment, the first symmetric key is generated based on the SM4 symmetric encryption algorithm (SM4 Symmetric Encryption Algorithm).

[0051] In an implementation manner, before using the first symmetric key to perform symmetric encryption on the first signature data and the information to be verified, it further includes: concatenating the first signature data and the information to be verified according to a preset concatenation rule.

[0052] In this embodiment, the preset concatenation rule includes: the rule of ascending ASCII code value arrangement. Specifically, the first signature data and the information to be verified are combined and concatenated into a string according to the rule of ascending ASCII code value arrangement.

[0053] Step S130: Use the second signature private key to sign the first encrypted information to obtain second signature data;

[0054] In this embodiment, the second signature private key includes: an SM2 signature private key (SM2 Signature Private Key). Specifically, use the SM2 signature private key to sign the first encrypted information to obtain a signature value that conforms to the PKCS1 standard.

[0055] Step S140: Send the first encrypted information and the second signature data to the server 220.

[0056] In this embodiment, the first encrypted information and the second signature data of the first encrypted information are sent to the server 220. The server 220 can verify the integrity of the first encrypted information and the reliability of the data source based on the obtained second signature data. After confirming that the first encrypted information is complete and reliable, the first encrypted information is further decrypted.

[0057] Step S150: The server 220 uses the second signature public key to verify the second signature data.

[0058] In this embodiment, the second signature public key includes: the SM2 signature public key. The server 220 uses the signature public key based on the SM2 algorithm to verify the validity of the second signature data. SM2 is an asymmetric encryption algorithm. The second signature data is generated using a private key, and the verification is completed through the corresponding public key. Through this verification process, the server 220 can ensure the integrity and authenticity of the signed data, thereby confirming that the data has not been tampered with during the transmission process and is generated by a legitimate entity holding the corresponding private key, improving the security during the data transmission process.

[0059] Step S160, if the verification passes, then use the first symmetric key to perform symmetric decryption on the first encrypted information to obtain the first signature data and the information to be verified.

[0060] In this embodiment, the same key, that is, the first symmetric key, is used for symmetric encryption and symmetric decryption, which is specifically implemented based on the symmetric encryption algorithm. Using the first symmetric key to decrypt the first encrypted information can restore the first encrypted information to the original plaintext data, that is, the first signature data and the information to be verified.

[0061] Step S170, use the first signature public key to verify the first signature data. If the verification passes, then extract the first signature public key certificate from the first signature data.

[0062] In this embodiment, by verifying whether the first signature data passes, the integrity of the signed data and the reliability of the source can be determined. Here, the signed data refers to the information to be verified.

[0063] Step S180, determine the user identity information according to the first signature public key certificate, and send the user identity information to the client 210.

[0064] In this embodiment, the first signature public key certificate includes: the UKey signature public key certificate, which includes: the public key of the digital signature and the related identity information and authentication information.

[0065] In an implementation manner, the sending the user identity information to the client 210 further includes: using the second symmetric key to perform symmetric encryption on the user identity information to obtain the second encrypted information; using the second signature private key to sign the second encrypted information to obtain the third signature data; sending the second encrypted information and the third signature data to the client 210.

[0066] In this embodiment, the processing procedure of the second symmetric key is the same as that of the first symmetric key described above. Based on the symmetric encryption algorithm, the identity information of the user is symmetrically encrypted to obtain the second encrypted information. Then, the second encrypted information is signed using the second signature private key, where the second signature private key includes: the SM2 signature private key, and the third signature data is a signature value conforming to the PKCS1 standard.

[0067] In an embodiment, before determining whether the information to be verified matches the user identity information, it further includes: verifying the third signature data using the second signature public key; if the verification passes, symmetrically decrypting the second encrypted information using the second symmetric key to obtain the user identity information.

[0068] In this embodiment, contrary to the processing procedure of the server 220, after receiving the third signature data and the second encrypted information, the client 210 verifies the third signature data using the second signature public key, and then decrypts the second encrypted information using the second symmetric key to obtain the user identity information.

[0069] In an embodiment, determining the user identity information according to the first signature public key certificate includes: querying a preset information library according to the first signature public key certificate to obtain the user identity information. Multiple different user identity information are prestored in the preset information library, and each user identity information corresponds to a different first signature public key certificate.

[0070] It can be understood that the preset information library stores the identity information of multiple users. The identity information of each user corresponds to a unique first signature public key certificate. According to the corresponding first signature public key certificate, the corresponding user identity information can be extracted from the preset information library, thereby completing the verification and confirmation of the user identity.

[0071] Step S190, the client 210 determines whether the information to be verified matches the user identity information. If they match, it is determined that the authentication passes.

[0072] In this embodiment, the client 210 compares the information to be verified with the user identity information obtained through the previous steps. If the two match, it indicates that the information to be verified is consistent with the user identity. The client 210 will determine that the authentication passes and allow the user to perform subsequent operations; otherwise, the authentication fails. Specifically, when the information to be verified is consistent with the user identity information, it is determined that the information to be verified matches the user identity information successfully.

[0073] In an embodiment, before determining whether the information to be verified matches the user identity information, it further includes: determining whether the user identity information is in a preset data format.

[0074] In this embodiment, if the user identity information is in a preset data format, it is further determined whether the information to be verified matches the user identity information. If the user identity information is not in the preset data format, it is considered that an abnormality occurs during the data transmission process, and it is confirmed that the authentication fails.

[0075] The identity authentication method provided by the embodiment of the present application includes: the client 210 obtains the information to be verified, signs the information to be verified using the first signature private key to obtain the first signature data; symmetrically encrypts the first signature data and the information to be verified using the first symmetric key to obtain the first encrypted information; signs the first encrypted information using the second signature private key to obtain the second signature data; sends the first encrypted information and the second signature data to the server 220; the server 220 verifies the second signature data using the second signature public key; if the verification passes, symmetrically decrypts the first encrypted information using the first symmetric key to obtain the first signature data and the information to be verified; verifies the first signature data using the first signature public key, and if the verification passes, extracts the first signature public key certificate from the first signature data; determines the user identity information according to the first signature public key certificate, and sends the user identity information to the client 210; the client 210 determines whether the information to be verified matches the user identity information, and if they match, determines that the authentication passes. The present application realizes multiple encryptions of data during the identity authentication process, improving the security of identity authentication.

[0076] Embodiment 2

[0077] In addition, please refer to Figure 2 , the embodiment of the present application provides an identity authentication system 200, including:

[0078] The client 210 is used to obtain the information to be verified, sign the information to be verified using the first signature private key to obtain the first signature data;

[0079] Symmetrically encrypt the first signature data and the information to be verified using the first symmetric key to obtain the first encrypted information;

[0080] Sign the first encrypted information using the second signature private key to obtain the second signature data;

[0081] Send the first encrypted information and the second signature data to the server 220;

[0082] The server 220 is used to verify the second signature data using the second signature public key;

[0083] If the verification is passed, the first symmetric key is used to perform symmetric decryption on the first encrypted information to obtain the first signature data and the information to be verified;

[0084] The first signature public key is used to verify the first signature data. If the verification is passed, the first signature public key certificate is extracted from the first signature data;

[0085] The user identity information is determined according to the first signature public key certificate;

[0086] The user identity information is sent to the client 210;

[0087] The client 210 is further configured to determine whether the information to be verified matches the user identity information. If they match, it is determined that the authentication is passed.

[0088] The identity verification system provided by the embodiments of the present application can implement the identity verification method described in Embodiment 1 above. To avoid repetition, it will not be elaborated here.

[0089] The identity verification system provided by the embodiments of the present application obtains the information to be verified through the client 210, signs the information to be verified using the first signature private key to obtain the first signature data; symmetrically encrypts the first signature data and the information to be verified using the first symmetric key to obtain the first encrypted information; signs the first encrypted information using the second signature private key to obtain the second signature data; sends the first encrypted information and the second signature data to the server 220; the server 220 uses the second signature public key to verify the second signature data; if the verification is passed, the first symmetric key is used to perform symmetric decryption on the first encrypted information to obtain the first signature data and the information to be verified; the first signature public key is used to verify the first signature data. If the verification is passed, the first signature public key certificate is extracted from the first signature data; the user identity information is determined according to the first signature public key certificate, and the user identity information is sent to the client 210; the client 210 determines whether the information to be verified matches the user identity information. If they match, it is determined that the authentication is passed, realizing multiple encryptions of data in the identity authentication process and improving the security of identity authentication.

[0090] Embodiment 3

[0091] In addition, an electronic device 400 is provided in an embodiment of the present invention, including a memory 403 and a processor 402. The memory 403 stores a computer program, and when the computer program runs on the processor 402, it executes the identity authentication method provided in Embodiment 1.

[0092] Specifically, please refer to Figure 4, the electronic device 400 includes: a transceiver 401, a bus interface, and a processor 402. The processor 402 is configured to obtain information to be verified for the client 210, sign the information to be verified using a first signature private key to obtain first signature data; symmetrically encrypt the first signature data and the information to be verified using a first symmetric key to obtain first encrypted information; sign the first encrypted information using a second signature private key to obtain second signature data; send the first encrypted information and the second signature data to the server 220. The server 220 verifies the second signature data using a second signature public key. If the verification passes, the server symmetrically decrypts the first encrypted information using the first symmetric key to obtain the first signature data and the information to be verified; verifies the first signature data using a first signature public key. If the verification passes, extracts a first signature public key certificate from the first signature data; determines user identity information according to the first signature public key certificate, and sends the user identity information to the client 210. The client 210 determines whether the information to be verified matches the user identity information. If they match, it is determined that the authentication passes.

[0093] In an embodiment of the present invention, the electronic device 400 further includes: a memory 403. In Figure 4 , the bus architecture may include any number of interconnected buses and bridges, specifically various circuits of one or more processors 402 represented by the processor 402 and the memory 403 represented by the memory 403 are linked together. The bus architecture can also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art, and thus will not be further described herein. The bus interface provides an interface. The transceiver 401 may be multiple components, that is, including a transmitter and a receiver, and provides a unit for communicating with various other devices on the transmission medium. The processor 402 is responsible for managing the bus architecture and general processing, and the memory 403 can store data used by the processor 402 when performing operations.

[0094] The electronic device 400 provided by the embodiment of the present invention can execute the identity authentication method provided in the above method embodiment 1. To avoid repetition, it will not be elaborated here.

[0095] Embodiment 4

[0096] In addition, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by the processor 402, it implements the identity authentication method provided in Embodiment 1.

[0097] In this embodiment, the computer-readable storage medium may be a read-only memory 403 (ROM for short), a random access memory 403 (RAM for short), a magnetic disk, an optical disk, or the like.

[0098] The computer-readable storage medium provided in this embodiment can implement the authentication method provided in Embodiment 1. To avoid repetition, it will not be elaborated here.

[0099] In all the examples shown and described here, any specific value should be construed as merely exemplary, not as a limitation. Therefore, other examples of the exemplary embodiments may have different values.

[0100] It should be noted that like reference numerals and letters denote like items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0101] The above-described embodiments merely represent several implementation manners of the present invention. The description thereof is relatively specific and detailed, but it should not be construed as a limitation to the scope of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of the present invention, several modifications and improvements can still be made, and these all belong to the protection scope of the present invention.

Claims

1. An identity authentication method, characterized in that, Applied to an identity authentication system, the system includes: a client and a server, and the method includes: The client obtains information to be verified, signs the information to be verified using a first signature private key to obtain first signature data; symmetrically encrypts the first signature data and the information to be verified using a first symmetric key to obtain first encrypted information; signs the first encrypted information using a second signature private key to obtain second signature data; and sends the first encrypted information and the second signature data to the server. The server verifies the second signature data using a second signature public key; if the verification passes, symmetrically decrypts the first encrypted information using the first symmetric key to obtain the first signature data and the information to be verified; verifies the first signature data using a first signature public key, and if the verification passes, extracts a first signature public key certificate from the first signature data; determines user identity information according to the first signature public key certificate, and sends the user identity information to the client. The client determines whether the information to be verified matches the user identity information, and if it matches, determines that the authentication passes.

2. The identity authentication method according to claim 1, characterized in that Before symmetrically encrypting the first signature data and the information to be verified using the first symmetric key, it further includes: Concatenating the first signature data and the information to be verified according to a preset concatenation rule.

3. The identity authentication method according to claim 1, wherein Determining the user identity information according to the first signature public key certificate includes: Querying a preset information database according to the first signature public key certificate to obtain the user identity information. Multiple different user identity information are pre-stored in the preset information database, and each user identity information corresponds to a different first signature public key certificate.

4. The identity authentication method according to claim 3, wherein When sending the user identity information to the client, it further includes: Symmetrically encrypting the user identity information using a second symmetric key to obtain second encrypted information; Signing the second encrypted information using the second signature private key to obtain third signature data; Sending the second encrypted information and the third signature data to the client.

5. The identity authentication method according to claim 4, wherein Before determining whether the information to be verified matches the user identity information, it further includes: Verifying the third signature data using a second signature public key; If the verification passes, symmetrically decrypt the second encrypted information using the second symmetric key to obtain the user identity information.

6. The identity authentication method according to claim 5, wherein Before determining whether the information to be verified matches the user identity information, it further includes: Determining whether the user identity information is in a preset data format.

7. The identity authentication method according to any one of claims 1-6, characterized in that, Before the client obtains the information to be verified, it further includes: Obtaining a login password and logging in to the intelligent password key based on the login password; Based on the intelligent password key, obtaining key information, where the key information includes: the first signature public key and the first signature private key.

8. An identity authentication system, characterized in that, The system includes: A client, configured to obtain information to be verified, sign the information to be verified using a first signature private key to obtain first signature data; Symmetrically encrypt the first signature data and the information to be verified using a first symmetric key to obtain first encrypted information; Sign the first encrypted information using the second signature private key to obtain second signature data; Send the first encrypted information and the second signature data to the server; The server is used to verify the second signature data using the second signature public key; If the verification passes, symmetrically decrypt the first encrypted information using the first symmetric key to obtain the first signature data and the information to be verified; Verify the first signature data using the first signature public key. If the verification passes, extract the first signature public key certificate from the first signature data; Determine the user identity information according to the first signature public key certificate; Send the user identity information to the client; The client is further used to determine whether the information to be verified matches the user identity information. If they match, it is determined that the authentication passes.

9. An electronic device, characterized in that, It includes a memory and a processor. The memory stores a computer program. When the computer program runs on the processor, it executes the identity authentication method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, it implements the identity authentication method according to any one of claims 1-7.

Images