Communication method and device, equipment, storage medium and program product

Abstract

The invention discloses a communication method and device, equipment, a storage medium and a program product, and the method comprises the steps: transmitting a connection request to a server, so as to enable the server to generate first to-be-authenticated information based on the connection request; wherein the authentication end is installed on the terminal equipment; the server side and the authentication side are provided by the same service provider; receiving the first to-be-authenticated information from the server; sending the first to-be-authenticated information to the authentication end, so that the authentication end authenticates the first to-be-authenticated information; and receiving a first session key from the authentication end in response to that the authentication end authenticates the first to-be-authenticated information, so as to communicate with the server by using the first session key.

Description

Technical Field

[0001] The present application relates to, but is not limited to, the field of computer technology, and in particular to a communication method, apparatus, device, storage medium, and program product. Background Art

[0002] The development of computer technology has brought great convenience to people's lives. However, when different computer devices communicate through the network, user information security issues may be involved.

[0003] For example, in the healthcare sector, to provide better medical information services, platform-based processing of medical device information is widely adopted. Specifically, medical information distributed across various workstations (computer devices) is transmitted to a medical platform via a communications network. This information can then be intelligently analyzed and processed using the artificial intelligence (AI) capabilities of the medical platform. This can improve the efficiency of medical information processing and yield more comprehensive analytical results.

[0004] However, medical information, such as the patient's chief complaint information, medical imaging information, doctor's diagnosis information, prescription list, etc., are all private information of patients and / or hospitals. If information leakage occurs during the transmission of medical information, it may cause huge economic losses and mental harm to patients and hospitals.

[0005] Therefore, how to improve the communication security between different computer devices has become an urgent problem to be solved. Summary of the Invention

[0006] In view of this, the present application provides at least one communication method, apparatus, device, storage medium, and program product.

[0007] The technical solution of this application is achieved as follows:

[0008] In one aspect, the present application provides a communication method, which is applied to a client installed on a terminal device, wherein the terminal device is also installed with an authentication terminal, including:

[0009] Sending a connection request to a server, so that the server generates first information to be authenticated based on the connection request; wherein the server and the authentication end are provided by the same service provider;

[0010] receiving the first information to be authenticated from the server;

[0011] sending the first information to be authenticated to the authentication end, so that the authentication end authenticates the first information to be authenticated;

[0012] In response to the authentication end successfully authenticating the first information to be authenticated, a first session key is received from the authentication end, so as to communicate with the service end using the first session key.

[0013] In some embodiments, in response to the authenticating end successfully authenticating the first information to be authenticated, receiving the first session key from the authenticating end includes:

[0014] In response to the authentication end successfully authenticating the first information to be authenticated, receiving user identity request information from the authentication end;

[0015] In response to a user input operation, sending the user identity authentication information input by the user to the authentication end, so that the authentication end generates second information to be authenticated based on the user identity authentication information and sends the second information to be authenticated to the server for authentication;

[0016] In response to the server successfully authenticating the second information to be authenticated, the server receives the first session key from the authentication end.

[0017] In some embodiments, before sending the connection request to the server, the method further includes:

[0018] In response to the completion of installing the authentication terminal on the terminal device, obtaining a second session key;

[0019] The second session key is stored so that the client communicates with the authentication end using the second session key.

[0020] In some embodiments, sending the first information to be authenticated to the authentication end so that the authentication end authenticates the first information to be authenticated includes:

[0021] generating third information to be authenticated based on the first information to be authenticated and the client identification information;

[0022] encrypting the third information to be authenticated using the second session key;

[0023] The encrypted third information to be authenticated is sent to the authentication end, so that the authentication end authenticates the third information to be authenticated.

[0024] On the other hand, the present application also provides a communication method applied to an authentication terminal installed on a terminal device, wherein the terminal device is also installed with a client, including:

[0025] receiving first information to be authenticated from the client; wherein the first information to be authenticated is generated by the server based on a connection request sent by the client; the server and the authentication end are provided by the same service provider;

[0026] authenticating the first information to be authenticated;

[0027] If the first information to be authenticated passes authentication, generating a first session key;

[0028] The first session key is sent to the client, so that the client communicates with the server using the first session key.

[0029] In some embodiments, generating a first session key when the first information to be authenticated passes authentication includes:

[0030] If the first information to be authenticated passes authentication, generating second information to be authenticated;

[0031] sending the second information to be authenticated to the server, so that the server authenticates the client based on the second information to be authenticated;

[0032] In response to the server successfully authenticating the second information to be authenticated, the first session key is generated.

[0033] In some embodiments, generating the second information to be authenticated includes:

[0034] Obtaining a client identifier and user identity authentication information corresponding to the client from the client;

[0035] generating a secondary master key based on the client identifier and the user identity authentication information;

[0036] The second information to be authenticated is generated based on the client identifier, the user identity authentication information, and the secondary master key.

[0037] In some embodiments, generating the first session key includes:

[0038] Based on the secondary master key, the first session key is generated.

[0039] In some embodiments, before receiving the first information to be authenticated from the client, the method further includes:

[0040] In response to the completion of installing the authentication terminal on the terminal device, obtaining a second session key;

[0041] The second session key is stored to communicate with the client using the second session key.

[0042] On the other hand, the present application also provides a communication method applied to a server installed on a server device, comprising:

[0043] In response to a connection request sent by a client, generating first information to be authenticated;

[0044] sending the first information to be authenticated to the client, so that the client sends the first information to be authenticated to an authentication terminal installed on the same terminal device as the client, and the authentication terminal authenticates the first information to be authenticated; wherein the authentication terminal and the server are provided by the same service provider;

[0045] When the authentication end successfully authenticates the first information to be authenticated, receiving second information to be authenticated from the authentication end to authenticate the second information to be authenticated;

[0046] When the second information to be authenticated is authenticated successfully, authentication success information is sent to the authentication end, and a third session key is generated, so as to communicate with the client using the third session key.

[0047] In some embodiments, the connection request includes at least one encryption method supported by the client;

[0048] The step of generating first information to be authenticated in response to a connection request sent by the client includes:

[0049] determining a target encryption method from the at least one encryption method;

[0050] Generate server-side random number and signature information;

[0051] The first information to be authenticated is generated based on the target encryption method, the server random number and the signature information.

[0052] In some embodiments, the second information to be authenticated includes at least: a client identifier corresponding to the client, user identity authentication information, and a secondary master key; wherein the secondary master key is generated by the authentication end after the authentication end successfully authenticates the first information to be authenticated;

[0053] The authenticating the second information to be authenticated includes:

[0054] authenticating the user identity authentication information and the client identifier;

[0055] The generating of the second session key includes:

[0056] Based on the secondary master key, the third session key is generated.

[0057] On the other hand, the present application also provides a communication method applied to a client installed on a terminal device, wherein the terminal device is also installed with an authentication terminal, including:

[0058] In response to a user's start-up operation, sending a connection request to a server; wherein the server and the authentication terminal are provided by the same service provider;

[0059] In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, a first interactive interface is displayed; wherein, the first information to be authenticated is generated by the server based on the connection request; the first interactive interface represents the interface for the user to conduct a conversation with the server through the client.

[0060] In some embodiments, in response to the authentication end successfully authenticating the first information to be authenticated sent by the server, displaying the first interactive interface includes:

[0061] In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, displaying a second interactive interface; wherein the second interactive interface is used to receive user identity authentication information input by the user;

[0062] In response to the server successfully authenticating the user identity authentication information input by the user through the second interactive interface, the first interactive interface is displayed.

[0063] In some embodiments, before sending a connection request to the server in response to the user's startup operation, the method further includes:

[0064] In response to the completion of installing the authentication terminal on the terminal device, obtaining a second session key;

[0065] The second session key is stored to communicate with the authentication end using the second session key.

[0066] On the other hand, the present application also provides a client device provided on a terminal device, wherein the terminal device is further equipped with an authentication terminal, including:

[0067] A first communication module of the client, configured to send a connection request to the server, so that the server generates first information to be authenticated based on the connection request; wherein the server and the authentication end are provided by the same service provider;

[0068] The first communication module of the client is further configured to receive the first information to be authenticated from the server;

[0069] The second communication module of the client is used to send the first information to be authenticated to the authentication end, so that the authentication end authenticates the first information to be authenticated;

[0070] The second communication module of the client is further configured to receive a first session key from the authentication end in response to the authentication end successfully authenticating the first information to be authenticated, so that the client communicates with the server using the first session key.

[0071] On the other hand, the present application also provides an authentication terminal device provided on a terminal device, wherein the terminal device is further equipped with a client, including:

[0072] The first communication device of the authentication end is configured to receive first information to be authenticated from the client; wherein the first information to be authenticated is generated by the server based on a connection request sent by the client; the server and the authentication end are provided by the same service provider;

[0073] An authentication module on the authentication end, configured to authenticate the first information to be authenticated;

[0074] an authentication end key generation module, configured to generate a first session key when the first information to be authenticated passes authentication;

[0075] The second communication module of the authentication end is used to send the first session key to the client, so that the client communicates with the server using the first session key.

[0076] On the other hand, the present application also provides a server-side device provided on a server-side device, comprising:

[0077] The server information generation module is used to generate first authentication information in response to the connection request sent by the client;

[0078] a first communication module on the server side, configured to send the first information to be authenticated to the client side, so that the client side sends the first information to be authenticated to an authentication terminal installed on the same terminal device as the client side; wherein the authentication terminal and the server side are provided by the same service provider;

[0079] The second communication module of the server is further configured to receive second information to be authenticated from the authentication end if the authentication end successfully authenticates the first information to be authenticated;

[0080] A server-side authentication module, configured to authenticate the second information to be authenticated;

[0081] The second communication module of the server is further configured to send authentication success information to the authentication end when the second information to be authenticated passes the authentication;

[0082] The server key generation module is used to generate a third session key so that the server can communicate with the client using the third session key.

[0083] On the other hand, the present application also provides a client device provided on a terminal device, wherein the terminal device is further equipped with an authentication terminal, including:

[0084] The third communication module of the client is used to send a connection request to the server in response to the user's startup operation; wherein the server and the authentication end are provided by the same service provider;

[0085] The client display module is used to display a first interactive interface in response to the authentication end successfully authenticating the first information to be authenticated sent by the server; wherein the first information to be authenticated is generated by the server based on the connection request; the first interactive interface represents the interface for the user to conduct a conversation with the server through the client.

[0086] In another aspect, the present application provides a communication system, comprising a client, an authentication terminal, and a server; the client and the authentication terminal are installed on the same terminal device; the authentication terminal and the server are provided by the same service provider; wherein:

[0087] The client is used to send a connection request to the server;

[0088] The server is configured to generate first information to be authenticated in response to a connection request sent by the client, and send the first information to be authenticated to the authentication terminal;

[0089] The authentication end is used to authenticate the first information to be authenticated, and generate a first session key if the authentication is successful; and send the first session key to the client, so that the client communicates with the server using the first session key.

[0090] On the other hand, the present application provides a terminal device, which includes a memory and a processor, wherein the memory stores a computer program that can be executed by the processor, and when the processor runs the computer program, it executes some or all of the steps in the above-mentioned communication method.

[0091] On the other hand, the present application provides a server device, which includes a memory and a processor, wherein the memory stores a computer program that can be executed by the processor, and when the processor runs the computer program, it executes some or all of the steps in the above-mentioned communication method.

[0092] On the other hand, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements part or all of the steps in the above method when executed by a processor.

[0093] On the other hand, the present application provides a computer program, comprising computer-readable codes. When the computer-readable codes are executed in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0094] On the other hand, the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, implements some or all of the steps in the above method.

[0095] In the present application, first, the client and the authenticator are installed on the same terminal device. Therefore, the identity authentication information transmitted between the client, the authenticator, and the server does not need to be transmitted to a third-party device, thereby improving the security of data transmission during the handshake process. At the same time, the client and the authenticator are installed on the same terminal device, so that data transmission between the client and the authenticator does not need to be carried out over the network, and the data transmission speed between the two is faster, thereby improving the efficiency of the handshake process. Second, the server and the authenticator are provided by the same service provider and do not involve the programs of a third-party organization. Therefore, attacks on the handshake process by a third-party organization can be avoided. Third, the handshake is completed without using the equipment and programs of a third-party organization, which can reduce the economic cost of the handshake process. Third, client authentication, server authentication, and key negotiation are completed simultaneously, which can reduce the need to establish an additional identity verification process to verify the identity of the client after the terminal device accesses the server based on the session key. In this way, the number of messages transmitted between the terminal device and the server device is effectively reduced, while ensuring the security of data transmission, reducing network latency and improving the efficiency of client access to the server. Finally, when the client and the authenticator communicate, the second session key is used for encryption, which can improve the security of data transmission between the client and the authenticator.

[0096] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] The drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and, together with the specification, are used to illustrate the technical solutions of the present application.

[0098] Figure 1 A schematic diagram of the implementation flow of a communication method applied to a client provided in this application;

[0099] Figure 2 A schematic diagram of the implementation flow of a communication method applied to an authentication terminal provided in this application;

[0100] Figure 3 A schematic diagram of the implementation flow of a communication method applied to a server provided in this application;

[0101] Figure 4 A schematic diagram of the implementation flow of a communication method applied to a client provided in this application;

[0102] Figure 5 A schematic diagram of the structure of a client device provided in this application;

[0103] Figure 6 A schematic diagram of the structure of an authentication terminal device provided in this application;

[0104] Figure 7 A schematic diagram of the structure of a server device provided in this application;

[0105] Figure 8 A schematic diagram of the structure of a client device provided in this application;

[0106] Figure 9 A schematic diagram of the structure of a communication system provided in this application;

[0107] Figure 10 A schematic diagram of an implementation flow of an embodiment of a method using the communication system provided by the present application;

[0108] Figure 11 A schematic diagram of the interaction flow of a communication method provided in this application;

[0109] Figure 12 A schematic diagram of the hardware entity of a terminal device provided in this application;

[0110] Figure 13 A hardware entity diagram of a server device provided in this application. DETAILED DESCRIPTION

[0111] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions of this application are further elaborated in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0112] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0113] The terms "first / second / third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first / second / third" can be interchanged with a specific order or sequence where permitted so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0114] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing this application only and are not intended to limit this application.

[0115] In order to better understand the communication method provided in the embodiments of the present application, the relevant schemes adopted in the related technologies are first described below.

[0116] To improve communication security between computer devices, related technologies use authentication and session encryption for network communications. For example, Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are encryption and authentication protocols designed to protect the security of internet communications.

[0117] TLS consists of two phases: the handshake and the encrypted session. The handshake phase is the process of enabling the encrypted session. During the TLS handshake phase, the communicating parties exchange messages to confirm and authenticate each other, determine the encryption algorithm used during the encrypted communication session, and generate a consistent session key. For example, the TLS handshake phase between a client and a server installed on a server may include the following steps: A1 to A9:

[0118] Step A1, "Client Hello" message: The client sends a hello message to the server to start the handshake process. The hello message contains the TLS version supported by the client, a list of supported cipher suites, and a string of random bytes called the client random.

[0119] Step A2, "Server Hello" message: In response to the Client Hello message, the server sends a Server Hello message. The Server Hello message contains the server's TLS certificate, the cipher suite selected by the server from the client's list of supported cipher suites, and a string of random bytes called the server random.

[0120] Step A3, Authentication: The client verifies the server's TLS certificate with the Certificate Authority (CA) that issued it to confirm that the server is who it claims to be and that the client is interacting with the actual owner of the domain.

[0121] Step A4, Premaster Secret: The client sends a string of random bytes called the premaster secret to the server. The premaster secret is encrypted using the public key and can only be decrypted using the server's private key, which the client obtains from the server's TSL certificate.

[0122] Step A5, private key decryption: The server uses the private key to decrypt the pre-master key;

[0123] Step A6: Generate session key: The client and server both use the client random number, the server random number, and the pre-master secret key to generate a session key. This way, the client and server both obtain the same session key.

[0124] Step A7, Client Ready: The client sends a "Completed" message and encrypts the message using the session key;

[0125] Step A8, Server Ready: The server sends a "Completed" message and encrypts the message using the session key;

[0126] Step A9: Implement secure symmetric encryption: The client and server complete the handshake and continue the encrypted session using the session key.

[0127] In the above solution, the client can use the CA to verify the server's TSL certificate to verify the legitimacy of the server it is accessing. However, this solution only involves the client's verification of the server, and does not involve the server's authentication of the client. Therefore, it cannot prevent illegal clients from invading the server.

[0128] Related art also provides a solution for client identity authentication using a USB key, which includes the following steps B1 to B8:

[0129] Step B1: The client sends a TSL connection request to the server;

[0130] Step B2: The client receives the server certificate sent by the server and verifies whether the server certificate is issued by a trusted certification authority and whether it is within the validity period;

[0131] Step B3: If the server certificate is issued by a trusted certification authority and is within its validity period, the server certificate verification succeeds;

[0132] Step B4: After the client verifies the server certificate, the client inserts the USB key into the device where the client is installed; enters and verifies the PIN code of the USB key; after the PIN code is verified, a first random number is generated inside the USB key;

[0133] Step B5: Sign the first random number and the timestamp using the client's private key stored in the USB key to obtain the client's signature and generate a secondary master key; send the client's signature, the secondary master secret, and the client certificate to the server;

[0134] Step B6: The server verifies whether the client certificate is issued by a trusted certification authority and is within its validity period. After the client certificate is successfully verified, the server verifies the client signature and checks whether the first random number and timestamp are valid. If the client signature is successfully verified and the first random number and timestamp are valid, the server generates a master secret based on the secondary master key.

[0135] Step B7: The client generates a session key with the server based on the secondary master key.

[0136] In step B8, the client and the server exchange data based on the session key.

[0137] The aforementioned USB-Shield authentication solution can achieve two-way authentication between the client and the server, but requires additional equipment (i.e., the USB-Shield), resulting in low efficiency and high cost for secure client access to the server. Furthermore, the aforementioned USB-Shield authentication solution still requires identity verification using a certificate provided by a third-party organization.

[0138] However, in applications requiring high data security, such as smart healthcare, users (e.g., hospitals) do not want medical data to leave the hospital premises and therefore do not want to verify certificates through a third-party certification body. Therefore, traditional Hypertext Transfer Protocol Secure (HTTPs) and the SSL handshake protocol (TLS) cannot meet these requirements.

[0139] In addition, in smart medical scenarios, the analysis of patient diagnostic data has high privacy protection requirements and processing efficiency requirements. Existing security authentication schemes require third-party organizations to perform authentication, resulting in low authentication efficiency and key negotiation efficiency between the client and the server.

[0140] To address the above issues, the present application provides a communication method that can be executed by a processor of a computer device. The computer device may include a server, laptop, tablet, desktop computer, smart TV, set-top box, mobile device (e.g., mobile phone, portable video player, personal digital assistant, dedicated messaging device, portable gaming device), or other device with data processing capabilities.

[0141] Figure 1 This is a schematic diagram of the implementation process of a communication method provided by this application, wherein the communication method is applied to a client installed on a terminal device, wherein the terminal device is also installed with an authentication terminal. Figure 1 As shown, the method includes the following steps S101 to S104:

[0142] Step S101: Send a connection request to a server, so that the server generates first information to be authenticated based on the connection request; wherein the server and the authentication end are provided by the same service provider.

[0143] Here, the client is a program installed on the terminal device, as opposed to the server, that provides the user with a local server. In the smart healthcare scenario, the client can be a program installed on the workstation computer that is paired with the testing equipment.

[0144] The client can be presented in various forms. In some embodiments, the client can include a web browser, or an application installed on a terminal device using an installation program, etc.

[0145] The server is a program installed on the server, as opposed to the client. In smart healthcare scenarios, the server can provide services such as data storage and data analysis for the client. For example, the client transmits patient diagnosis and treatment data obtained by the workstation computer to the server process storage; because the server has AI processing capabilities or can be connected to a variety of electronic devices with AI processing capabilities, the client can obtain corresponding AI processing services through the server; at the same time, the terminal device installed with the client can also have AI processing capabilities, so that the patient diagnosis and treatment data after AI processing by the terminal device can be transmitted to the server device for storage or for call by other terminal devices.

[0146] The authenticator is a program used to assist in authenticating the client and server.

[0147] Here, the authentication end and the corresponding client are installed on the same terminal device, that is, when the client authenticates the server with the help of the authentication end, and when the authentication end assists the server in authenticating the client, the authentication information is only transmitted between the terminal device on which the client and the authentication end are installed and the service device on which the server is installed, and there is no need to transmit the authentication information to a third-party organization device through the network, thereby improving the transmission security of the authentication information and improving the transmission efficiency.

[0148] The authenticator and server are provided by the same service provider, and both maintain the secret key used to communicate with each other, and the authenticator maintains the secret key used to authenticate the server. This ensures mutual trust between the authenticator and server, and the authentication process does not involve third-party authentication procedures, thus preventing third-party attacks and further enhancing security.

[0149] When a client sends a connection request to a server, it means that when the client needs to communicate data with the server, the client sends information to the server to start the handshake process.

[0150] In some embodiments, before the client sends a connection request to the server, the client generates a client random number. The client determines connection request information based on the client random number, at least one cipher suite supported by the client, and a timestamp generated by the client.

[0151] Here, the client random number is a set of random numbers generated by the client using a random number algorithm. In some embodiments, the client generates the client random number using a random number generation tool installed in the terminal device. Here, the random number algorithm may include a linear congruential algorithm, a Rosenfeld algorithm, a Gaussian distribution algorithm, a Mersenne twister algorithm, or other random number algorithms commonly used in the art, which are not specifically limited here.

[0152] The at least one encryption suite supported by the client refers to at least one encryption algorithm supported by the client. Here, the encryption suite may include symmetric encryption algorithms such as the Advanced Encryption Standard (AES) and the Data Encryption Standard (DES), asymmetric encryption algorithms such as the RSA algorithm and the Elliptic Curve Cryptography (ECC), or other types of encryption algorithms, which are not specifically limited here. Thus, the client sends the at least one encryption suite supported by the client to the server, so that the server selects an encryption suite from the at least one encryption suite as the encryption method for the session between the client and the server.

[0153] The timestamp is a timestamp certificate generated by the client based on the supported timestamp protocol to authenticate the time when the signature object corresponding to the timestamp was generated, thereby verifying whether the signature object has been tampered with after generation.

[0154] In this way, the client determines the connection request based on the client random number, at least one cipher suite supported by the client, and a timestamp generated by the client, so that the server confirms that the client desires to establish a data communication connection, and returns the first information to be authenticated based on the connection request. Here, the first information to be authenticated is information sent by the server to the client and verified by the authentication terminal on the terminal device.

[0155] Step S102: Receive the first information to be authenticated from the server.

[0156] In some embodiments, the first information to be authenticated may include a server random number generated by the server, an encryption suite selected by the server from at least one encryption suite in the connection request for encrypting the session, and signature information of the server.

[0157] Here, the server-side random number is a set of random numbers generated by the server using a random number algorithm. In some embodiments, the client generates the client-side random number using a random number generation tool installed in the terminal device. Here, the random number algorithm may include a linear congruential algorithm, a Rosenfeld algorithm, a Gaussian distribution algorithm, a Mersenne twister algorithm, or other random number algorithms commonly used in the art, which are not specifically limited here.

[0158] The server's signature information is a string of numbers generated by the server using the server's private key, which can prove the authenticity of the information sent by the server.

[0159] Step S103: Send the first information to be authenticated to the authentication end, so that the authentication end authenticates the first information to be authenticated.

[0160] Here, the client sends the first information to be authenticated sent by the server to the authentication end, so that the authentication end assists in completing the authentication of the server.

[0161] In some embodiments, the client forwards the first information to be authenticated directly to the authentication terminal. In some embodiments, the client encrypts the first information to be authenticated before sending it to the authentication terminal. In some embodiments, the client sends client information such as a client random number and / or client identification information along with the first information to be authenticated to the authentication terminal.

[0162] In some embodiments, the authentication end stores information for authenticating the information to be authenticated on the server end, so as to implement authentication of the first information to be authenticated.

[0163] In some embodiments, the first information to be authenticated includes the server signature information; the authentication end stores the authentication public key corresponding to the server signature information, so that the authentication end uses the authentication public key to authenticate the server signature information, thereby realizing identity authentication of the server.

[0164] In some embodiments, the authentication public key is an undisclosed key and is encrypted and stored in the authentication terminal.

[0165] Since the server and the authentication end are provided by the same service provider, the authentication process of the authentication end on the server does not involve a third-party organization, thus achieving the security of data communication.

[0166] Step S104 : In response to the authentication end successfully authenticating the first information to be authenticated, receiving a first session key from the authentication end, and communicating with the server end using the first session key.

[0167] Here, the authentication end successfully authenticates the first information to be authenticated, that is, the authentication end confirms that the server end is legitimate, thereby achieving identity authentication of the server end.

[0168] When the server passes the authentication, the authentication end generates a first session key and sends the first session key to the client, so that the client uses the first session key to perform encrypted communication with the server.

[0169] In some embodiments, when the server passes the authentication, the authentication end generates a secondary master key and sends the secondary master key to the server, so that the server generates a corresponding third session key based on the secondary master key; wherein, the third session key is a key corresponding to the first session key, so that the server uses the third session key to conduct an encrypted session with the client.

[0170] In some embodiments, when the client and the server conduct an encrypted session, the client and the server encrypt the session data using the encryption suite, the first session key, or the second session key selected by the server.

[0171] From the above, it can be seen that this application installs both the client and the authentication end on the terminal device, and the server and the authentication end are provided by the same service provider. When the authentication end is used to assist in authenticating the server and generating the session key between the client and the server, there is no need to transmit the authentication information to the equipment provided by the third-party organization, nor is there any need to use the program provided by the third-party organization for identity authentication, thereby improving the security of identity authentication and generation of session keys, and protecting user information from attacks; at the same time, installing the authentication end and the client on the same terminal device can also increase the data transmission speed, thereby improving the efficiency of the identity authentication and session key generation process; in addition, not using the equipment and programs of the third-party organization to complete the handshake can reduce the economic cost of the handshake process.

[0172] In some embodiments, in response to the authenticating end successfully authenticating the first information to be authenticated, the first session key is received from the authenticating end, that is, the above step S104 can be implemented by the following steps S1041 to S1043:

[0173] Step S1041: In response to the authentication end successfully authenticating the first information to be authenticated, receiving user identity request information from the authentication end.

[0174] The user identity request information is a request information sent by the authentication end to the client after the authentication end has successfully authenticated the server, and is used to obtain the user identity information of the client currently logged in. Here, the user identity information may include, for example, user name and password information, etc.

[0175] In some embodiments, in response to user identity request information received from the authentication end, a second interaction interface is displayed to receive user identity information input by the user through the second interaction interface.

[0176] Step S1042: In response to the user input operation, the user identity authentication information input by the user is sent to the authentication end, so that the authentication end generates second information to be authenticated based on the user identity authentication information and sends the second information to be authenticated to the server for authentication.

[0177] Here, the user input operation may be an input operation performed by the user using an input device such as a keyboard and / or a mouse.

[0178] In some embodiments, sending the user identity authentication information input by the user to the authentication end may be implemented by encrypting the user identity authentication information input by the user and sending the encrypted user identity authentication information to the authentication end.

[0179] In some embodiments, the authenticating end generates the second information to be authenticated based on the user identity authentication information, which may include: the authenticating end generates the second information to be authenticated based on the user identity authentication information and client identification information corresponding to the client.

[0180] In some embodiments, the authentication end sends the second information to be authenticated to the server for authentication. This can be achieved by the authentication end encrypting the second information to be authenticated and sending the encrypted second information to be authenticated to the server for authentication.

[0181] Step S1043: In response to the server successfully authenticating the second information to be authenticated, the server receives the first session key from the authentication end.

[0182] Here, the server authenticates the second information to be authenticated, that is, the server confirms that the client identity is legitimate. In some embodiments, the server determines that the client identity is legitimate by confirming the legitimacy of information such as the user name, password, and client identifier included in the second information to be authenticated.

[0183] In some embodiments, the authenticator generates the first session key based on information shared with the server. For example, the authenticator may generate the first session key based on at least one of the following information: a client random number, a server random number, a username, and a password, etc.

[0184] In some embodiments, in response to successful authentication of the first information to be authenticated, the authenticator generates a secondary master key, sends the secondary master key to the server, and generates a first session key based on the secondary master key.

[0185] In the above embodiment, after the authentication end successfully authenticates the server, it further generates a second information to be authenticated and sends it to the server, so that the server authenticates the client based on the second information to be authenticated. When the server successfully authenticates the second information to be authenticated, a first session key is generated. In this way, two-way authentication is achieved during the handshake process, further improving communication security. At the same time, client authentication, server authentication, and key negotiation (i.e., determining the first session key) are completed at the same time, which can reduce the number of messages transmitted between the terminal device and the server device, while ensuring data transmission security, reducing network latency and improving the efficiency of client access to the server.

[0186] In some embodiments, before sending the connection request to the server, that is, before the above step S101, the following steps S105 to S106 are also included:

[0187] Step S105, in response to the authentication terminal being installed on the terminal device, obtaining a second session key;

[0188] Step S106: Store the second session key so that the client can communicate with the authentication end using the second session key.

[0189] Here, the authentication end installation program is provided by the service provider, which is also the service provider of the server.

[0190] In some embodiments, before a developer develops an installation program of the authentication terminal, he or she applies for a second session key from a service provider, and encodes the applied second session key into the installation program of the authentication terminal.

[0191] In some embodiments, the same authentication terminal can support secure access between multiple clients and servers. Here, the same authentication terminal installation program can be installed on multiple terminal devices at the same time to support clients installed on the same terminal device to access the server, thereby reducing the development cost of the authentication terminal.

[0192] Here, after installing the authentication end on the terminal device, the client can obtain the second session key encoded in the authentication end installation program, and use the second session key as the session key used when the client and the authentication end transmit data, thereby improving the security of data transmission between the client and the authentication end.

[0193] In some embodiments, the sending of the first information to be authenticated to the authentication end so that the authentication end authenticates the first information to be authenticated, that is, the above step S103, can be implemented by the following steps S1031 to S1033:

[0194] Step S1031: Generate third information to be authenticated based on the first information to be authenticated and the client identification information.

[0195] Here, after the client receives the first information to be authenticated and before sending the first information to be authenticated to the authentication end, the client processes the first information to be authenticated to obtain the third information to be authenticated.

[0196] In some embodiments, the third information to be authenticated includes information related to the client. In some embodiments, after receiving the first information to be authenticated, the client confirms the server-selected encryption suite information and server-side signature information in the first information to be authenticated. Simultaneously, the client's client identification information and client random number are appended to the first information to be authenticated to obtain the third information to be authenticated. Thus, in some embodiments, the third information to be authenticated includes the client random number, the server random number, the server-selected encryption suite, and the server-side signature information.

[0197] Step S1032: Encrypt the third information to be authenticated using the second session key.

[0198] Here, the client uses the second session key to encrypt the first information to be authenticated and the client identification information sent by the server to obtain encrypted third information to be authenticated.

[0199] Step S1033: Send the encrypted third information to be authenticated to the authentication end, so that the authentication end authenticates the third information to be authenticated.

[0200] In the above embodiment, after receiving the first information to be authenticated from the server, the client obtains the third information to be authenticated based on information related to the client and the first information to be authenticated; after encrypting the third information to be authenticated, the encrypted third information to be authenticated is sent to the authenticator. This prevents malicious programs from attacking the terminal device and leaking server or client information, thereby improving the security of data transmission.

[0201] As can be seen from the above, in the communication method applied to the terminal device provided by the present application, first, the client and the authentication end are installed on the same terminal device. Therefore, there is no need to transmit the identity authentication information transmitted between the client, the authentication end and the server to a third-party device, thereby improving the security of data transmission during the handshake process; at the same time, the client and the authentication end are installed on the same terminal device, so that there is no need for data transmission between the client and the authentication end through the network, and the data transmission speed between the two is faster, thereby improving the efficiency of the handshake process; secondly, the server and the authentication end are provided by the same service provider and do not involve the procedures of a third-party organization. Therefore, it can avoid the third-party organization from interfering with the handshake process. Secondly, the handshake is completed without using the equipment and programs of a third-party organization, which can reduce the economic cost of the handshake process; thirdly, the client authentication, server authentication and key negotiation are completed at the same time, which can reduce the need for the terminal device to establish an additional identity authentication process to verify the identity of the client after accessing the server based on the session key. In this way, the number of messages transmitted between the terminal device and the server device is effectively reduced, while ensuring the security of data transmission, the network delay is reduced, and the efficiency of the client accessing the server is improved; finally, when the client and the authenticator communicate, the second session key is used for encryption, which further improves the security of data transmission between the client and the authenticator.

[0202] On the other hand, the present application also provides a communication method applied to an authentication terminal installed on a terminal device, wherein the terminal device is also installed with a client. Figure 2 As shown, the communication method includes the following steps S201 to S204:

[0203] Step S201: receiving first information to be authenticated from the client; wherein the first information to be authenticated is generated by a server based on a connection request sent by the client; the server and the authenticator are provided by the same service provider.

[0204] Here, regarding the client, authenticator, and server, please refer to the detailed description above and will not be repeated here.

[0205] Regarding the authenticator receiving the first information to be authenticated from the client and the server generating the first information to be authenticated, please refer to the detailed description above and will not be repeated here.

[0206] Step S202: authenticating the first information to be authenticated.

[0207] Here, the process of the authentication end authenticating the first information to be authenticated can be described in detail above and will not be repeated here.

[0208] Step S203: If the first information to be authenticated passes the authentication, a first session key is generated.

[0209] Here, there is a process in which the authentication end generates the first session key. Please refer to the detailed description above and will not be repeated here.

[0210] Step S204: Send the first session key to the client, so that the client communicates with the server using the first session key.

[0211] From the above, it can be seen that this application installs both the client and the authentication end on the terminal device, and the server and the authentication end are provided by the same service provider. When the authentication end is used to assist in authenticating the server and generating the session key between the client and the server, there is no need to transmit the authentication information to the equipment provided by the third-party organization, nor is there any need to use the program provided by the third-party organization for identity authentication, thereby improving the security of identity authentication and generation of session keys, and protecting user information from attacks; at the same time, installing the authentication end and the client on the same terminal device can also increase the data transmission speed, thereby improving the efficiency of the identity authentication and session key generation process; in addition, not using the equipment and programs of the third-party organization to complete the handshake can reduce the economic cost of the handshake process.

[0212] In some embodiments, when the first information to be authenticated passes authentication, generating the first session key, that is, the above step S203, can be implemented by the following steps S2031 to S2033:

[0213] Step S2031: if the first information to be authenticated passes authentication, generating second information to be authenticated;

[0214] Here, the authentication end successfully authenticates the first information to be authenticated, that is, the authentication end confirms that the identity of the server is legitimate; thereafter, the authentication end generates the second information to be authenticated.

[0215] Here, the second information to be authenticated is information to be authenticated related to the client generated by the authentication end. After the information to be authenticated is sent to the server, the server authenticates the client, thereby realizing two-way authentication.

[0216] In some embodiments, the second information to be authenticated includes a secondary master key generated by the authentication terminal. In some embodiments, the second information to be authenticated also includes a user name and password information obtained by the authentication terminal from the client, and a client identification code.

[0217] Step S2032: Send the second information to be authenticated to the server, so that the server authenticates the client based on the second information to be authenticated.

[0218] In some embodiments, the authenticator encrypts the second information to be authenticated using the public key to ensure the security of information exchanged between the authenticator and the server. Correspondingly, the server decrypts the encrypted second information to be authenticated using the stored private key to authenticate the second information to be authenticated.

[0219] Step S2033: In response to the server successfully authenticating the second information to be authenticated, the first session key is generated.

[0220] Here, the server authenticates the second information to be authenticated, that is, the server confirms that the client identity is legitimate. In some embodiments, the server determines that the client identity is legitimate by confirming the legitimacy of the user name, password and client identifier included in the second information to be authenticated.

[0221] In some embodiments, the authenticator generates the first session key based on information shared with the server. For example, the authenticator may generate the first session key based on at least one of the following information: a client random number, a server random number, a username, and a password, etc.

[0222] In some embodiments, in response to successful authentication of the first information to be authenticated, the authenticator generates a secondary master key, sends the secondary master key to the server, and generates a first session key based on the secondary master key.

[0223] In the above embodiment, after the authentication end successfully authenticates the server, it further generates a second information to be authenticated and sends it to the server, so that the server authenticates the client based on the second information to be authenticated. When the server successfully authenticates the second information to be authenticated, a first session key is generated. In this way, two-way authentication is achieved during the handshake process, further improving communication security. At the same time, client authentication, server authentication, and key negotiation (i.e., determining the first session key) are completed at the same time, which can reduce the number of messages transmitted between the terminal device and the server device, while ensuring data transmission security, reducing network latency and improving the efficiency of client access to the server.

[0224] In some embodiments, the generating of the second information to be authenticated, i.e., the above step S2031, can be implemented by the following steps S2034 to S2036:

[0225] Step S2034: Obtain the client identifier and user identity authentication information corresponding to the client from the client.

[0226] Here, regarding the client identification and user identity authentication information, please refer to the detailed description above and will not be repeated here.

[0227] In some embodiments, after the client receives the first information to be authenticated from the server, the client sends the client identifier and the first information to be authenticated as the third information to be authenticated to the authentication end, so that the authentication end authenticates the server based on the third information to be authenticated. At the same time, the authentication end obtains the client identifier through the third information to be authenticated.

[0228] In some embodiments, after the client successfully authenticates the first information to be authenticated, a user identity information request is sent to the client to obtain the user identity authentication information from the client.

[0229] Step S2035: Generate a secondary master key based on the client identifier and the user identity authentication information.

[0230] Step S2036: Generate the second information to be authenticated based on the client identifier, the user identity authentication information and the secondary master key.

[0231] In some embodiments, the client identifier, user identity authentication information and secondary master key can be sent to the server as the second information to be authenticated, so that the server can verify the client identifier and user identity authentication information therein, and if the verification is successful, use the secondary master key to generate a session key.

[0232] In some embodiments, the generating of the first session key, i.e., the above step S2033, can be implemented as the following steps S2037 including:

[0233] Step S2037: Generate the first session key based on the secondary master key.

[0234] Here, the first session key is a key used to protect the secure storage and transmission of the secondary master key, that is, the first session key is used to encrypt the secondary master key.

[0235] In some embodiments, a first session key is generated based on a secondary master key, a client random number, and a server random number.

[0236] In this way, during an encrypted session between the client and the server, the data is first encrypted using the secondary master key, and then the secondary master key is encrypted using the first session key. This multi-layer encryption improves the security of data transmission between the client and the server, thereby better protecting user information.

[0237] In some embodiments, before receiving the first information to be authenticated from the client, that is, before the above step S201, the following steps S205 to S206 are also included:

[0238] Step S205: In response to the authentication terminal being installed on the terminal device, obtaining a second session key;

[0239] Step S206 stores the second session key to communicate with the client using the second session key.

[0240] Here, regarding the method of obtaining and storing the second session key, please refer to the detailed description above and will not be repeated here.

[0241] The above description of the embodiment of the communication method applied to the authentication end corresponds to the description of the embodiment of the communication method applied to the client, and has similar beneficial effects as the embodiment of the communication method applied to the client. In some embodiments, for technical details not disclosed in the embodiment of the communication method applied to the authentication end provided by this disclosure, please refer to the description of the embodiment of the communication method applied to the client of this application for understanding.

[0242] On the other hand, the present application also provides a communication method for a server installed on a server device. Figure 3 As shown, the communication method includes the following steps S301 to S304:

[0243] Step S301: generating first information to be authenticated in response to a connection request sent by a client.

[0244] Here, after receiving the connection request sent by the client, the server confirms the client-related information. In some embodiments, the connection request includes a client random number generated by the client, at least one encryption suite supported by the client, and a timestamp information generated by the client.

[0245] In some embodiments, the first information to be authenticated is information related to the server sent by the server to the client, so that the client uses the first information to be authenticated to authenticate the server.

[0246] In some embodiments, the first information to be authenticated includes a server random number generated by the server, an encryption suite selected by the server from at least one encryption suite in the connection request, and signature information generated by the server.

[0247] Step S302: Send the first information to be authenticated to the client, so that the client sends the first information to be authenticated to an authentication end installed on the same terminal device as the client, and the authentication end authenticates the first information to be authenticated; wherein the authentication end and the server are provided by the same service provider.

[0248] Here, the authentication end and the corresponding client are installed on the same terminal device, that is, when the client authenticates the server with the help of the authentication end, and when the authentication end assists the server in authenticating the client, the authentication information is only transmitted between the terminal device on which the client and the authentication end are installed and the server device on which the server is installed, and there is no need to transmit the authentication information through the network to a third-party organization device other than the terminal device and the server device, thereby improving the transmission security of the authentication information and at the same time improving the transmission efficiency.

[0249] The authenticator and server are provided by the same service provider, and both maintain secret keys for communicating with each other, with the authenticator also maintaining a key for authenticating the server. This ensures mutual trust between the authenticator and server, and prevents third-party attacks during the authentication process, further enhancing its security.

[0250] In some embodiments, after receiving the first information to be authenticated, the client generates third information to be authenticated based on the first information to be authenticated, a client random number generated by the client, and a client identifier, and sends the third information to be authenticated to the authentication end.

[0251] In some embodiments, the client encrypts the third information to be authenticated using the second session key and sends the encrypted third information to the authenticator for authentication. Here, the second session key is a session key generated after the authenticator is installed on the terminal device and stored in the client and the authenticator for use in encrypting data transmitted between the client and the authenticator.

[0252] In some embodiments, the authentication end authenticates the first information to be authenticated, including: the authentication end authenticates the server signature information in the first information to be authenticated using the authentication public key.

[0253] In some embodiments, the authentication public key is an undisclosed key and is encrypted and stored in the authentication terminal.

[0254] Step S303: When the authentication end successfully authenticates the first information to be authenticated, the authentication end receives second information to be authenticated from the authentication end to authenticate the second information to be authenticated.

[0255] The authenticator successfully authenticates the first information to be authenticated, confirming the server's identity. The authenticator then generates second information to be authenticated and sends it to the server. The second information is used by the server to authenticate the client.

[0256] In some embodiments, the second information to be authenticated includes user name authentication information input by a user of the client terminal, a client identifier obtained by the authentication terminal, and a secondary master key generated by the authentication terminal.

[0257] Here, the user identity authentication information may include user name and password information.

[0258] The client ID is a unique identifier assigned to each client when the client is installed, which facilitates the server to identify the client.

[0259] A sub-master key is a key used to protect the secure storage and transmission of data.

[0260] In some embodiments, the authenticator encrypts the second information to be authenticated using a public key agreed upon with the server, and sends the encrypted second information to be authenticated to the server. Thus, upon receiving the encrypted second information to be authenticated, the server decrypts the encrypted second information to be authenticated using the stored private key to obtain the second information to be authenticated.

[0261] The server authenticates the second information to be authenticated, that is, verifies the client-related information in the second information to be authenticated to determine the legitimacy of the client's identity.

[0262] In some embodiments, the server may use the stored client information to authenticate the second information to be authenticated to determine whether the current client is a legitimate client that has been registered with the server.

[0263] In some embodiments, the server may use the stored user information to authenticate the second information to be authenticated to determine whether the current user logging into the client is a legitimate user registered with the server.

[0264] Step S304: When the second information to be authenticated is authenticated successfully, authentication success information is sent to the authentication end, and a third session key is generated to communicate with the client using the third session key.

[0265] Here, the second information to be authenticated is successfully authenticated, that is, the server confirms the legitimacy of the client identity by verifying the second information to be authenticated.

[0266] After successful authentication, the server sends a confirmation message to the authenticator, authorizing the client to access the server. This allows the authenticator to generate a first session key. Furthermore, the server generates a third session key, which it uses to conduct an encrypted session with the client. This simultaneous completion of client and server authentication and key negotiation reduces the number of messages exchanged between the terminal and server devices, ensuring data security while also reducing network latency and improving client-server access efficiency.

[0267] In some embodiments, the connection request includes at least one encryption method supported by the client. In response to the connection request sent by the client, the first information to be authenticated is generated, that is, the above step S301 can be implemented by the following steps S3011 to S3013:

[0268] Step S3011: Determine a target encryption method from the at least one encryption method.

[0269] Here, the server selects an encryption method from at least one encryption method sent by the client as a target encryption method, so that the client and the server encrypt the communication data based on the target encryption method.

[0270] Step S3012: Generate server-side random number information and signature information.

[0271] Here, the server-side random number is a set of random numbers generated by the server using a random number algorithm. In some embodiments, the server generates the server-side random number using a random number generation tool installed in the server device. Here, the random number algorithm may include a linear congruential algorithm, a Rosenfeld algorithm, a Gaussian distribution algorithm, a Mersenne twister algorithm, or other random number algorithms commonly used in the art, which are not specifically limited here.

[0272] The server's signature is a string of numbers generated by the server using its private key, proving the authenticity of the information it sends. The authentication client stores the public key corresponding to the signature generated by the server, allowing the authentication client to use this public key to authenticate the server's signature, thereby authenticating the server's identity.

[0273] Step S3013: Generate the first information to be authenticated based on the target encryption method, the server random number and the signature information.

[0274] Here, the server can combine and encode the target encryption method, server random number and signature information, and send it to the client.

[0275] In some embodiments, the second information to be authenticated includes at least: a client identifier corresponding to the client, user identity authentication information, and a secondary master key; wherein the secondary master key is generated by the authentication end after the authentication end successfully authenticates the first information to be authenticated;

[0276] Thus, the authentication of the second information to be authenticated in the above step S303 can be achieved by the following steps S3031:

[0277] Step S3031: authenticating the user identity authentication information and the client identifier.

[0278] Here, the server may determine whether the user identity authentication information and the client identification in the second information to be authenticated are of a registered legitimate user and client based on the user information and client identification information set stored in the server.

[0279] The generation of the second session key in step S304 above can be achieved by the following steps S3041:

[0280] Step S3041: Generate the third session key based on the secondary master key.

[0281] Here, the secondary master key is a key used to protect the storage and transmission security of data. The second session key is a key used to protect the storage and transmission security of the secondary master key.

[0282] In this way, during an encrypted session between the client and the server, the data is first encrypted using the secondary master key, and then the secondary master key is encrypted using the second session key. This multi-layer encryption improves the security of data transmission between the client and the server, thereby better protecting user information.

[0283] In some embodiments, a first session key is generated based on a secondary master key, a client random number, and a server random number.

[0284] The above description of the communication method embodiment applied to the server corresponds to the above description of the communication method embodiment applied to the client and the communication method embodiment applied to the authentication end, and has corresponding beneficial effects. In some embodiments, for technical details not disclosed in the communication method embodiment applied to the server of this application, please refer to the description of the communication method embodiment applied to the client and the communication method embodiment applied to the authentication end of this application for understanding.

[0285] On the other hand, the present application also provides a communication method applied to a client installed on a terminal device, wherein the terminal device is also installed with an authentication terminal. Figure 4 As shown, the communication method includes the following steps S401 to S402:

[0286] Step S401: In response to a user's start-up operation, a connection request is sent to a server; wherein the server and the authentication end are provided by the same service provider.

[0287] Here, regarding the client, authenticator, and server, please refer to the detailed description above and will not be repeated here.

[0288] In some embodiments, the user's startup operation may include a click operation, a touch operation, or a sliding operation on an icon corresponding to the client; it may also include a voice control operation of the client by the user.

[0289] Here, the client sends a connection request to the server to establish a communication connection. In some embodiments, a connection status interface between the client and the server can be displayed on a display screen of the terminal device.

[0290] Step S402: In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, a first interactive interface is displayed; wherein the first information to be authenticated is generated by the server based on the connection request; the first interactive interface represents the interface for the user to conduct a conversation with the server through the client.

[0291] Here, the authentication step of the authenticating end for the first information to be authenticated sent by the server can be referred to the detailed description above and will not be repeated here.

[0292] The first interactive interface is an interface for the user corresponding to the client to conduct a conversation with the server, that is, the user can send service request information to the server through the first interactive interface and receive corresponding service information from the server.

[0293] In some embodiments, in response to the authentication end successfully authenticating the first information to be authenticated sent by the server, displaying the first interactive interface, that is, the above step S402, can be implemented by the following steps S4021 to S4022:

[0294] Step S4021: In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, a second interactive interface is displayed; wherein the second interactive interface is used to receive user identity authentication information input by the user.

[0295] Here, after the authentication terminal successfully authenticates the first information to be authenticated, the authentication terminal sends a user identity information request to the client. In response to the user identity information request sent by the authentication terminal, the client displays the second interactive interface.

[0296] The second interactive interface is used to prompt the user to input user identity authentication information and provide input options corresponding to the identity authentication information. In some embodiments, the user identity authentication information includes user name and password information.

[0297] Step S4022: In response to the server successfully authenticating the user identity authentication information input by the user through the second interactive interface, the first interactive interface is displayed.

[0298] Here, in response to the user inputting user identity authentication information through the second interactive interface, the client sends the user identity authentication information to the authentication end, so that the authentication end generates second information to be authenticated based on the identity authentication information and sends it to the server for authentication.

[0299] The server successfully authenticates the user identity authentication information, that is, the server successfully authenticates the client, and displays the first interactive interface to allow the user to conduct a conversation with the server through the client.

[0300] In some embodiments, before sending the connection request to the server in response to the user's startup operation, that is, before the above step S401, the communication method further includes the following steps S403 to S404:

[0301] Step S403: In response to the authentication terminal being installed on the terminal device, obtaining a second session key;

[0302] Step S404: store the second session key so that the client can communicate with the authentication end using the second session key.

[0303] Here, regarding the steps of obtaining and storing the second session key, please refer to the detailed description above and will not be repeated here.

[0304] The above description of the embodiment of the communication method applied to the client corresponds to the above description of the embodiment of the communication method applied to the client, the embodiment of the communication method applied to the authentication end, and the embodiment of the communication method applied to the server, and has corresponding beneficial effects. In some embodiments, for technical details not disclosed in the embodiment of the communication method applied to the client of this application, please refer to the description of the embodiment of the communication method applied to the client, the embodiment of the communication method applied to the authentication end, and the embodiment of the communication method applied to the server of this application for understanding.

[0305] On the other hand, the present application also provides a client device arranged on a terminal device. The various units included in the device and the various modules included in each unit can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0306] Figure 5 This is a schematic diagram of the structure of a client device provided by this application. Figure 5 As shown, the client device 500 includes: a first client communication module 510 and a second client communication module 520, wherein:

[0307] The first communication module 510 of the client is configured to send a connection request to the server, so that the server generates first information to be authenticated based on the connection request; wherein the server and the authentication terminal are provided by the same service provider; and the authentication terminal is installed on the terminal device;

[0308] The first communication module 510 of the client is further configured to receive the first information to be authenticated from the server;

[0309] The second communication module 520 of the client is configured to send the first information to be authenticated to the authentication end, so that the authentication end authenticates the first information to be authenticated;

[0310] The second communication module 520 of the client is further configured to receive a first session key from the authentication end in response to the authentication end successfully authenticating the first information to be authenticated, so that the client communicates with the server using the first session key.

[0311] In some embodiments, the client second communication module 520 is configured to:

[0312] In response to the authentication end successfully authenticating the first information to be authenticated, receiving user identity request information from the authentication end;

[0313] In response to a user input operation, sending the user identity authentication information input by the user to the authentication end, so that the authentication end generates second information to be authenticated based on the user identity authentication information and sends the second information to be authenticated to the server for authentication;

[0314] In response to the server successfully authenticating the second information to be authenticated, the server receives the first session key from the authentication end.

[0315] In some embodiments, the client device 500 further includes:

[0316] The client key acquisition module 530 is configured to acquire a second session key in response to the authentication terminal being installed on the terminal device;

[0317] The client storage module 540 is configured to store the second session key so that the client can communicate with the authentication end using the second session key.

[0318] In some embodiments, the client second communication module 520 is configured to:

[0319] generating third information to be authenticated based on the first information to be authenticated and the client identification information;

[0320] encrypting the third information to be authenticated using the second session key;

[0321] The encrypted third information to be authenticated is sent to the authentication end, so that the authentication end authenticates the third information to be authenticated.

[0322] The above description of the client device embodiment provided on the terminal device is similar to the description of the communication method embodiment applied to the client described above, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the client device provided by the present disclosure can be used to perform the method described in the communication method embodiment applied to the client described above. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment applied to the client of the present application for understanding.

[0323] On the other hand, the present application also provides an authentication terminal device provided on a terminal device. The various units included in the device, and the various modules included in each unit, can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0324] Figure 6This is a schematic diagram of the structure of an authentication terminal device provided by this application. Figure 6 As shown, the authentication end device 600 includes: an authentication end first communication module 610, an authentication end authentication module 620, an authentication end secret key generation module 630 and an authentication end second communication module 640, wherein:

[0325] The first communication device 610 of the authentication end is configured to receive first information to be authenticated from the client; wherein the first information to be authenticated is generated by the server based on a connection request sent by the client; the server and the authentication end are provided by the same service provider;

[0326] The authentication module 620 of the authentication end is used to authenticate the first information to be authenticated;

[0327] The authentication end key generation module 630 is configured to generate a first session key when the first information to be authenticated passes authentication;

[0328] The second communication module 640 of the authentication end is configured to send the first session key to the client, so that the client communicates with the server using the first session key.

[0329] In some embodiments, the authentication end key generation module 630 includes:

[0330] An information generation module 631 is configured to generate second information to be authenticated if the first information to be authenticated passes authentication;

[0331] The third communication module 632 of the authentication end is configured to send the second information to be authenticated to the server end, so that the server end authenticates the client end based on the second information to be authenticated;

[0332] The authentication end key generation submodule 633 is configured to generate the first session key in response to the server successfully authenticating the second information to be authenticated.

[0333] In some embodiments:

[0334] The first communication device 610 of the authentication end is used to obtain the client identifier and user identity authentication information corresponding to the client from the client;

[0335] The authentication end key generation module 630 is used to generate a secondary master key based on the client identifier and the user identity authentication information;

[0336] The information generation module 631 is configured to generate the second information to be authenticated based on the client identifier, the user identity authentication information, and the secondary master key.

[0337] In some embodiments, the authentication end key generation submodule 633 is configured to generate the first session key based on the secondary master key.

[0338] In some embodiments, the authentication terminal device 600 further includes:

[0339] The authentication terminal key acquisition module 640 is configured to acquire a second session key in response to the authentication terminal being installed on the terminal device;

[0340] The authentication end storage module 650 is configured to store the second session key so as to communicate with the client using the second session key.

[0341] The above description of the embodiment of the authentication terminal apparatus provided on the terminal device is similar to the description of the embodiment of the communication method applied to the authentication terminal, and has similar beneficial effects as the embodiment of the method. In some embodiments, the functions or modules included in the authentication terminal apparatus provided by the present disclosure can be used to execute the method described in the embodiment of the communication method applied to the authentication terminal. For technical details not disclosed in the embodiment of the apparatus of the present application, please refer to the description of the embodiment of the method applied to the client of the present application for understanding.

[0342] On the other hand, the present application also provides a server-side device provided on a server-side device. The units included in the device and the modules included in each unit can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0343] Figure 7 This is a schematic diagram of the composition structure of a server device provided by this application. Figure 7 As shown, the server device 700 includes: a server information generation module 710, a server first communication module 720, a server second communication module 730, a server authentication module 740 and a server key generation module 750; wherein:

[0344] The server information generation module 710 is configured to generate first information to be authenticated in response to a connection request sent by the client;

[0345] The server-side first communication module 720 is configured to send the first information to be authenticated to the client, so that the client sends the first information to be authenticated to an authentication terminal installed on the same terminal device as the client; wherein the authentication terminal and the server-side are provided by the same service provider;

[0346] The server-side second communication module 730 is further configured to receive second information to be authenticated from the authentication end if the authentication end successfully authenticates the first information to be authenticated;

[0347] The server authentication module 740 is configured to authenticate the second information to be authenticated;

[0348] The server-side second communication module 730 is further configured to send authentication success information to the authentication end if the second information to be authenticated passes authentication;

[0349] The server key generation module 750 is configured to generate a third session key so that the server can communicate with the client using the third session key.

[0350] In some embodiments, the connection request includes at least one encryption method supported by the client;

[0351] The server information generation module 710 is used to:

[0352] determining a target encryption method from the at least one encryption method;

[0353] Generate server-side random number and signature information;

[0354] The first information to be authenticated is generated based on the target encryption method, the server random number and the signature information.

[0355] In some embodiments, the second information to be authenticated includes at least: a client identifier corresponding to the client, user identity authentication information, and a secondary master key; wherein the secondary master key is generated by the authentication end after the authentication end successfully authenticates the first information to be authenticated;

[0356] The server authentication module 740 is used to authenticate the user identity authentication information and the client identifier;

[0357] The authentication end key generation module 750 is configured to generate the third session key based on the secondary master key.

[0358] The above description of the server-side apparatus embodiment provided on the server-side device is similar to the description of the communication method embodiment applied to the server-side, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the server-side apparatus provided by the present disclosure can be used to execute the method described in the communication method embodiment applied to the server-side. For technical details not disclosed in the apparatus embodiment of the present application, please refer to the description of the method embodiment applied to the client of the present application for understanding.

[0359] On the other hand, the present application also provides a client device provided on a terminal device, wherein the terminal device is also equipped with an authentication terminal. The various units included in the client device, and the various modules included in each unit, can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA).

[0360] Figure 8 This is a schematic diagram of the structure of a client device provided by this application. Figure 8 As shown, the client device 800 includes: a first client communication module 810 and a client display module 820; wherein,

[0361] The first communication module 810 of the client is configured to send a connection request to the server in response to a user's startup operation; wherein the server and the authentication end are provided by the same service provider; wherein the authentication end is installed on the terminal device;

[0362] The client display module 820 is used to display a first interactive interface in response to the authentication end successfully authenticating the first information to be authenticated sent by the server; wherein, the first information to be authenticated is generated by the server based on the connection request; the first interactive interface represents the interface for the user to conduct a conversation with the server through the client.

[0363] In some embodiments, the client display module 820 is configured to:

[0364] In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, displaying a second interactive interface; wherein the second interactive interface is used to receive user identity authentication information input by the user;

[0365] In response to the server successfully authenticating the user identity authentication information input by the user through the second interactive interface, the first interactive interface is displayed.

[0366] In some embodiments, the client device 800 further includes:

[0367] The client key acquisition module 830 is configured to acquire a second session key in response to the authentication terminal being installed on the terminal device;

[0368] The client storage module 840 is configured to store the second session key so as to communicate with the authentication end using the second session key.

[0369] The above description of the client device embodiment provided on the terminal device is similar to the description of the communication method embodiment applied to the client described above, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the client device provided by the present disclosure can be used to perform the method described in the communication method embodiment applied to the client described above. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment applied to the client of the present application for understanding.

[0370] On the other hand, the present application also provides a communication system for executing the above communication method.

[0371] Reference Figure 9 The communication system 900 includes a client 911, an authentication terminal 912, and a server 921; the client 911 and the authentication terminal 912 are installed on a terminal device 910; the server 921 is installed on a server device 920; the authentication terminal 912 and the server 921 are provided by the same service provider; wherein:

[0372] The client 911 is used to send a connection request to the server 921;

[0373] The server 921 is configured to generate first information to be authenticated in response to a connection request sent by the client 911, and send the first information to be authenticated to the authentication terminal 912;

[0374] The authentication end 912 is used to authenticate the first information to be authenticated, and if the authentication is successful, generate a first session key; send the first session key to the client 911, so that the client 911 uses the first session key to communicate with the server 921.

[0375] It should be noted that the communication system provided in this application corresponds to the above-mentioned communication method embodiments applied to the client, the communication method embodiments applied to the authentication end, and the communication method embodiments applied to the server, and has similar beneficial effects. In some embodiments, for technical details not disclosed in the communication system embodiments of this application, please refer to the description of the communication method embodiments applied to the client, the communication method embodiments applied to the authentication end, and the communication method embodiments applied to the server of this application for understanding.

[0376] Next, combine Figure 10 An embodiment of communication using the communication method provided by the present application is described in detail.

[0377] like Figure 10 As shown, this embodiment includes the following steps S1001 to S1010:

[0378] Step S1001: Install an authentication terminal on a terminal device; in response to the authentication terminal being installed, determine a terminal session key for communication between a client on the terminal device and the authentication terminal; then, execute step S1002;

[0379] In step S1002, the client generates a client random number; the client sends a connection request to the server; wherein the connection request includes the client random number, at least one cipher suite supported by the client, and a timestamp generated by the client; thereafter, step S1003 is executed;

[0380] In step S1003, the server receives a connection request from the client; the server generates a server random number and selects a target encryption suite from multiple encryption suites supported by the client; the server signs the server random number and the target encryption suite to obtain fourth information to be authenticated, and sends the fourth information to be authenticated to the client; thereafter, step S1004 is executed;

[0381] In step S1004, the client receives the fourth information to be authenticated from the server and confirms the server random number, target cipher suite, and server signature information in the fourth information to be authenticated. The client encrypts the server random number, target cipher suite, server signature information, client random number, and client identification code using the terminal session key to obtain the fifth information to be authenticated. The fifth information to be authenticated is sent to the authenticator. Thereafter, step S1005 is executed.

[0382] In step S1005, the authenticator receives the fifth information to be authenticated from the client and decrypts it using the terminal session key. The authenticator verifies the server signature using the first public key. In response to the server signature being successfully verified, the authenticator obtains the user name and password from the user and generates a secondary master key. The authenticator encrypts the secondary master key, user name, password, and client identification code using the second public key to obtain the sixth information to be authenticated, and sends the sixth information to the server. Thereafter, step S1006 is executed.

[0383] Here, the authentication end and the server end are provided by the same service provider. Therefore, the first public key and the second public key are both provided by the service provider. The first public key is used to verify the server signature, and the second public key is used to encrypt the session between the authentication end and the server end; accordingly, the server end stores a server private key corresponding to the second public key, which is used to decrypt the encrypted information sent by the authentication end.

[0384] In some embodiments, the first public key and the second public key are both undisclosed secret keys and are encrypted and stored in the authentication end.

[0385] In step S1006, the server receives the sixth information to be authenticated from the authenticator and decrypts it using the server private key. The server verifies the username, password, and client identification code. After successful verification, the server sends an access permission message to the authenticator. The server generates a master key, i.e., a session key between the client and the server, using the secondary master key, the client random number, and the server random number. Thereafter, step S1007 is executed.

[0386] Step S1007: After receiving the access permission message from the server, the authenticator generates a master key using the secondary master key, the client random number, and the server random number, i.e., the session key between the client and the server, and sends the session key to the client. Then, step S1008 is executed.

[0387] Step S1008: The client generates a handshake completion message and encrypts it using the session key; the client sends the encrypted handshake completion message to the server; then, step S1009 is executed;

[0388] Step S1009: After receiving the handshake completion message sent by the client, the server uses the session key to decrypt and verify the handshake completion message. In response to the verification, the server generates a handshake completion message and encrypts it using the session key. The server sends the encrypted handshake completion message to the client. Thereafter, step S1010 is executed.

[0389] In step S1010 , the client and the server perform encrypted communication using the encryption suite and session key selected by the server.

[0390] For further information, see Figure 11 . Figure 11 Schematic diagram of the interactive process of the communication method provided in this application. The communication method involves a client 1110, an authentication terminal 1120 and a server 1130. Figure 11 As shown, the interaction process may include at least the following steps S1101 to S1119:

[0391] Step S1101: The client 1110 sends a connection request to the server.

[0392] Here, the connection request includes a client random number and at least one encryption suite supported by the client 1110 .

[0393] In step S1102, the server 1130 sends the fourth authentication information to the client.

[0394] Here, the fourth information to be authenticated includes the server random number, the target encryption suite selected by the server 1130 and the server signature.

[0395] Step S1103: The client 1110 generates fifth information to be authenticated.

[0396] Here, the client 1110 uses the terminal session key to encrypt the client random number, the client identification code, the server random number, the target encryption suite selected by the server 1130 and the server signature to obtain the fifth information to be authenticated.

[0397] Step S1104: The client 1110 sends the fifth authentication information to the authentication end;

[0398] Step S1105: the authenticating end 1120 decrypts the fifth information to be authenticated using the terminal session key;

[0399] Here, after decrypting the fifth information to be authenticated, the authenticator 1120 obtains the server random number, the client random number, the client identification code, the target encryption suite, and the server signature.

[0400] Step S1106: The authentication end 1120 uses the first public key to verify the signature of the server.

[0401] Here, the first public key is a public key provided by the provider of the authentication end 1120 and the server 1130 and encrypted and stored in the authentication end 1120 for authenticating the server signature.

[0402] Step S1107: The authentication end 1120, in response to the server-side signature verification being successful, obtains the user name and password from the user and generates a secondary master key.

[0403] Step S1108: The authentication end 1120 encrypts the secondary master key, the user name, the password, and the client identification code using the second public key to obtain sixth information to be authenticated.

[0404] Here, the second public key is a public key provided by the providers of authenticator 1120 and server 1130 and stored in authenticator 1120 for encrypting session data between authenticator 1120 and server 1130. Accordingly, server 1130 stores a server private key corresponding to the second public key, which is used to decrypt encrypted information sent by authenticator 1120.

[0405] Step S1109: the authentication end 1120 sends the sixth information to be authenticated to the server;

[0406] Step S1111, the server 1130 decrypts the sixth information to be authenticated using the server private key;

[0407] Here, the server 1130 decrypts the sixth information to be authenticated to obtain the secondary master key, user name, password, and client identification code.

[0408] In step S1112, the server 1130 verifies the user name, password, and client identification code;

[0409] In step S1113, the server 1130 generates a session key in response to the verification being successful.

[0410] Here, the server 1130 generates a master key, ie, a session key between the client 1110 and the server 1130 , using the secondary master key, the client random number, and the server random number.

[0411] Step S1114: the server 1130 sends an access permission message to the authenticator.

[0412] Step S1115: the authentication end 1120 generates a session key and sends the session key to the client;

[0413] Here, the authenticator 1120 generates a master key, ie, a session key between the client 1110 and the server 1130 , using the secondary master key, the client random number, and the server random number.

[0414] Step S1116: The client 1110 sends a handshake completion message to the server.

[0415] Here, the client 1110 generates a handshake completion message and encrypts it using the session key.

[0416] In step S1117, the server 1130 decrypts the handshake completion message using the session key and verifies the handshake completion message.

[0417] Step S1118: The server 1130 sends a handshake completion message to the client in response to the verification being successful.

[0418] Here, in response to the verification being successful, the server generates a handshake completion message and encrypts it using the session key.

[0419] In step S1119, the client and the server perform encrypted communication using the encryption suite and session key selected by the server.

[0420] It should be noted that, in the embodiment of the present application, if the above-mentioned communication method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific hardware, software or firmware, or any combination of hardware, software and firmware.

[0421] An embodiment of the present application provides a terminal device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0422] An embodiment of the present application provides a server device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0423] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements some or all of the steps in the above method. The computer-readable storage medium may be transient or non-transient.

[0424] An embodiment of the present application provides a computer program, including computer-readable code. When the computer-readable code is run in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0425] An embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, implements some or all of the steps in the above method. The computer program product can be implemented specifically by hardware, software, or a combination thereof. In some embodiments, the computer program product is embodied as a computer storage medium. In other embodiments, the computer program product is embodied as a software product, such as a software development kit (SDK), etc.

[0426] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between the various embodiments, and their similarities or similarities can be referenced to each other. The descriptions of the above device, storage medium, computer program, and computer program product embodiments are similar to the descriptions of the above method embodiments and have similar beneficial effects as the method embodiments. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this application, please refer to the description of the method embodiments of this application for understanding.

[0427] It should be noted that Figure 12 A schematic diagram of a hardware entity of a terminal device in an embodiment of the present application is shown in FIG. Figure 12 As shown, the hardware entity of the terminal device 1200 includes: a processor 1201, a communication interface 1202 and a memory 1203, wherein:

[0428] The processor 1201 generally controls the overall operation of the terminal device 1200 .

[0429] The communication interface 1202 enables the computer device to communicate with other terminals or servers through a network.

[0430] The memory 1203 is configured to store instructions and applications executable by the processor 1201, and can also cache data to be processed or processed by the processor 1201 and various modules in the terminal device 1200 (for example, image data, audio data, voice communication data, and video communication data). This can be implemented using flash memory (FLASH) or random access memory (RAM). Data can be transmitted between the processor 1201, the communication interface 1202, and the memory 1203 via the bus 1204.

[0431] Figure 13 A schematic diagram of a hardware entity of a server device in an embodiment of the present application is shown in FIG. Figure 13 As shown, the hardware entity of the server device 1300 includes: a processor 1301, a communication interface 1302 and a memory 1303, wherein:

[0432] The processor 1301 generally controls the overall operation of the server device 1300 .

[0433] The communication interface 1302 enables the computer device to communicate with other terminals or servers through a network.

[0434] The memory 1303 is configured to store instructions and applications executable by the processor 1301. It can also cache data to be processed or processed by the processor 1301 and various modules in the server device 1300 (for example, image data, audio data, voice communication data, and video communication data). This can be implemented using flash memory (FLASH) or random access memory (RAM). Data can be transmitted between the processor 1301, the communication interface 1302, and the memory 1303 via the bus 1304.

[0435] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned steps / processes does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0436] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0437] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0438] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0439] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0440] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, and other media that can store program codes.

[0441] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0442] The above is only an implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. A communication method, characterized in that: Applicable to a client installed on a terminal device, the terminal device also having an authentication terminal installed, including: Sending a connection request to a server, so that the server generates first information to be authenticated based on the connection request; wherein the server and the authentication end are provided by the same service provider; receiving the first information to be authenticated from the server; sending the first information to be authenticated to the authentication end, so that the authentication end authenticates the first information to be authenticated; In response to the authentication end successfully authenticating the first information to be authenticated, a first session key is received from the authentication end, so as to communicate with the service end using the first session key.

2. The method according to claim 1, characterized in that The receiving a first session key from the authentication end in response to the authentication end successfully authenticating the first information to be authenticated includes: In response to the authentication end successfully authenticating the first information to be authenticated, receiving user identity request information from the authentication end; In response to a user input operation, sending the user identity authentication information input by the user to the authentication end, so that the authentication end generates second information to be authenticated based on the user identity authentication information and sends the second information to be authenticated to the server for authentication; In response to the server successfully authenticating the second information to be authenticated, the server receives the first session key from the authentication end.

3. The method according to any one of claims 1 to 2, characterized in that Before sending the connection request to the server, the method further includes: In response to the completion of installing the authentication terminal on the terminal device, obtaining a second session key; The second session key is stored so that the client communicates with the authentication end using the second session key.

4. The method according to claim 3, characterized in that The sending the first information to be authenticated to the authentication end so that the authentication end authenticates the first information to be authenticated includes: generating third information to be authenticated based on the first information to be authenticated and the client identification information; encrypting the third information to be authenticated using the second session key; The encrypted third information to be authenticated is sent to the authentication end, so that the authentication end authenticates the third information to be authenticated.

5. A communication method, characterized in that: Applicable to an authentication terminal installed on a terminal device, the terminal device also having a client installed, including: receiving first information to be authenticated from the client; wherein the first information to be authenticated is generated by the server based on a connection request sent by the client; the server and the authentication end are provided by the same service provider; authenticating the first information to be authenticated; If the first information to be authenticated passes authentication, generating a first session key; The first session key is sent to the client, so that the client communicates with the server using the first session key.

6. The method according to claim 5, characterized in that The generating a first session key when the first information to be authenticated passes the authentication includes: If the first information to be authenticated passes authentication, generating second information to be authenticated; sending the second information to be authenticated to the server, so that the server authenticates the client based on the second information to be authenticated; In response to the server successfully authenticating the second information to be authenticated, the first session key is generated.

7. The method according to claim 6, characterized in that The generating of the second information to be authenticated includes: Obtaining a client identifier and user identity authentication information corresponding to the client from the client; generating a secondary master key based on the client identifier and the user identity authentication information; The second information to be authenticated is generated based on the client identifier, the user identity authentication information, and the secondary master key.

8. The method according to claim 7, characterized in that The generating the first session key includes: Based on the secondary master key, the first session key is generated.

9. The method according to any one of claims 5 to 8, characterized in that Before receiving the first information to be authenticated from the client, the method further includes: In response to the completion of installing the authentication terminal on the terminal device, obtaining a second session key; The second session key is stored to communicate with the client using the second session key.

10. A communication method, characterized in that: Applicable to the server installed on the server device, including: In response to a connection request sent by a client, generating first information to be authenticated; sending the first information to be authenticated to the client, so that the client sends the first information to be authenticated to an authentication terminal installed on the same terminal device as the client, and the authentication terminal authenticates the first information to be authenticated; wherein the authentication terminal and the server are provided by the same service provider; When the authentication end successfully authenticates the first information to be authenticated, receiving second information to be authenticated from the authentication end to authenticate the second information to be authenticated; When the second information to be authenticated is authenticated successfully, authentication success information is sent to the authentication end, and a third session key is generated, so as to communicate with the client using the third session key.

11. The method according to claim 10, characterized in that The connection request includes at least one encryption method supported by the client; The step of generating first information to be authenticated in response to a connection request sent by the client includes: determining a target encryption method from the at least one encryption method; Generate server-side random number and signature information; The first information to be authenticated is generated based on the target encryption method, the server random number and the signature information.

12. The method according to claim 10, characterized in that The second information to be authenticated includes at least: a client identifier corresponding to the client, user identity authentication information, and a secondary master key; wherein the secondary master key is generated by the authentication end after the authentication end successfully authenticates the first information to be authenticated; The authenticating the second information to be authenticated includes: authenticating the user identity authentication information and the client identifier; The generating of the second session key includes: Based on the secondary master key, the third session key is generated.

13. A communication method, characterized in that: Applicable to a client installed on a terminal device, the terminal device also having an authentication terminal installed, including: In response to a user's start-up operation, sending a connection request to a server; wherein the server and the authentication terminal are provided by the same service provider; In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, a first interactive interface is displayed; wherein, the first information to be authenticated is generated by the server based on the connection request; the first interactive interface represents the interface for the user to conduct a conversation with the server through the client.

14. The method according to claim 13, characterized in that The displaying of the first interactive interface in response to the authentication end successfully authenticating the first information to be authenticated sent by the server includes: In response to the authentication end successfully authenticating the first information to be authenticated sent by the server, displaying a second interactive interface; wherein the second interactive interface is used to receive user identity authentication information input by the user; In response to the server successfully authenticating the user identity authentication information input by the user through the second interactive interface, the first interactive interface is displayed.

15. The method according to claim 13, characterized in that Before sending the connection request to the server in response to the user's startup operation, the method further includes: In response to the completion of installing the authentication terminal on the terminal device, obtaining a second session key; The second session key is stored to communicate with the authentication end using the second session key.

16. A client device, characterized in that: Set on the terminal device, the terminal device is also equipped with an authentication terminal, including: A first communication module of the client, configured to send a connection request to the server, so that the server generates first information to be authenticated based on the connection request; wherein the server and the authentication end are provided by the same service provider; The first communication module of the client is further configured to receive the first information to be authenticated from the server; The second communication module of the client is used to send the first information to be authenticated to the authentication end, so that the authentication end authenticates the first information to be authenticated; The second communication module of the client is further configured to receive a first session key from the authentication end in response to the authentication end successfully authenticating the first information to be authenticated, so that the client communicates with the server using the first session key.

17. An authentication terminal device, characterized in that: Set on a terminal device, the terminal device also has a client installed, including: The first communication device of the authentication end is configured to receive first information to be authenticated from the client; wherein the first information to be authenticated is generated by the server based on a connection request sent by the client; the server and the authentication end are provided by the same service provider; An authentication module on the authentication end, configured to authenticate the first information to be authenticated; an authentication end key generation module, configured to generate a first session key when the first information to be authenticated passes authentication; The second communication module of the authentication end is used to send the first session key to the client, so that the client communicates with the server using the first session key.

18. A server device, characterized in that: Settings on the server device include: The server information generation module is used to generate first authentication information in response to the connection request sent by the client; a first communication module on the server side, configured to send the first information to be authenticated to the client side, so that the client side sends the first information to be authenticated to an authentication terminal installed on the same terminal device as the client side; wherein the authentication terminal and the server side are provided by the same service provider; The second communication module of the server is further configured to receive second information to be authenticated from the authentication end if the authentication end successfully authenticates the first information to be authenticated; A server-side authentication module, configured to authenticate the second information to be authenticated; The second communication module of the server is further configured to send authentication success information to the authentication end when the second information to be authenticated passes the authentication; The server key generation module is used to generate a third session key so that the server can communicate with the client using the third session key.

19. A client device, characterized in that: Set on the terminal device, the terminal device is also equipped with an authentication terminal, including: The third communication module of the client is used to send a connection request to the server in response to the user's startup operation; wherein the server and the authentication end are provided by the same service provider; The client display module is used to display a first interactive interface in response to the authentication end successfully authenticating the first information to be authenticated sent by the server; wherein the first information to be authenticated is generated by the server based on the connection request; the first interactive interface represents the interface for the user to conduct a conversation with the server through the client.

20. A communication system, characterized in that: The communication system includes a client, an authentication terminal, and a server; the client and the authentication terminal are installed on the same terminal device; the authentication terminal and the server are provided by the same service provider; wherein: The client is used to send a connection request to the server; The server is configured to generate first information to be authenticated in response to a connection request sent by the client, and send the first information to be authenticated to the authentication terminal; The authentication end is used to authenticate the first information to be authenticated, and generate a first session key if the authentication is successful; and send the first session key to the client, so that the client communicates with the server using the first session key.

21. A terminal device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be executed by the processor, and when the processor executes the computer program, the communication method according to any one of claims 1 to 4, 5 to 9, or 13 to 15 is executed.

22. A server device, characterized in that: The device comprises a memory and a processor, wherein the memory stores a computer program that can be executed by the processor, and when the processor executes the computer program, the communication method according to any one of claims 10 to 12 is executed.

23. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed, the steps of the communication method according to any one of claims 1 to 4, 5 to 9, 10 to 12 or 13 to 15 are implemented.

24. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instructions are executed by a processor, the steps of the communication method according to any one of claims 1 to 4, 5 to 9, 10 to 12 or 13 to 15 are implemented.

Images