Identity authentication method and system, client, server, equipment and medium

Abstract

The invention provides an identity authentication method and system, a client, a server, equipment and a medium, and relates to the technical field of identity authentication. The method is applied to a client, the client comprises a credible authentication module and an SIM card, a digital certificate of a user is pre-stored in the SIM card, and the method comprises the steps that the credible authentication module obtains to-be-signed information, used for logging in a service system, of the user and sends the to-be-signed information to the SIM card; the SIM card signs the to-be-signed information according to a pre-stored user private key to obtain a first signature value, and sends the first signature value and the identification information of the digital certificate to the credible authentication module; the credible authentication module sends the first signature value and the identification information to an identity authentication server; according to the scheme, the data transmission quantity can be reduced, and the identity authentication efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of identity authentication technology, specifically to an identity authentication method, system, client, server, device, and medium. Background Technology

[0002] A digital certificate, also known as a digital identifier, is a digital authentication document used in internet communications to identify the identity of parties involved. It ensures the integrity and security of information and data exchanged between network users through encryption or decryption. Currently, digital certificates are stored directly on the client or other hardware media. Furthermore, the authentication process requires transmitting the digital certificate, increasing data transmission volume and necessitating access to a Certificate Authority (CA) for verification, leading to increased authentication time and bandwidth limitations. Summary of the Invention

[0003] This application provides an identity authentication method, system, client, server, device, and medium to solve the aforementioned technical problems.

[0004] To solve the above-mentioned technical problems, this application is implemented as follows:

[0005] Firstly, this application provides an identity authentication method applied to a client, the client including a trusted authentication module and a SIM (Subscriber Identity Module) card, wherein the SIM card pre-stores the user's digital certificate, and the method includes:

[0006] The trusted authentication module obtains the pending signature information used by the user to log in to the business system and sends the pending signature information to the SIM card;

[0007] The SIM card signs the information to be signed according to the pre-stored user private key to obtain a first signature value, and sends the first signature value and the identification information of the digital certificate to the trusted authentication module;

[0008] The trusted authentication module sends the first signature value and the identification information to the identity authentication server.

[0009] Optionally, in the identity authentication method, before the trusted authentication module obtains the user's pending signature information for logging into the business system, the method further includes:

[0010] The trusted authentication module obtains the user information input by the user and sends the user information to the SIM card;

[0011] The SIM card signs the user information using the user's private key to obtain a second signature value, and then sends the second signature value to the trusted authentication module.

[0012] The trusted authentication module generates a CSR (Certificate Signing Request) based on the user information, the pre-stored user public key, and the second signature value, and sends the CSR to the identity authentication server.

[0013] The trusted authentication module receives the digital certificate sent by the identity authentication server and sends the digital certificate to the SIM card;

[0014] The SIM card stores the digital certificate.

[0015] Optionally, in the identity authentication method, before the trusted authentication module generates the CSR based on the user information, the pre-stored user public key, and the second signature value, the method further includes:

[0016] The SIM card generates a random number and sends the random number to the trusted authentication module through the BIP (Bearer Independent Protocol) channel;

[0017] The trusted authentication module encrypts the random number according to a preset key algorithm to obtain ciphertext, and sends the ciphertext to the SIM card;

[0018] The SIM card verifies the ciphertext. If the ciphertext verification is successful, it generates and stores the user's public key and the user's private key, and sends the user's public key to the trusted authentication module.

[0019] The trusted authentication module stores the user's public key.

[0020] Optionally, in the identity authentication method, the SIM card verifies the ciphertext by:

[0021] The SIM card decrypts the ciphertext using the encryption algorithm hardware circuit and the pre-stored key to obtain a first decryption result;

[0022] If the first decryption result is successful, the SIM card performs an availability status check on the trusted authentication module to obtain a status check result.

[0023] If the status verification result indicates that the status is available, the SIM card sends status availability information to the trusted authentication module.

[0024] Optionally, in the identity authentication method, after the SIM card sends the user's public key to the trusted authentication module, the method further includes:

[0025] The SIM card modifies the available status of the trusted authentication module to unavailable.

[0026] Optionally, in the identity authentication method, the client further includes a fingerprint recognition module, which pre-stores the user's fingerprint feature value;

[0027] After the trusted authentication module obtains the user's pending signature information for logging into the business system, the method further includes:

[0028] The trusted authentication module sends a fingerprint recognition request to the fingerprint recognition module;

[0029] The fingerprint recognition module performs fingerprint recognition on the user based on the fingerprint feature value and the fingerprint recognition request, obtains the fingerprint recognition result, and sends the fingerprint recognition result to the trusted authentication module;

[0030] The trusted authentication module sends the pending signature information to the SIM card, including:

[0031] When the trusted authentication module receives a fingerprint recognition result indicating that the fingerprint authentication is successful, it sends the pending signature information to the SIM card.

[0032] Optionally, in the identity authentication method, the SIM card signs the information to be signed based on a pre-stored user private key to obtain a first signature value, including:

[0033] The SIM card signs the information to be signed using the encryption algorithm hardware circuit and the pre-stored user private key to obtain a first signature value.

[0034] Secondly, this application also provides an identity authentication method applied to an identity authentication server, wherein the identity authentication server pre-stores the user's digital certificate, and the method includes:

[0035] Receive the first signature value and digital certificate identification information sent by the trusted authentication module in the client;

[0036] Obtain the digital certificate based on the identification information;

[0037] If the first signature value is verified successfully using the user's public key in the digital certificate, the information to be signed and the user information in the digital certificate are obtained.

[0038] The encrypted user information and the encrypted information to be signed are sent to the business server.

[0039] Optionally, in the identity authentication method, before receiving the identification information of the digital certificate and the first signature value sent by the trusted authentication module in the client, the method further includes:

[0040] Receive the CSR sent by the trusted authentication module;

[0041] The user information is signed using the user's public key in the CSR to obtain a third signature value;

[0042] If the second signature value in the CSR is verified to be valid based on the third signature value, the digital certificate generated by the CA service is obtained.

[0043] Send the digital certificate to the trusted authentication module.

[0044] Optionally, the identity authentication method further includes:

[0045] The digital certificate is stored in both a cache and a database.

[0046] Obtaining the digital certificate based on the identification information includes:

[0047] The digital certificate is obtained from the cache and / or the database based on the identification information.

[0048] Thirdly, this application also provides an identity authentication system, including: a client, an identity authentication server, and a business server, wherein the client includes a trusted authentication module and a SIM card, and the SIM card and the identity authentication server pre-store the user's digital certificate;

[0049] The trusted authentication module is used to obtain the pending signature information used by the user to log in to the business system and send the pending signature information to the SIM card;

[0050] The SIM card is used to sign the information to be signed according to the pre-stored user private key to obtain a first signature value, and send the first signature value and the identification information of the digital certificate to the trusted authentication module.

[0051] The trusted authentication module is used to send the first signature value and the identification information to the identity authentication server;

[0052] The identity authentication server is configured to receive the first signature value and the identification information, obtain the digital certificate based on the identification information, and, if the first signature value is verified successfully using the user's public key in the digital certificate, obtain the user information and the information to be signed in the digital certificate, and send the encrypted user information and the encrypted information to be signed to the business server.

[0053] The business server is used to determine whether to allow a user to log in to the business system based on the encrypted user information and the encrypted pending signature information.

[0054] Optionally, in the aforementioned identity authentication system,

[0055] The trusted authentication module is also used to obtain the user information input by the user and send the user information to the SIM card;

[0056] The SIM card is also used to sign the user information according to the user's private key to obtain a second signature value, and send the second signature value to the trusted authentication module;

[0057] The trusted authentication module is also used to generate a CSR based on the user information, the pre-stored user public key and the second signature value, and send the CSR to the identity authentication server;

[0058] The identity authentication server is also used to receive the CSR sent by the trusted authentication module, sign the user information according to the user public key in the CSR to obtain a third signature value, and if the second signature value is verified by the third signature value, obtain the digital certificate generated by the CA service and send the digital certificate to the trusted authentication module.

[0059] The trusted authentication module is also used to send the digital certificate to the SIM card;

[0060] The SIM card is used to store the digital certificate.

[0061] Optionally, in the aforementioned identity authentication system,

[0062] The identity authentication server is also used to store the digital certificate in a cache and a database, respectively; and,

[0063] The digital certificate is obtained from the cache and / or the database based on the identification information.

[0064] Fourthly, this application also provides a client, including a trusted authentication module and a SIM card, wherein the SIM card pre-stores the user's digital certificate;

[0065] The trusted authentication module is used to obtain the pending signature information used by the user to log in to the business system and send the pending signature information to the SIM card;

[0066] The SIM card is used to sign the information to be signed according to the pre-stored user private key to obtain a first signature value, and send the first signature value and the identification information of the digital certificate to the trusted authentication module.

[0067] The trusted authentication module is also used to send the first signature value and the identification information to the identity authentication server.

[0068] Fifthly, this application also provides an identity authentication server, wherein the identity authentication server pre-stores the user's digital certificate, including:

[0069] The first receiving module is used to receive the first signature value and the identification information of the digital certificate sent by the trusted authentication module in the client;

[0070] The first acquisition module is used to acquire the digital certificate based on the identification information;

[0071] The first obtaining module is used to obtain the information to be signed and the user information in the digital certificate when the first signature value is verified and passed according to the user's public key in the digital certificate.

[0072] The first sending module is used to send the encrypted user information and the encrypted information to be signed to the business server.

[0073] In a sixth aspect, this application also provides an identity authentication device, comprising: a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the processor executes the program or instructions to implement the identity authentication method as described in the first aspect, or to implement the identity authentication method as described in the second aspect.

[0074] In a seventh aspect, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the authentication method as described in the first aspect, or implements the authentication method as described in the second aspect.

[0075] Eighthly, this application also provides a computer program product, including computer instructions that, when executed by a processor, implement the authentication method as described in the first aspect, or implement the authentication method as described in the second aspect.

[0076] Compared with existing technologies, this application provides an identity authentication method, system, client, server, device, and medium. The SIM card and the identity authentication server pre-store the user's digital certificate. When authenticating the user's identity, there is no need to transmit the digital certificate. The trusted authentication module only needs to obtain the identification information of the digital certificate stored in the SIM card and transmit the identification information to the identity authentication server. Thus, the identity authentication server authenticates the user's identity based on the identification information, effectively reducing the amount of data transmission and saving identity authentication time and bandwidth usage, thereby improving identity authentication efficiency. Attached Figure Description

[0077] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0078] Figure 1 This is a schematic diagram of the architecture of the identity authentication system described in the embodiments of this application;

[0079] Figure 2 This is a flowchart illustrating the identity authentication method according to one embodiment of this application;

[0080] Figure 3 This is a flowchart illustrating one of the implementation methods of the identity authentication method described in the embodiments of this application;

[0081] Figure 4 This is a flowchart illustrating a second implementation of the identity authentication method described in the embodiments of this application;

[0082] Figure 5 This is a flowchart illustrating a third implementation of the identity authentication method described in this application.

[0083] Figure 6 This is a flowchart illustrating a fourth implementation of the identity authentication method described in the embodiments of this application;

[0084] Figure 7 This is a flowchart illustrating the fifth implementation of the identity authentication method described in the embodiments of this application;

[0085] Figure 8 This is a schematic diagram illustrating the connection between the trusted authentication module and the SIM card as described in an embodiment of this application.

[0086] Figure 9 This is a flowchart illustrating a sixth implementation of the identity authentication method described in the embodiments of this application;

[0087] Figure 10This is a flowchart illustrating the identity authentication method according to another embodiment of this application;

[0088] Figure 11 This is a flowchart illustrating an eighth implementation of the identity authentication method described in this application.

[0089] Figure 12 This is a flowchart illustrating the ninth implementation of the identity authentication method described in the embodiments of this application;

[0090] Figure 13 This is a schematic diagram of the client structure described in the embodiments of this application;

[0091] Figure 14 This is a schematic diagram of the structure of the identity authentication server described in the embodiments of this application;

[0092] Figure 15 This is a hardware block diagram of the identity authentication device described in the embodiments of this application. Detailed Implementation

[0093] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, without limiting the number of objects; for example, the first object can be one or more. Furthermore, "or" in this application indicates at least one of the connected objects. For example, "A or B" covers three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0094] Please refer to Figure 1 This application provides an identity authentication system, including: a client, an identity authentication server, and a business server, wherein the client includes a trusted authentication module and a SIM card, and the SIM card and the identity authentication server pre-store the user's digital certificate;

[0095] The trusted authentication module is used to obtain the pending signature information used by the user to log in to the business system and send the pending signature information to the SIM card;

[0096] The SIM card is used to sign the information to be signed according to the pre-stored user private key to obtain a first signature value, and send the first signature value and the identification information of the digital certificate to the trusted authentication module.

[0097] The trusted authentication module is used to send the first signature value and the identification information to the identity authentication server;

[0098] The identity authentication server is configured to receive the first signature value and the identification information, obtain the digital certificate based on the identification information, and, if the first signature value is verified successfully using the user's public key in the digital certificate, obtain the user information and the information to be signed in the digital certificate, and send the encrypted user information and the encrypted information to be signed to the business server.

[0099] The business server is used to determine whether to allow a user to log in to the business system based on the encrypted user information and the encrypted pending signature information.

[0100] In one implementation, optionally, the identity authentication server is further configured to store the digital certificate in a cache and a database respectively; and,

[0101] The digital certificate is obtained from the cache and / or the database based on the identification information.

[0102] In one embodiment, optionally, the trusted authentication module is further configured to obtain the user information input by the user and send the user information to the SIM card;

[0103] The SIM card is also used to sign the user information according to the user's private key to obtain a second signature value, and send the second signature value to the trusted authentication module;

[0104] The trusted authentication module is also used to generate a CSR based on the user information, the pre-stored user public key and the second signature value, and send the CSR to the identity authentication server;

[0105] The identity authentication server is also used to receive the CSR sent by the trusted authentication module, sign the user information according to the user public key in the CSR to obtain a third signature value, and if the second signature value is verified by the third signature value, obtain the digital certificate generated by the CA service and send the digital certificate to the trusted authentication module.

[0106] The trusted authentication module is also used to send the digital certificate to the SIM card;

[0107] The SIM card is used to store the digital certificate.

[0108] In one embodiment, optionally, the SIM card is also used to generate a random number and send the random number to the trusted authentication module through a Bearer Independent Protocol (BIP) channel;

[0109] The trusted authentication module is further configured to encrypt the random number according to a preset key algorithm to obtain ciphertext, and send the ciphertext to the SIM card;

[0110] The SIM card is also used to verify the ciphertext, and if the ciphertext verification is successful, to generate and store the user public key and the user private key, and to send the user public key to the trusted authentication module.

[0111] The trusted authentication module is also used to store the user's public key.

[0112] In one embodiment, optionally, the SIM card is specifically used to decrypt the ciphertext according to the encryption algorithm hardware circuit and the pre-stored key to obtain a first decryption result;

[0113] If the first decryption result is successful, the trusted authentication module is checked for availability to obtain the status check result.

[0114] If the status verification result indicates that the status is available, the status availability information is sent to the trusted authentication module.

[0115] In one embodiment, optionally, the SIM card is further configured to change the available status of the trusted authentication module to unavailable.

[0116] In one embodiment, optionally, the client further includes a fingerprint recognition module, which pre-stores the user's fingerprint feature values;

[0117] The trusted authentication module is also used to send a fingerprint recognition request to the fingerprint recognition module;

[0118] The fingerprint recognition module is used to perform fingerprint recognition on the user based on the fingerprint feature value and the fingerprint recognition request, obtain the fingerprint recognition result, and send the fingerprint recognition result to the trusted authentication module;

[0119] The trusted authentication module is specifically used to send the signature-pending information to the SIM card when the fingerprint recognition result indicates that the fingerprint authentication is successful.

[0120] In one embodiment, optionally, the SIM card is specifically used to sign the information to be signed based on the encryption algorithm hardware circuit and the pre-stored user private key to obtain a first signature value.

[0121] It should be noted that the trusted authentication module in this application embodiment can be a trusted authentication APP (Application) or an integrated authentication SDK (Software Development Kit). After scanning the code, it can wake up the fingerprint recognition module to verify the user's identity and sign the information to be signed.

[0122] The fingerprint recognition module is used to identify the user's fingerprint in order to verify the user's identity.

[0123] The SIM card may be a super SIM card, storing the user's digital certificate. The SIM card includes a card application used to generate the user's public key and private key, and to sign the information to be signed based on the user's private key.

[0124] The business server is used to receive the token transmitted from the identity authentication server, verify the user's identity, and enable user login. The identity authentication server is used to apply for and store digital certificates, encrypt user information and pending signature information to generate a token, and transmit the token to the business server.

[0125] The CA service is used to issue and verify digital certificates.

[0126] It should also be noted that the identity authentication system includes a business front-end and an identity authentication management back-end. The business front-end integrates a web authentication service page and generates a QR code. Specifically, the business front-end can be a PC / web-based business system front-end that connects to a customized web authentication service page, transmits relevant parameters via redirection, and polls the identity authentication server for login results.

[0127] The identity authentication management backend is used to manage business parties and their user information, and to configure the asymmetric encryption methods used by business parties, among other functions.

[0128] The business server is used to customize and develop the authentication result callback interface for business integration, obtain the user's signature authentication result and user information, verify the user information, confirm the user's permissions, complete the authentication, and return the login result to the business front end.

[0129] Business system users download and install the trusted authentication module on the client, complete the identity authentication function activation and apply for a digital certificate (users only need to activate and apply for a digital certificate once). The digital certificate application process will generate a user public key and a user private key, which will be stored in the SIM card. The digital certificate will be stored in the identity authentication server and the SIM card.

[0130] Specifically, when a user accesses the PC-based business system and enters the WEB authentication service page, they use the trusted authentication module to scan the QR code on the page. After scanning, they obtain information to be signed. The trusted authentication module then activates the fingerprint recognition module on the client side to authenticate the user's fingerprint, ensuring that the user is the owner of the device before authentication can be successful. After fingerprint authentication, the authentication SDK integrated into the trusted authentication module signs the information to be signed. The authentication SDK calls the SIM card's card application through the BIP channel, using the user's private key to sign the information to be signed, obtaining a first signature value. Then, the trusted authentication module calls the interface of the identity authentication server to verify the signature. The identity authentication server obtains the user information and generates a token, which is then returned to the business server. The WEB authentication service page continuously polls the identity authentication server to obtain the token. After obtaining the token, the business frontend calls the interface of the business server to verify the token. The business server verifies the token, checks the user information, confirms the user's permissions, completes the authentication, and returns the login result to the business frontend.

[0131] Please refer to Figure 2 This application also provides an identity authentication method applied to a client. The client includes a trusted authentication module and a SIM card. The SIM card pre-stores a user's digital certificate. The SIM card and the digital certificate have a one-to-one correspondence, with one SIM card corresponding to one digital certificate.

[0132] Furthermore, the method includes:

[0133] Step 201: The trusted authentication module obtains the pending signature information used by the user to log in to the business system and sends the pending signature information to the SIM card.

[0134] It should be noted that the information to be signed can be a random number generated by the business server. The business server stores the information to be signed in a cache and sets a cache validity period, which means that identity authentication can only be effective if completed within the cache validity period. The business server uses the information to be signed to generate a QR code. Specifically, the user selects QR code login on the business front end, opens the authentication web page, and obtains the URL of the QR code of the information to be signed from the business server by calling the business server interface. The business front end then displays the QR code of the information to be signed.

[0135] The user scans the QR code of the pending signature information through the trusted authentication module to obtain the pending signature information used by the user to log in to the business system, and the trusted authentication module sends the pending signature information to the SIM card.

[0136] Figure 3This is a flowchart illustrating one implementation of the identity authentication method described in the embodiments of this application. Figure 3 As shown, the method includes:

[0137] Step 301: The user accesses the business front end, enters the login page of the business system, and initiates login.

[0138] Step 302: The business front end sends a request for pending signature information to the business server.

[0139] Step 303: The business server generates the information to be signed, stores the information in the cache, sets the cache validity period, and generates a QR code for the information to be signed.

[0140] Step 304: The business server sends the URL (Uniform Resource Locator) of the QR code for the information to be signed to the business client.

[0141] Step 305: The user activates the trusted authentication module.

[0142] Step 306: The user scans the QR code of the information to be signed through the trusted authentication module.

[0143] Step 307: The trusted authentication module obtains the information to be signed.

[0144] Step 202: The SIM card signs the information to be signed according to the pre-stored user private key to obtain a first signature value, and sends the identification information of the digital certificate and the first signature value to the trusted authentication module.

[0145] In one embodiment, optionally, the client further includes a fingerprint recognition module, which pre-stores the user's fingerprint feature values;

[0146] After the trusted authentication module obtains the user's pending signature information for logging into the business system, the method further includes:

[0147] The trusted authentication module sends a fingerprint recognition request to the fingerprint recognition module;

[0148] The fingerprint recognition module performs fingerprint recognition on the user based on the fingerprint feature value and the fingerprint recognition request, obtains the fingerprint recognition result, and sends the fingerprint recognition result to the trusted authentication module;

[0149] The trusted authentication module sends the pending signature information to the SIM card, including:

[0150] When the trusted authentication module receives a fingerprint recognition result indicating that the fingerprint authentication is successful, it sends the pending signature information to the SIM card.

[0151] It should be noted that after obtaining the information to be signed, the trusted authentication module initiates a fingerprint recognition request to the fingerprint recognition module to wake up the fingerprint recognition module and perform user identity authentication to ensure that only users who have registered with the client can use the identity authentication system.

[0152] Figure 4 This is a flowchart illustrating a second implementation of the identity authentication method described in the embodiments of this application. Figure 4 As shown, the method includes:

[0153] The user enters the fingerprint to be identified;

[0154] The fingerprint recognition module identifies the fingerprint to be identified, specifically including: calculating the fingerprint feature value to be identified based on the fingerprint to be identified, comparing the fingerprint feature value to be identified with multiple pre-stored fingerprint feature values, such as fingerprint feature value 1, fingerprint feature value 2, and fingerprint feature value ... respectively, to obtain the fingerprint recognition result;

[0155] The fingerprint recognition module sends the fingerprint recognition result to the trusted authentication module. If the same fingerprint feature value exists, the fingerprint recognition result is that the fingerprint authentication is successful, which is used to indicate that the user's identity authentication is successful.

[0156] Continue as Figure 3 As shown, the method further includes:

[0157] Step 308: The trusted authentication module sends a fingerprint recognition request to the fingerprint recognition module.

[0158] Step 309: The user enters their fingerprint to be identified in order to authenticate their identity.

[0159] Step 310: The fingerprint recognition module recognizes the fingerprint to be recognized and sends the fingerprint recognition result to the trusted authentication module.

[0160] In one implementation, optionally, the SIM card signs the information to be signed based on a pre-stored user private key to obtain a first signature value, including:

[0161] The SIM card signs the information to be signed using the encryption algorithm hardware circuit and the pre-stored user private key to obtain a first signature value.

[0162] Continue as Figure 3 As shown, the method further includes:

[0163] Step 311: The trusted authentication module calls the authentication SDK to sign the information to be signed.

[0164] Step 312: The authentication SDK calls the hardware interface operation layer of the SIM card's card application to sign the information to be signed.

[0165] Step 313: The card application signs the information to be signed based on the user's private key to obtain the first signature value.

[0166] Step 314: The card application sends the first signature value to the authentication SDK.

[0167] It should be noted that the SIM card integrates encryption algorithm hardware circuitry and supports Chinese national cryptographic algorithms. Therefore, the encryption algorithm hardware circuitry can be referred to as the Chinese national cryptographic algorithm hardware circuitry. The Chinese national cryptographic algorithms supported by the SIM card are shown in Table 1 below.

[0168] Table 1: Examples of Chinese Cryptographic Algorithms

[0169] National Cryptographic Algorithm describe SM1 A symmetric key algorithm for encrypting and decrypting data. SM2 An Asymmetric Key Algorithm Based on Elliptic Curve Cryptography SM3 A cryptographic hash function for generating message digests. SM4 A symmetric key algorithm, also known as SMS4

[0170] The SIM card has a storage space where the availability status of the trusted authentication module, the user's public key, and the user's private key can be stored. Since the hardware space cannot be used directly, the SIM card provides a hardware interface operation layer. This layer provides an interface between the encryption algorithm hardware circuitry and the SIM card's storage space, allowing card applications to access it.

[0171] Furthermore, taking the SIM card's support for the SM2 national cryptographic algorithm as an example, a user public key and a user private key are generated according to SM2 and stored in the SIM card. A signature value is generated by signing according to SM2. A signature verification result is generated by verifying the signature according to SM2.

[0172] Figure 5 This is a flowchart illustrating a third implementation of the identity authentication method described in this application. Figure 5 As shown, the method includes:

[0173] First, the authentication SDK integrated into the trusted authentication module calls the signature interface in the SIM card's card application via the BIP channel, thereby invoking the encryption algorithm hardware circuit of the SIM card's hardware interface operation layer. Based on the user's private key pre-stored in the SIM card's storage space, the information to be signed is signed to obtain a first signature value. Then, the SIM card returns the first signature value and the identification information of the digital certificate to the authentication SDK integrated into the trusted authentication module.

[0174] Step 203: The trusted authentication module sends the first signature value and the identification information to the identity authentication server.

[0175] In one embodiment, optionally, before the trusted authentication module obtains the user's pending signature information for logging into the business system, the method further includes:

[0176] The trusted authentication module obtains the user information input by the user and sends the user information to the SIM card;

[0177] The SIM card signs the user information using the user's private key to obtain a second signature value, and then sends the second signature value to the trusted authentication module.

[0178] The trusted authentication module generates a CSR based on the user information, the pre-stored user public key, and the second signature value, and sends the CSR to the identity authentication server.

[0179] The trusted authentication module receives the digital certificate sent by the identity authentication server and sends the digital certificate to the SIM card;

[0180] The SIM card stores the digital certificate.

[0181] It should be noted that when a user opens the trusted authentication module and enters the certificate management page, they enter user information. This user information includes at least one of the following: mobile phone number, name, document type, and document number. The user information can be in message form, as shown in the following example:

[0182]

[0183] The trusted authentication module integrates authentication by calling the CSR signature interface of the SIM card, sending the user information to the SIM card, and the SIM card signs the user information according to the user's private key to obtain a second signature value. The SIM card then sends the second signature value to the trusted authentication module.

[0184] The trusted authentication module generates a CSR based on the user information, the user's public key, and the second signature value. The CSR can be in message form, and an example of a CSR message is as follows:

[0185]

[0186] Furthermore, the trusted authentication module retrieves the certificate application interface of the identity authentication server and sends the CSR to the identity authentication server.

[0187] Figure 6 This is a flowchart illustrating a fourth implementation of the identity authentication method described in this application. Figure 6 As shown, the method includes:

[0188] The identity authentication server signs the user information using the user's public key and the SM2 algorithm in the CSR to obtain a third signature value. The server then verifies the second signature value in the CSR using the third signature value. Specifically, the server compares the third signature value with the second signature value in the CSR. If the third signature value is the same as the second signature value, it means that the verification of the second signature value using the third signature value has passed.

[0189] Furthermore, if the identity authentication server verifies the second signature value in the CSR based on the third signature value, it calls the certificate application interface of the CA service. After verifying the information, the CA service signs the CSR using its own private key to obtain a signature value and generate a digital certificate. The CA service then returns the digital certificate to the identity authentication server. The identity authentication server stores the digital certificate and simultaneously sets its status to available in the database.

[0190] It should be noted that, in order to speed up the identity authentication process, the identity authentication server stores the digital certificate in both a cache and a database. When the identity authentication server retrieves the digital certificate based on its identifier information, it first searches for the digital certificate in the cache based on the identifier information. If the digital certificate is in the cache, it is retrieved directly. If the digital certificate is not in the cache, it searches for it in the database. This greatly speeds up the identity authentication process, transforming it from an I / O-intensive task into a computationally intensive task.

[0191] It should also be noted that when the status of the digital certificate is changed to unavailable in the database, the digital certificate in the cache needs to be deleted simultaneously.

[0192] The identity authentication server returns the digital certificate to the trusted authentication module, the trusted authentication module sends the digital certificate and the identification information of the digital certificate to the SIM card, and the SIM card stores the digital certificate and the identification information of the digital certificate in its storage space.

[0193] In one embodiment, optionally, before the trusted authentication module generates the CSR based on the user information, the pre-stored user public key, and the second signature value, the method further includes:

[0194] The SIM card generates a random number and sends the random number to the trusted authentication module through the Independent Bearer Protocol (BIP) channel.

[0195] The trusted authentication module encrypts the random number according to a preset key algorithm to obtain ciphertext, and sends the ciphertext to the SIM card;

[0196] The SIM card verifies the ciphertext. If the ciphertext verification is successful, it generates and stores the user's public key and the user's private key, and sends the user's public key to the trusted authentication module.

[0197] The trusted authentication module stores the user's public key.

[0198] In one implementation, optionally, the SIM card verifies the encrypted message, including:

[0199] The SIM card decrypts the ciphertext using a pre-stored key to obtain a first decryption result;

[0200] If the first decryption result is successful, the SIM card performs an availability status check on the trusted authentication module to obtain a status check result.

[0201] If the status verification result indicates that the status is available, the SIM card sends status availability information to the trusted authentication module.

[0202] In one embodiment, optionally, after the SIM card sends the user public key to the trusted authentication module, the method further includes:

[0203] The SIM card modifies the available status of the trusted authentication module to unavailable.

[0204] Figure 7 This is a flowchart illustrating a fifth implementation of the identity authentication method described in this application. Specifically, Figure 7 This diagram illustrates the process of generating a user's public and private keys through interaction between a trusted authentication module and a SIM card. The trusted authentication module integrates an authentication SDK, and the SIM card includes card applications. Figure 7 As shown, the method includes:

[0205] Step 701: The trusted authentication module calls the random number generation interface provided by the hardware interface operation layer of the SIM card through the BIP channel to obtain a random number.

[0206] Step 702: The SIM card generates a random number and returns the random number to the trusted authentication module.

[0207] Step 703: The trusted authentication module encrypts the random number according to a preset key algorithm, such as SM1, to obtain ciphertext.

[0208] Step 704: The trusted authentication module sends ciphertext to the SIM card.

[0209] Step 705: The SIM card calls the verification random number interface provided by the hardware interface operation layer, decrypts the ciphertext according to the key to obtain the first decryption result, and if the first decryption result is successful, that is, the ciphertext verification is passed, the available status of the trusted authentication module is set to available, and then the available status of the trusted module is verified to obtain the verification result.

[0210] Step 706: If the verification result indicates that the status is available, the SIM card returns the status availability information to the trusted authentication module and returns the first decryption result to the trusted authentication module.

[0211] Step 707: The trusted authentication module calls the public-private key pair generation interface provided by the hardware operation interface layer of the SIM card to obtain the public-private key pair, including the user's public key and user's private key.

[0212] Step 708: The SIM card generates a public-private key pair, including the user's public key and the user's private key, and stores the public-private key pair in the SIM card's storage space.

[0213] Step 709: The SIM card returns the user's public key to the trusted authentication module, which stores the user's public key.

[0214] Step 710: The trusted authentication module sends a request to the SIM card to close the BIP channel.

[0215] Step 711: The SIM card changes the available status of the trusted authentication module to unavailable based on the request to close the BIP channel.

[0216] Step 712: The SIM card returns a closed confirmation message to the trusted authentication module.

[0217] Figure 8 This is a schematic diagram illustrating the connection between the trusted authentication module and the SIM card described in an embodiment of this application. Figure 8 As shown, the trusted authentication module integrates an authentication SDK for obtaining the user's public key to generate a CSR. The SIM card includes a hardware interface operation layer and a storage space. The hardware interface operation layer integrates interfaces and encryption algorithm hardware circuitry. The interfaces include at least one of the following: a random number generation interface, a random number verification interface, an availability status modification interface, a public-private key pair generation interface, a CSR signing interface, and a certificate operation interface. The storage space stores the digital certificate's identification information, the availability status of the trusted authentication module, the digital certificate, the user's public key, and the user's private key.

[0218] To ensure the security of the aforementioned interfaces of the SIM card, it is necessary to verify whether the trusted authentication module has the authority to call the SIM card. The verification method is to use symmetric encryption to verify whether the trusted authentication module has the authority to call the interfaces of the SIM card.

[0219] Figure 9 This is a flowchart illustrating a sixth implementation of the identity authentication method described in this application. Specifically, Figure 9 A flowchart illustrating the process of applying for a digital certificate for a user. (For example...) Figure 9 As shown, the method includes:

[0220] Step 901: The user applies for a digital certificate from the trusted authentication module.

[0221] Step 902: The trusted authentication module applies for a digital certificate from the authentication SDK.

[0222] Step 903: The authentication SDK requests the card application of the SIM card to generate a public-private key pair.

[0223] Step 904: The card application returns the user's public key to the authentication SDK.

[0224] Step 905: The authentication SDK sends user information to the card application.

[0225] Step 906: The card application signs the user information based on the user's private key to obtain a second signature value, and returns the second signature value to the authentication SDK.

[0226] Step 907: The authentication SDK generates a CSR based on the user information, the user's public key, and the second signature value, and sends the CSR to the identity authentication server.

[0227] Step 908: The identity authentication server requests a digital certificate from the CA service.

[0228] Step 909: The CA service returns a digital certificate to the identity authentication server.

[0229] Step 910: The identity authentication server stores digital certificates in the cache and database.

[0230] Step 911: The identity authentication server sends a digital certificate to the authentication SDK.

[0231] Step 912: The authentication SDK sends a digital certificate to the card application, which stores the digital certificate in the SIM card storage space.

[0232] Please refer to Figure 10This application also provides an identity authentication method applied to an identity authentication server, wherein the identity authentication server pre-stores digital certificates of users, and the identity authentication server pre-stores digital certificates of multiple users, with one identity authentication server corresponding to multiple digital certificates.

[0233] Furthermore, the method includes:

[0234] Step 1001: Receive the first signature value and digital certificate identification information sent by the trusted authentication module in the client;

[0235] Step 1002: Obtain the digital certificate based on the identification information;

[0236] Step 1003: If the first signature value is verified successfully using the user's public key in the digital certificate, obtain the information to be signed and the user information in the digital certificate.

[0237] Step 1004: Send the encrypted user information and the encrypted information to be signed to the business server.

[0238] It should be noted that the identity authentication server encrypts the user information and the information to be signed using a pre-stored business public key to obtain a token, and then sends the token to the business server.

[0239] Figure 11 This is a flowchart illustrating an eighth implementation of the identity authentication method described in this application. Specifically, Figure 11 This is a flowchart illustrating the authentication process between the trusted authentication module, the identity authentication server, and the business server. Figure 11 As shown, the method includes:

[0240] The identity authentication server encrypts user information and the information to be signed using a pre-stored business public key to obtain a token. The identity authentication server sends the token to the business server. The business server receives the token, decrypts it using its business private key to obtain the information to be signed, and checks if the information exists in its database. If it does, the identity authentication is successful; otherwise, the authentication has timed out and the information has been deleted. Furthermore, if the information already exists, it is deleted, and the token, user information, and a record of the user's logged-in status are stored.

[0241] Next, the business front end polls the identity authentication server to call the token acquisition interface, passing in the information to be signed. Once the token is generated, the identity authentication server finds the token through the information to be signed and returns it to the business front end.

[0242] The business frontend calls the verification token interface of the business server. The business server checks if the token exists. If the token exists, it retrieves the user information. If the user is logged in, the login is successful. After receiving the user's successful login information, the business frontend sends a request to the business system homepage along with the token to complete the login process.

[0243] Continue as Figure 3 As shown, the method further includes:

[0244] Step 315: The authentication SDK sends the first signature value and the identification information of the digital certificate to the identity authentication server.

[0245] Step 316: The identity authentication server searches for the digital certificate, verifies the first signature value based on the user's public key in the digital certificate to obtain the information to be signed and the user information, generates a token based on the information to be signed and the user information, and sends the token and user information to the business server.

[0246] Step 317: The business server stores the token and user information.

[0247] Step 318: The business front end polls for the token generated by the identity authentication server.

[0248] Step 319: The identity authentication server returns a token to the business frontend.

[0249] Step 320: The business front-end calls the verification token interface of the business server.

[0250] Step 321: The business server verifies whether the token exists and checks the user information to confirm that the user is logged in.

[0251] Step 322: The business server returns a successful user login message to the business frontend.

[0252] At this point, the login page on the business front end has completed the login process, allowing users to enter the business system.

[0253] In one embodiment, optionally, before receiving the identification information of the digital certificate and the first signature value sent by the trusted authentication module in the client, the method further includes:

[0254] Receive the CSR sent by the trusted authentication module;

[0255] The user information is signed using the user's public key in the CSR to obtain a third signature value;

[0256] If the second signature value in the CSR is verified to be valid based on the third signature value, the digital certificate generated by the Certificate Authority (CA) service is obtained.

[0257] Send the digital certificate to the trusted authentication module.

[0258] In one embodiment, optionally, the method further includes:

[0259] The digital certificate is stored in both a cache and a database.

[0260] Obtaining the digital certificate based on the identification information includes:

[0261] The digital certificate is obtained from the cache and / or the database based on the identification information.

[0262] It should be noted that the digital certificate is first retrieved from the cache based on the identification information. If the digital certificate does not exist in the cache, it is retrieved from the database based on the identification information.

[0263] Figure 12 This is a flowchart illustrating implementation nine of the identity authentication method described in the embodiments of this application. Figure 12 As shown, the method includes:

[0264] Users enter the business system login page, select QR code login, enter the QR code page, use the trusted authentication module to scan the code, perform fingerprint recognition on the user, obtain the information to be signed, sign the information to be signed to obtain the first signature value, if the first signature value is verified, encrypt the information to be signed and the user information in the digital certificate to obtain a token, save the token, check if the token exists according to the information to be signed, if the token exists, retrieve the user information, if the user is in a logged-in state, the login is successful.

[0265] It should be noted that before accessing the identity authentication system described in this application embodiment, it is necessary to enter the business party information in the identity authentication management backend, generate the business party ID, and use it when calling the interface. At the same time, the asymmetric encryption algorithm used by the business party should be selected according to the requirements. The user information that can use the identity authentication system should be entered in the identity authentication management backend, and only specific users can use it.

[0266] In summary, the identity authentication method described in this application requires no additional hardware. The user's digital certificate is pre-stored in the SIM card and the identity authentication server. During user authentication, there is no need to transmit the digital certificate; the trusted authentication module only needs to obtain the identification information of the digital certificate stored in the SIM card and transmit it to the identity authentication server. The identity authentication server then authenticates the user based on the identification information, effectively reducing data transmission volume, saving authentication time and bandwidth usage, and thus improving authentication efficiency. The SIM card's BIP channel is used to call the capabilities provided by the SIM card, such as interfaces, which is simple, fast, and does not rely on SMS channels. After the digital certificate is issued, its status can be modified in the identity authentication management backend, enabling convenient management of the digital certificate while balancing security and efficiency. Furthermore, fingerprint recognition is used to authenticate the user's identity during the authentication process, ensuring that only the account holder can log in to the business system, improving system security. Fingerprint recognition also improves user convenience and security compared to password authentication. The encryption algorithm hardware circuit integrated into the SIM card is used during the encryption process to achieve hardware-level algorithm security protection.

[0267] Please refer to Figure 13 This application embodiment also provides a client, including a trusted authentication module 1301 and a SIM card 1302, wherein the SIM card pre-stores the user's digital certificate;

[0268] The trusted authentication module 1301 is used to obtain the pending signature information used by the user to log in to the business system and send the pending signature information to the SIM card 1302.

[0269] The SIM card 1302 is used to sign the information to be signed according to the pre-stored user private key to obtain a first signature value, and send the identification information of the digital certificate and the first signature value to the trusted authentication module 1301.

[0270] The trusted authentication module 1301 is also used to send the identification information of the digital certificate and the first signature value to the identity authentication server.

[0271] Optionally, the client, wherein,

[0272] The trusted authentication module 1301 is used to obtain the user information input by the user and send the user information to the SIM card 1302.

[0273] The SIM card 1302 is used to sign the user information according to the user's private key to obtain a second signature value, and send the second signature value to the trusted authentication module 1301.

[0274] The trusted authentication module 1301 is used to generate a certificate signing request (CSR) based on the user information, the pre-stored user public key, and the second signature value, and send the CSR to the identity authentication server.

[0275] The trusted authentication module 1301 is used to receive the digital certificate sent by the identity authentication server and send the digital certificate to the SIM card 1302;

[0276] The SIM card 1302 is used to store the digital certificate.

[0277] Optionally, the client, wherein,

[0278] The SIM card 1302 is used to generate random numbers and send the random numbers to the trusted authentication module 1301 through the independent bearer protocol BIP channel;

[0279] The trusted authentication module 1301 is used to encrypt the random number according to a preset key algorithm to obtain ciphertext, and send the ciphertext to the SIM card 1302;

[0280] The SIM card 1302 is used to verify the ciphertext. If the ciphertext verification is successful, it generates and stores the user's public key and the user's private key, and sends the user's public key to the trusted authentication module 1301.

[0281] The trusted authentication module 1301 is used to store the user's public key.

[0282] Optionally, the client, wherein,

[0283] The SIM card 1302 is used to decrypt the ciphertext according to the encryption algorithm hardware circuit and the pre-stored key to obtain a first decryption result;

[0284] The SIM card 1302 is used to perform an availability status check on the trusted authentication module 1301 and obtain a status check result when the first decryption result is successful.

[0285] The SIM card 1302 is used to send status availability information to the trusted authentication module 1301 when the status verification result is that the status is available.

[0286] Optionally, the client, wherein,

[0287] The SIM card 1302 is used to change the available status of the trusted authentication module 1301 to unavailable.

[0288] Optionally, the client further includes a fingerprint recognition module, which pre-stores the user's fingerprint feature values;

[0289] The trusted authentication module 1301 is used to send a fingerprint recognition request to the fingerprint recognition module;

[0290] The fingerprint recognition module is used to perform fingerprint recognition on the user based on the fingerprint feature value and the fingerprint recognition request, obtain the fingerprint recognition result, and send the fingerprint recognition result to the trusted authentication module 1301.

[0291] The trusted authentication module 1301 is used to send the pending signature information to the SIM card 1302, including:

[0292] The trusted authentication module 1301 is used to send the pending signature information to the SIM card 1302 when the fingerprint recognition result indicates that the fingerprint authentication is successful.

[0293] Optionally, the client, wherein,

[0294] The SIM card 1302 is used to sign the information to be signed based on the encryption algorithm hardware circuit and the pre-stored user private key to obtain a first signature value.

[0295] Please refer to Figure 14 This application embodiment also provides an identity authentication server, wherein the identity authentication server pre-stores the user's digital certificate, including:

[0296] The first receiving module 1401 is used to receive the identification information and first signature value of the digital certificate sent by the trusted authentication module in the client;

[0297] The first acquisition module 1402 is used to acquire the digital certificate based on the identification information;

[0298] The first obtaining module 1403 is used to obtain user information and pending signature information in the digital certificate when the first signature value is verified and passed according to the user public key in the digital certificate.

[0299] The first sending module 1404 is used to send the encrypted user information and the encrypted information to be signed to the business server.

[0300] Optionally, the identity authentication server further includes:

[0301] The second receiving module is used to receive the CSR sent by the trusted authentication module;

[0302] The second obtaining module is used to sign the user information based on the user's public key in the CSR to obtain a third signature value;

[0303] The second acquisition module is used to acquire the digital certificate generated by the Certificate Authority (CA) service if the second signature value in the CSR is verified and passed according to the third signature value.

[0304] The second sending module is used to send the digital certificate to the trusted authentication module.

[0305] Optionally, the identity authentication server further includes:

[0306] A storage module is used to store the digital certificate in a cache and a database, respectively;

[0307] The first acquisition module 1402 is specifically used for:

[0308] The digital certificate is obtained from the cache and / or the database based on the identification information.

[0309] This application also provides an identity authentication device, such as... Figure 15 As shown, it includes:

[0310] The processor 1501, memory 1502, transceiver 1503, and a program or instructions stored in the memory 1502 and executable on the processor 1501; when the processor 1501 executes the program or instructions, it implements the various processes of the above-described identity authentication method embodiments and achieves the same technical effect. To avoid repetition, these will not be described again here.

[0311] The transceiver 1503 is used to receive and send data under the control of the processor 1501.

[0312] Among them, Figure 15 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically connecting various circuits of one or more processors represented by processor 1501 and memory represented by memory 1502. The bus architecture can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 1503 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. For different user equipment, the user interface 1504 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0313] Processor 1501 is responsible for managing the bus architecture and general processing, while memory 1502 can store the data used by processor 1501 when performing operations.

[0314] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described identity authentication method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0315] This application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the above-described identity authentication method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0316] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0317] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0318] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An identity authentication method, characterized in that, Applied to a client, the client includes a trusted authentication module and a user identification module (SIM card), wherein the SIM card pre-stores the user's digital certificate, and the method includes: The trusted authentication module obtains the pending signature information used by the user to log in to the business system and sends the pending signature information to the SIM card; The SIM card signs the information to be signed according to the pre-stored user private key to obtain a first signature value, and sends the first signature value and the identification information of the digital certificate to the trusted authentication module; The trusted authentication module sends the first signature value and the identification information to the identity authentication server.

2. The identity authentication method according to claim 1, characterized in that, Before the trusted authentication module obtains the user's pending signature information for logging into the business system, the method further includes: The trusted authentication module obtains the user information input by the user and sends the user information to the SIM card; The SIM card signs the user information using the user's private key to obtain a second signature value, and then sends the second signature value to the trusted authentication module. The trusted authentication module generates a Certificate Signing Request (CSR) based on the user information, the pre-stored user public key, and the second signature value, and sends the CSR to the identity authentication server. The trusted authentication module receives the digital certificate sent by the identity authentication server and sends the digital certificate to the SIM card; The SIM card stores the digital certificate.

3. The identity authentication method according to claim 2, characterized in that, Before the trusted authentication module generates the CSR based on the user information, the pre-stored user public key, and the second signature value, the method further includes: The SIM card generates a random number and sends the random number to the trusted authentication module through the Independent Bearer Protocol (BIP) channel. The trusted authentication module encrypts the random number according to a preset key algorithm to obtain ciphertext, and sends the ciphertext to the SIM card; The SIM card verifies the ciphertext. If the ciphertext verification is successful, it generates and stores the user's public key and the user's private key, and sends the user's public key to the trusted authentication module. The trusted authentication module stores the user's public key.

4. The identity authentication method according to claim 3, characterized in that, The SIM card verifies the encrypted message, including: The SIM card decrypts the ciphertext using the encryption algorithm hardware circuit and the pre-stored key to obtain a first decryption result; If the first decryption result is successful, the SIM card performs an availability status check on the trusted authentication module to obtain a status check result. If the status verification result indicates that the status is available, the SIM card sends status availability information to the trusted authentication module.

5. The authentication method according to any one of claims 3 or 4, characterized in that, After the SIM card sends the user's public key to the trusted authentication module, the method further includes: The SIM card modifies the available status of the trusted authentication module to unavailable.

6. The identity authentication method according to claim 1, characterized in that, The client also includes a fingerprint recognition module, which pre-stores the user's fingerprint feature values; After the trusted authentication module obtains the user's pending signature information for logging into the business system, the method further includes: The trusted authentication module sends a fingerprint recognition request to the fingerprint recognition module; The fingerprint recognition module performs fingerprint recognition on the user based on the fingerprint feature value and the fingerprint recognition request, obtains the fingerprint recognition result, and sends the fingerprint recognition result to the trusted authentication module; The trusted authentication module sends the pending signature information to the SIM card, including: When the trusted authentication module receives a fingerprint recognition result indicating that the fingerprint authentication is successful, it sends the pending signature information to the SIM card.

7. The identity authentication method according to claim 1, characterized in that, The SIM card signs the information to be signed using a pre-stored user private key to obtain a first signature value, including: The SIM card signs the information to be signed using the encryption algorithm hardware circuit and the pre-stored user private key to obtain a first signature value.

8. An identity authentication method, characterized in that, Applied to an identity authentication server, wherein the identity authentication server pre-stores the user's digital certificate, the method includes: Receive the first signature value and digital certificate identification information sent by the trusted authentication module in the client; Obtain the digital certificate based on the identification information; If the first signature value is verified successfully using the user's public key in the digital certificate, the information to be signed and the user information in the digital certificate are obtained. The encrypted user information and the encrypted information to be signed are sent to the business server.

9. The identity authentication method according to claim 8, characterized in that, Before receiving the digital certificate identification information and first signature value sent by the trusted authentication module in the client, the method further includes: Receive the CSR sent by the trusted authentication module; The user information is signed using the user's public key in the CSR to obtain a third signature value; If the second signature value in the CSR is verified to be valid based on the third signature value, the digital certificate generated by the Certificate Authority (CA) service is obtained. Send the digital certificate to the trusted authentication module.

10. The identity authentication method according to claim 9, characterized in that, The method further includes: The digital certificate is stored in both a cache and a database. Obtaining the digital certificate based on the identification information includes: The digital certificate is obtained from the cache and / or the database based on the identification information.

11. An identity authentication system, characterized in that, include: The system includes a client, an identity authentication server, and a business server. The client includes a trusted authentication module and a SIM card. The SIM card and the identity authentication server pre-store the user's digital certificate. The trusted authentication module is used to obtain the pending signature information used by the user to log in to the business system and send the pending signature information to the SIM card; The SIM card is used to sign the information to be signed according to the pre-stored user private key to obtain a first signature value, and send the first signature value and the identification information of the digital certificate to the trusted authentication module. The trusted authentication module is used to send the first signature value and the identification information to the identity authentication server; The identity authentication server is configured to receive the first signature value and the identification information, obtain the digital certificate based on the identification information, and, if the first signature value is verified successfully using the user's public key in the digital certificate, obtain the user information and the information to be signed in the digital certificate, and send the encrypted user information and the encrypted information to be signed to the business server. The business server is used to determine whether to allow a user to log in to the business system based on the encrypted user information and the encrypted pending signature information.

12. The identity authentication system according to claim 11, characterized in that, The trusted authentication module is also used to obtain the user information input by the user and send the user information to the SIM card; The SIM card is also used to sign the user information according to the user's private key to obtain a second signature value, and send the second signature value to the trusted authentication module; The trusted authentication module is also used to generate a CSR based on the user information, the pre-stored user public key and the second signature value, and send the CSR to the identity authentication server; The identity authentication server is also used to receive the CSR sent by the trusted authentication module, sign the user information according to the user public key in the CSR to obtain a third signature value, and if the second signature value is verified by the third signature value, obtain the digital certificate generated by the CA service and send the digital certificate to the trusted authentication module. The trusted authentication module is also used to send the digital certificate to the SIM card; The SIM card is used to store the digital certificate.

13. The identity authentication system according to any one of claims 11 or 12, characterized in that, The identity authentication server is also used to store the digital certificate in a cache and a database, respectively; and, The digital certificate is obtained from the cache and / or the database based on the identification information.

14. A client, characterized in that, It includes a trusted authentication module and a SIM card, wherein the SIM card contains the user's digital certificate; The trusted authentication module is used to obtain the pending signature information used by the user to log in to the business system and send the pending signature information to the SIM card; The SIM card is used to sign the information to be signed according to the pre-stored user private key to obtain a first signature value, and send the first signature value and the identification information of the digital certificate to the trusted authentication module. The trusted authentication module is also used to send the first signature value and the identification information to the identity authentication server.

15. An identity authentication server, characterized in that, The identity authentication server pre-stores the user's digital certificate, including: The first receiving module is used to receive the first signature value and the identification information of the digital certificate sent by the trusted authentication module in the client; The first acquisition module is used to acquire the digital certificate based on the identification information; The first obtaining module is used to obtain the information to be signed and the user information in the digital certificate when the first signature value is verified and passed according to the user's public key in the digital certificate. The first sending module is used to send the encrypted user information and the encrypted information to be signed to the business server.

16. An identity authentication device, characterized in that, include: A processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the processor, when executing the program or instructions, implements the authentication method as described in any one of claims 1 to 7, or implements the authentication method as described in any one of claims 8 to 10.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the authentication method as described in any one of claims 1 to 7, or implements the authentication method as described in any one of claims 8 to 10.

18. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the authentication method as described in any one of claims 1 to 7, or implement the authentication method as described in any one of claims 8 to 10.

Images