User identity authentication method and device, equipment, storage medium and program product

Abstract

A user identity authentication method, device, equipment, storage medium and program product are disclosed, the method comprising: receiving a wake-up request sent by an authentication platform; wherein the wake-up request is used to wake up a SIM card application built-in in a terminal device; the wake-up request is triggered by the authentication platform after receiving an indication of a user's real-name authentication authorization confirmation for a service platform; generating a first identity identifier through the SIM card application according to the user's identity information; sending the first identity identifier to the authentication platform, so that the authentication platform performs identity authentication according to the first identity identifier and a second identity identifier. The present application does not need to transmit the original identity information of the user to the authentication platform for identity authentication, can realize real-name authentication without data out-of-warehouse, thereby effectively reducing the risk of information leakage and forgery and improving the security of identity authentication.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a user authentication method, apparatus, device, storage medium, and program product. Background Technology

[0002] Real-name authentication is a necessary prerequisite and basic management requirement for network services such as instant messaging. Currently, existing real-name authentication methods are mainly divided into the following categories according to different application scenarios and security requirements: (1) comparison authentication based on name + ID number; (2) face recognition authentication based on facial recognition technology; (3) bank card authentication; (4) multi-factor authentication combining mobile phone number + ID card + bank card + facial recognition and other multiple authentication methods.

[0003] However, in existing real-name authentication methods, personal identity information data, such as names, phone numbers, and ID card numbers, is widely transmitted and stored. These data are often required to be entered or provided in different systems. This information may be collected and stored by applications or systems of multiple companies, which can easily lead to the leakage of identity information. Summary of the Invention

[0004] To address the problems existing in the prior art, embodiments of the present invention provide a user identity authentication method, apparatus, device, storage medium, and program product, which can achieve real-name authentication without data leaving the database, effectively reducing the risk of information leakage and forgery, and improving the security of identity authentication.

[0005] In a first aspect, embodiments of the present invention provide a user authentication method, applied to a terminal device, comprising: The system receives a wake-up request from the authentication platform; wherein the wake-up request is used to activate the SIM card application built into the terminal device; the wake-up request is triggered by the authentication platform after receiving an instruction from the user to confirm the real-name authentication authorization of the business platform. Based on the user's identity information, a first identity identifier is generated through the SIM card application; The first identity identifier is sent to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0006] As an improvement to the above solution, the step of generating a first identity identifier through the SIM card application based on the user's identity information includes: The SIM card application uses a multi-factor dynamic obfuscation strategy to encrypt the pre-stored security elements and identity information of the user, thereby generating the first identity identifier. The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

[0007] As an improvement to the above solution, the step of encrypting the pre-stored security elements and identity information of the user by applying a multi-factor dynamic obfuscation strategy to the SIM card application to generate the first identity identifier includes: The user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable are encrypted using a preset message authentication code algorithm to obtain a first hash value; wherein, the time window variable is determined based on the current timestamp and the preset time window. Perform a hash calculation on the user's name to obtain a second hash value; The first hash value and the second hash value are dynamically obfuscated to generate the first identity identifier.

[0008] As an improvement to the above scheme, the application uses a preset message authentication code algorithm to encrypt the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable to obtain a first hash value, including: Hash calculations are performed on the user's identity code and communication number respectively to obtain a third hash value corresponding to the identity code and a fourth hash value corresponding to the communication number; The third hash value, the fourth hash value, the device binding factor, and the time window variable are concatenated to obtain the first authentication information. The initial seed of the dynamic salt is dynamically updated to generate a dynamic salt value; The message authentication code algorithm is applied to encrypt the dynamic salt value and the first information to be authenticated to obtain the first hash value.

[0009] As an improvement to the above scheme, the step of dynamically obfuscating the first hash value and the second hash value to generate the first identity identifier includes: The first hash value is truncated to obtain a basic obfuscation value with a set number of bits; Perform a circular left shift operation on the base obfuscation value to obtain the fifth hash value; Perform a circular right shift operation on the second hash value to obtain the sixth hash value; Calculate the dynamic random time value based on the time window variable and the first random number; The first identity identifier is generated by summing and moduloing the fifth hash value, the sixth hash value, and the dynamic random time value.

[0010] As an improvement to the above scheme, the step of dynamically updating the initial seed of the dynamic salt to generate a dynamic salt value includes: Based on the device binding factor and the time window variable, the initial seed of the dynamic salt is updated through the key derivation function to obtain the dynamic salt value.

[0011] As an improvement to the above scheme, the second identity identifier is generated by the communication service platform by encrypting the user's security elements and identity information stored in the local database using a multi-factor dynamic obfuscation strategy.

[0012] As an improvement to the above solution, the method further includes: During the initial user network access phase, a data write request is received from the communication service platform; The user's identity information and security elements carried in the data write request are written into the storage space of the SIM card application.

[0013] As an improvement to the above scheme, the dynamic salt initial seed in the security element is a second random number generated by the communication service platform based on a cryptographically secure random number generator; The device binding factor in the security elements is generated by the communication service platform by reading the device identifier of the SIM card of the terminal device.

[0014] As an improvement to the above solution, the method further includes: Receive the authentication result sent by the authentication platform; The authentication result is obtained by the authentication platform by comparing the first identity identifier with the second identity identifier; when the first identity identifier and the second identity identifier are consistent, the authentication result is successful; when the first identity identifier and the second identity identifier are inconsistent, the authentication result is unsuccessful.

[0015] Secondly, embodiments of the present invention provide a user authentication method, applied to a communication service platform, comprising: The authentication platform receives an identifier generation request; wherein the identifier generation request is sent by the authentication platform after receiving the first identity identifier sent by the terminal device, and the identifier generation request carries the user's communication number; The system queries the local database to retrieve the corresponding user's identity information and security details based on the communication number. Based on the retrieved identity information and security elements, a second identity identifier is generated and sent to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0016] As an improvement to the above solution, the step of generating a second identity identifier based on the retrieved identity information and security elements includes: A multi-factor dynamic obfuscation strategy is applied to encrypt the queried security elements and identity information to generate the second identity identifier; The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

[0017] Thirdly, embodiments of the present invention provide a user authentication device, applied to a terminal device, comprising: The first request receiving module is used to receive a wake-up request sent by the authentication platform; wherein, the wake-up request is used to wake up the SIM card application built into the terminal device; the wake-up request is triggered by the authentication platform after receiving the user's instruction to confirm the real-name authentication authorization of the business platform; The first identifier generation module is used to generate a first identity identifier through the SIM card application based on the user's identity information; The first identifier sending module is used to send the first identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0018] Fourthly, embodiments of the present invention provide a user authentication device applied to a communication service platform, comprising: The second request receiving module is used to receive an identifier generation request sent by the authentication platform; wherein, the identifier generation request is sent by the authentication platform after receiving the first identity identifier sent by the terminal device, and the identifier generation request carries the user's communication number; The information query module is used to query the identity information and security elements of the corresponding user stored in the local database based on the communication number; The second identifier sending module is used to generate a second identity identifier based on the queried identity information and security elements, and send the second identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0019] Fifthly, embodiments of the present invention provide a user authentication device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement a user authentication method as described in any one of the first aspects or a user authentication method as described in any one of the second aspects.

[0020] In a sixth aspect, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a user authentication method as described in any one of the first aspects or a user authentication method as described in any one of the second aspects.

[0021] In a seventh aspect, embodiments of the present invention provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the user authentication method as described in any one of the first aspects or the user authentication method as described in any one of the second aspects.

[0022] Compared to existing technologies, this invention provides a user authentication method, apparatus, device, storage medium, and program product that receives a wake-up request sent by an authentication platform. The wake-up request is used to activate a SIM card application built into a terminal device. The wake-up request is triggered by the authentication platform after receiving an instruction from a user confirming real-name authentication authorization to the service platform. Then, based on the user's identity information, a first identity identifier is generated through the SIM card application. The first identity identifier is then sent to the authentication platform, enabling the authentication platform to perform identity authentication based on the first identity identifier and a second identity identifier. In this invention, there is no need to transmit the user's original identity information to the authentication platform for authentication, enabling real-name authentication to be completed without data leaving the database. This effectively reduces the risk of information leakage and forgery, and improves the security of identity authentication. Attached Figure Description

[0023] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a user authentication method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the network access card writing process provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the overall process of real-name authentication provided in the embodiments of the present invention; Figure 4 This is a schematic diagram of the interactive interface for pop-up authorization provided in an embodiment of the present invention; Figure 5 This is another flowchart of a user authentication method provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of a user authentication device provided in an embodiment of the present invention; Figure 7 This is another structural block diagram of a user authentication device provided in an embodiment of the present invention; Figure 8 This is a structural block diagram of a user identity authentication device provided in an embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] It is understood that the various numerical designations used in the embodiments of this invention are merely for descriptive convenience and are not intended to limit the scope of this application. The order of the process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.

[0027] In embodiments of the invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element. The term "a plurality or several" refers to two or more.

[0028] The following explains some terms and concepts involved in the embodiments of the present invention.

[0029] Terminal equipment, also known as user equipment (UE) or a terminal, is a mobile or fixed device with wireless transceiver capabilities. Terminal equipment can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on water (such as on ships); and it can be deployed in the air (e.g., on airplanes, balloons, and satellites). The terminal equipment can be a mobile phone, tablet computer, computer with wireless transceiver capabilities, virtual reality (VR) terminal device, augmented reality (AR) terminal device, wireless terminal device for industrial control, wireless terminal device for autonomous driving, wireless terminal device for telemedicine, wireless terminal device for smart grids, wireless terminal device for transportation safety, wireless terminal device for smart cities, and / or wireless terminal device for smart homes. The terminal device may also be a cellular phone, cordless phone, Session Initiation Protocol (SIP) phone, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA), handheld device or computing device with wireless communication function, vehicle-mounted device, wearable device, terminal device in the future 5th Generation (5G) network, or terminal device in the future evolved Public Land Mobile Network (PLMN), etc., and is not specifically limited in this embodiment of the invention.

[0030] Please see Figure 1 , Figure 1 This is a flowchart of a user authentication method provided in an embodiment of the present invention. The user authentication method is applied to a terminal device and includes: S11: Receive a wake-up request sent by the authentication platform; wherein the wake-up request is used to wake up the SIM card application built into the terminal device; the wake-up request is triggered by the authentication platform after receiving the user's instruction to confirm the real-name authentication authorization of the business platform; In this embodiment of the invention, the terminal device is equipped with a SIM (Subscriber Identification Module) card and a pre-installed SIM card application (also known as a SIM card app). This SIM card application is an application developed based on the functions of the SIM card (such as user identification, network authentication, SMS data sending and receiving interface management, etc.) and stored in the SIM card for identity authentication.

[0031] For example, when a user accesses the business platform through a terminal device, the business platform will require the user to authenticate their identity and display a real-name authentication authorization window in the terminal device's interface, prompting the user to agree to the authentication. The business platform can be a financial system, e-commerce platform, public service platform, etc., and this embodiment of the invention does not impose specific limitations.

[0032] After the user clicks / touches the control indicating confirmation in the real-name authentication authorization window, the user confirms that the user authorizes the service platform to perform real-name authentication. Then, the terminal device obtains the terminal device's current communication number (such as a mobile phone number) under the GPRS (General Packet Radio Service) network traffic environment and sends an instruction to the authentication platform instructing the user to confirm the authorization of the service platform to perform real-name authentication. This instruction carries the terminal device's communication number.

[0033] The authentication platform sends a wake-up request to the terminal device via the SIM platform based on the received communication number, which is used to activate the SIM card application built into the terminal device to perform the user identity authentication process.

[0034] S12: Generate a first identity identifier through the SIM card application based on the user's identity information; The SIM card's storage space pre-stores the user's identity information, including: identification code (such as ID card number), name, and communication number (optional). The user's identification code and name are encrypted using national cryptographic standards and then stored in the SIM card's storage space.

[0035] After the SIM card application is invoked, a window pops up on the terminal device's interface, asking the user whether they agree to authorize the service platform to use the user's identity code and name for real-name authentication. When the user clicks / touches the confirmation control in the SIM card application window, it confirms the user's agreement to real-name authentication and initiates the real-name authentication process. The SIM card application reads the user's identity information stored in the local storage space to generate a first identity identifier. When the user clicks / touches the cancellation control in the SIM card application window, it confirms the user's disagreement to real-name authentication, the real-name authentication process ends, and the user is returned to the service platform's real-name authentication authorization window, which displays a message indicating that real-name authentication failed.

[0036] S13: Send the first identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0037] The second identity identifier is requested by the authentication platform from the communication service platform after receiving the first identity identifier.

[0038] Furthermore, the method also includes: Receive the authentication result sent by the authentication platform; The authentication result is obtained by the authentication platform by comparing the first identity identifier with the second identity identifier; when the first identity identifier and the second identity identifier are consistent, the authentication result is successful; when the first identity identifier and the second identity identifier are inconsistent, the authentication result is unsuccessful.

[0039] If a user agrees to real-name authentication, a first identity identifier will be generated based on the user's identity information and sent to the authentication platform. The authentication platform will then perform identity authentication by comparing this first identity identifier with a second identity identifier sent by the communication service platform (such as the operator's system). For example, it will compare whether the first identity identifier and the second identity identifier sent by the communication service platform are the same. The second identity identifier is generated by the communication service platform based on the corresponding user's identity information stored in its local database. If they are the same, the identity authentication is successful; otherwise, the identity authentication fails, and the user will be notified of the success / failure authentication result in the real-name authentication authorization window of the business platform.

[0040] In this embodiment of the invention, during the user real-name authentication process, both the terminal device and the operator system only need to provide the authentication platform with the identity identifier generated through encrypted authentication, without transmitting the user's original identity information (such as the three elements of identity code, communication number, and name) to the business platform and authentication platform. This avoids the problem of user personal information being transmitted and stored by multiple parties. For the data source side of the operator system, real-name authentication can be completed without data leaving the database. That is, it is possible to verify whether the mobile phone number + name + ID card number of the person to be verified is consistent with the actual person who registered on the network without transmitting the ID card number and mobile phone number. Users do not need to enter identity information on the business platform. It is simple and easy to use, effectively reduces the risk of information leakage and forgery, and improves the security of identity authentication.

[0041] In an optional embodiment, S12: Based on the user's identity information, a first identity identifier is generated through the SIM card application, including: The SIM card application uses a multi-factor dynamic obfuscation strategy to encrypt the pre-stored security elements and identity information of the user, thereby generating the first identity identifier. The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

[0042] Furthermore, the second identity identifier is generated by the communication service platform by encrypting the user's security elements and identity information stored in the local database using a multi-factor dynamic obfuscation strategy.

[0043] In this embodiment of the invention, the SIM card application employs a multi-factor dynamic obfuscation strategy. It combines the user's pre-stored dynamic salt initial seed, device binding factor, and other security elements, along with the user's name, identification code, and communication number, to generate a first identity identifier for the user. Similarly, the communication service platform also employs a multi-factor dynamic obfuscation strategy, combining the user's pre-stored dynamic salt initial seed, device binding factor, and other security elements, along with the user's name, identification code, and communication number, to generate a second identity identifier for the user. The authentication platform completes identity authentication by comparing the first identity identifier generated by the SIM card application with the second identity identifier generated by the communication service platform. On one hand, using a multi-factor dynamic obfuscation strategy to generate the user's identity identifier can prevent reverse engineering and attacks; on the other hand, the dual verification by the SIM card application and the communication service platform (i.e., the operator's data source) can ensure the reliability of authentication. Furthermore, in this embodiment of the invention, the introduction of a device binding factor during the identity authentication process ensures that even if the phone number is leaked, different devices cannot generate the same identity identifier, preventing SIM card cloning.

[0044] It should be noted that the principle and process of generating identity identifiers using the multi-factor dynamic obfuscation strategy are the same for SIM card applications and communication service platforms. To avoid duplication, the following text takes the generation of the first identity identifier using the multi-factor dynamic obfuscation strategy of SIM card applications as an example to explain the identity identifier generation process in detail.

[0045] Specifically, the step of encrypting the pre-stored security elements and identity information of the user through the application of a multi-factor dynamic obfuscation strategy on the SIM card to generate the first identity identifier includes: The user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable are encrypted using a preset message authentication code algorithm to obtain a first hash value; wherein, the time window variable is determined based on the current timestamp and the preset time window. Perform a hash calculation on the user's name to obtain a second hash value; The first hash value and the second hash value are dynamically obfuscated to generate the first identity identifier.

[0046] In this embodiment of the invention, the multi-factor dynamic obfuscation strategy mainly includes two stages. The first stage is the basic obfuscation layer, which introduces a time window variable determined based on the current timestamp and a preset time window, as well as the identity code, communication number, dynamic salt initial seed, and device binding factor pre-stored in the local storage space. A preset message authentication code algorithm is used to calculate the hash value to obtain the first hash value (i.e., the intermediate token). The second stage is the dynamic output layer, which uses the first hash value output by the basic obfuscation layer as the obfuscation basis and combines it with the second hash value of the user's name to perform dynamic obfuscation and generate a fixed-length verification code as the user's first identity identifier.

[0047] This invention utilizes the user's three key personal information elements—phone number, name, and ID number—as computational variables. Simultaneously, it introduces multi-factor dynamic obfuscation variables such as device binding factor, time window variable, salt value obfuscation, and hierarchical hashing, significantly enhancing security, privacy, and resistance to attacks. Furthermore, the multi-factor dynamic obfuscation strategy employs a hierarchical structure, divided into two stages, ensuring both high strength and flexibility.

[0048] Specifically, the application's preset message authentication code algorithm encrypts the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable to obtain a first hash value, including: Hash calculations are performed on the user's identity code and communication number respectively to obtain a third hash value corresponding to the identity code and a fourth hash value corresponding to the communication number; The third hash value, the fourth hash value, the device binding factor, and the time window variable are concatenated to obtain the first authentication information. The initial seed of the dynamic salt is dynamically updated to generate a dynamic salt value; The message authentication code algorithm is applied to encrypt the dynamic salt value and the first information to be authenticated to obtain the first hash value.

[0049] In the first stage of the multi-factor dynamic obfuscation strategy, the specific process for calculating the first hash value is as follows: (1); Here, Token represents the first hash value output in the first phase.

[0050] HMAC-SHA256 represents a message authentication code algorithm based on SHA-256. The SHA-256 algorithm can provide message authentication and integrity protection. HMAC provides key-dependent authentication to prevent reverse engineering of the formula.

[0051] K-SALT stands for Dynamic Salt Value. The Dynamic Salt Value K-SALT is dynamically updated before the intermediate token is generated by the base obfuscation layer. Specifically, it is obtained by dynamically updating the locally pre-stored dynamic salt initial seed through the key derivation function.

[0052] D stands for Device Binding Factor, which is the SHA-256 hash value of the device's unique identifier (such as the SIM card's ICCID). By introducing the Device Binding Factor, SIM card cloning attacks can be prevented. Even if the phone number is leaked, different devices can generate different identity identifiers because the Device Binding Factors are different for different devices.

[0053] I represents the SHA-256 hash value of the identity identifier, i.e., the third hash value.

[0054] P is the SHA-256 hash value of the communication number, i.e., the fourth hash value.

[0055] Q(T) is a time window variable, obtained by mapping the current timestamp T to a fixed window (e.g., 30 seconds). The specific calculation formula is as follows: Where W is the preset time window size (configurable). This indicates rounding down to the nearest integer.

[0056] This indicates a splicing operation.

[0057] The above calculations yield a 256-bit hash value (Token), which serves as the first hash value output from the first stage and is input into the second stage of the multi-factor dynamic obfuscation strategy. The HMAC-SHA256 algorithm is used in the first stage of the multi-factor dynamic obfuscation strategy to prevent reverse engineering and attacks. The introduction of dynamic factors such as dynamic salt values ​​and time window variables significantly enhances security, privacy, and resistance to attacks. Furthermore, the inclusion of a device binding factor ensures that even if a phone number is leaked, different devices can generate different identifiers due to their different device binding factors, preventing SIM card cloning attacks or cross-device impersonation.

[0058] Furthermore, the initial seed of the dynamic salt is dynamically updated to generate a dynamic salt value, including: Based on the device binding factor and the time window variable, the initial seed of the dynamic salt is updated through the key derivation function to obtain the dynamic salt value.

[0059] For example, through derived functions The current dynamic salt value K-SALT is dynamically generated so that the dynamic salt value is different each time the intermediate token is generated.

[0060] KDF is the key derivation function; K-SALT_SEED is the dynamic salt initial seed, which is generated by the communication service platform when the user first joins the network and written into the SIM card and the local database of the communication service platform, so that the SIM card application and the communication service platform share the initial seed.

[0061] In this embodiment of the invention, by introducing dynamic salt values ​​and time window variables, the calculation results in the first stage are different each time, effectively preventing data leakage and the derivation of plaintext information.

[0062] Specifically, the step of dynamically obfuscating the first hash value and the second hash value to generate the first identity identifier includes: The first hash value is truncated to obtain a basic obfuscation value with a set number of bits; Perform a circular left shift operation on the base obfuscation value to obtain the fifth hash value; Perform a circular right shift operation on the second hash value to obtain the sixth hash value; Calculate the dynamic random time value based on the time window variable and the first random number; The first identity identifier is generated by summing and moduloing the fifth hash value, the sixth hash value, and the dynamic random time value.

[0063] In the second stage of the multi-factor dynamic obfuscation strategy, the specific process for calculating the first identity is as follows: (2); Token0:m represents the base obfuscation value, which is the first m+1 bits of the first hash value Token. For example, in this embodiment of the invention, the first 31 bits (bits 0-31, i.e., 4 bytes) of the first hash value Toke are taken as the obfuscation base. At this time, the base obfuscation value = Token0:31.

[0064] rotl(Token0: m, n1) represents a circular left shift operation, which shifts the basic obfuscation value Token0: m to the left by n1 bits and wraps around the overflow bit, adding non-linearity to obtain the fifth hash value. For example, in this embodiment of the invention, the basic obfuscation value Token0: 31 is shifted to the left by 5 bits to obtain the fifth hash value rotl(Token0: 31, 5).

[0065] `rotr(N, n2)` represents a circular right shift operation, shifting N to the right by n2 bits and wrapping around the overflow bit to add non-linearity, resulting in the sixth hash value. N is the SHA-256 hash value of the user's name. For example, in this embodiment of the invention, the SHA-256 hash value N of the name is shifted to the left by 2 bits to obtain the fifth hash value `rotr(N, 2)`.

[0066] R is the first random number, a dynamically generated random number based on K-SAL (Keyed Secure Authenticated Link), ensuring that the multiplier is unpredictable. For example, R = (K-SAL%11) + 5.

[0067] K is a preset constant, such as K=10000000, used to control the length of the first identity identifier output in the second stage.

[0068] In the second stage of the multi-factor dynamic obfuscation strategy, the first hash value output by the basic obfuscation layer is used as the obfuscation basis. Combined with the second hash value of the user's name, a double nesting of the device binding factor and the user's name can be formed. This avoids the problem of a single factor being forged and increases the risk of identity verification being reverse-engineered. At the same time, a time window variable and a first random number are introduced for dynamic obfuscation to generate a fixed-length identity, which can enhance the timeliness and unpredictability of the identity. In addition, the fixed-length identity can be uniformly adapted to various authentication interfaces and storage systems, avoiding parsing errors or storage redundancy caused by dynamic length changes, and facilitating hardware-level encrypted transmission and rapid authentication.

[0069] Furthermore, the method also includes: During the initial user network access phase, a data write request is received from the communication service platform; The user's identity information and security details, carried in the data write request, are written into the storage space of the SIM card application.

[0070] Among them, the dynamic salt initial seed in the security element is a second random number generated by the communication service platform based on a cryptographically secure random number generator; The device binding factor in the security elements is generated by the communication service platform by reading the device identifier of the SIM card of the terminal device.

[0071] In this embodiment of the invention, the generation process of the dynamic salt initial seed and the device binding factor (such as the SIM card ICCID) occurs before the user performs real-name authentication, that is, when the user initially joins the network. Figure 2 As shown, the specific process includes: Users submit network access applications: Users submit network access applications through operator channels (business hall / online APP), providing three personal information elements: communication number (such as mobile phone number), name, and identification code (such as valid ID card number), and at the same time submit physical SIM card (offline) or electronic SIM information (online).

[0072] The communication service platform (i.e., the operator system) generates security elements: for example, the registration system of the communication service platform performs two core operations, namely generating the dynamic salt initial seed and obtaining the SIM card ICCID.

[0073] Specifically, a high-strength second random number is generated using a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) as the initial seed K-SALT_SEED for the dynamic salt, with a seed length of at least 256 bits (32 bytes).

[0074] The SIM card's ICCID is read by a SIM card reader and used as a device binding factor. The ICCID is a globally unique identifier for the SIM card.

[0075] Data is stored in the local database of the communication service platform: New user records are created in the local database, storing five key elements, including communication number (e.g., mobile phone number), name, identification code (e.g., valid ID card number, device binding factor (e.g., ICCID), and dynamic salt initial seed K-SALT Seed). The following security measures are implemented: sensitive fields (identification code) and name are encrypted using the national cryptographic algorithm SM4.

[0076] The communication service platform sends a data write request to the SIM card, requesting that the user's identity information and security elements be written to the SIM card. Specifically, the communication service platform writes the following elements to the SIM card's storage space through a secure write process: the user's name (plaintext), identity code (SM4 encrypted storage), device binding factor (read-only area), and dynamic salt initial seed K-SALT Seed (SM4 encrypted storage). Furthermore, the following security measures are taken: authentication is performed using the SIM card manufacturer's key, and the write process is completed under the protection of the HSM (Hardware Security Module).

[0077] SIM card secure storage: In the secure storage area eSE within the storage space: encrypted storage identity code (SM4-CTR mode), storage dynamic salt initial seed K-SALT Seed (shared with the operator), and in the read-only area within the storage space: storage device binding factor (physically fixed and unmodifiable); access to the secure storage area requires SIM card application signature authentication.

[0078] The SIM card returns the writing result to the communication service platform: if the writing is successful, a code indicating success is returned, such as 0x9000; if the writing fails, a code indicating the reason for the error is returned, such as a code indicating signature authentication failure or insufficient storage space. This embodiment of the invention does not make specific limitations.

[0079] Network access complete: After the communication service platform receives the instruction from the SIM card indicating successful card writing, it activates the corresponding communication number, and the user obtains a SIM card that can be used normally.

[0080] In this embodiment of the invention, when a user initially joins the network, the user's name (plaintext), identity code (SM4 encrypted storage), device binding factor (read-only area), and dynamic salt initial seed K-SALT Seed (SM4 encrypted storage) are written to the storage space of the SIM card. The above information is only accessible to authorized SIM card applications. The first identity identifier is generated by the SIM card application embedded in the SIM card and is calculated in real time after the user authorizes it, ensuring that the information cannot be directly read by external parties.

[0081] It should be noted that the term "identity authentication" can also be described as real-name authentication, and the two can be used interchangeably. The term "communication number" can also be described as mobile phone number, and the two can be used interchangeably. The term "identity code" can also be described as ID card number, and the two can be used interchangeably. No specific limitation is made in the embodiments of the present invention.

[0082] The following is combined with Figure 3 The process of generating a first identity identifier using a SIM card application as described in this embodiment of the invention will be explained in detail. The specific process includes: After a user accesses the business platform through a terminal device, the business platform requires the user to undergo real-name authentication and pops up a real-name authentication authorization window in the terminal device's interactive interface, prompting the user to agree to real-name authentication.

[0083] When a user clicks / touches the control indicating confirmation in the real-name authentication authorization window, they confirm their agreement to authorize the service platform to perform real-name authentication. Then, the terminal device obtains its current communication number under GPRS network traffic and sends it to the authentication platform.

[0084] The authentication platform activates the SIM card application built into the user's terminal device based on the received communication number.

[0085] After the SIM card application is invoked, a window will pop up on the terminal device's interface, asking the user whether they agree to authorize the service platform to use pre-stored two-factor authentication information (including ID card number and name) for real-name authentication. Figure 4 As shown.

[0086] When a user clicks / touches the indicated control in the SIM card application window, they confirm their agreement to undergo real-name authentication and enter the real-name authentication process.

[0087] The SIM card application reads the user's ID card number and name stored in the local storage space and uses the above-mentioned multi-factor dynamic obfuscation generation formulas (1) and (2) to generate the first identity identifier code1; see the above description for the specific generation method.

[0088] The SIM card application sends the first identity identifier code1 to the authentication platform. After receiving the first identity identifier code1, the authentication platform sends an identifier generation request carrying the user's communication number to the communication service platform (such as the operator system), requesting the communication service platform (such as the operator system) to generate the second identity identifier code2.

[0089] After receiving a user's communication number, the communication service platform (such as an operator's system) queries its local database for the ID card number and name used when registering the user's network access. It then uses multi-factor dynamic obfuscation generation formulas (1) and (2) to calculate the second identity identifier code2 and returns it to the authentication platform. The data source side of the communication service platform (such as an operator's system) also transmits the identity identifier rather than the original data, thus ensuring that the data's value can be utilized even without leaving the database.

[0090] The authentication platform compares whether the first identity identifier code1 and the second identity identifier code2 are the same. If they are the same, the real-name authentication is successful and the platform returns a successful authentication result to the user's terminal device; otherwise, the real-name authentication fails and the platform returns a failed authentication result to the user's terminal device.

[0091] When a user clicks / touches the control indicating cancellation in the SIM card application window, confirming that the user has cancelled the real-name authentication process, a result indicating real-name authentication failure is returned to the user's terminal device.

[0092] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows: (1) In the real-name authentication process, only the dynamically generated identity identifier needs to be transmitted to the authentication platform for comparison to complete the real-name authentication. There is no need to transmit the original sensitive information (such as ID card number and name). For the terminal side, the first identity identifier code1 is generated in real time by the SIM card application based on the user's encrypted name, ID card number, and communication number, introducing device binding factors, time window variables, etc., and applying a multi-factor dynamic obfuscation formula. For the operator system side, the second identity identifier code2 is generated and returned by the operator system using the same algorithm based on the original data stored when entering the network. The authentication platform only compares the consistency between code1 and code2. The original data never leaves the SIM card and the operator database, realizing a real-name authentication method where the data does not leave the database. Since the data does not leave the database and does not share the data, but shares the data value, that is, "data is available but not visible", data privacy can be ensured and the security of real-name authentication can be improved.

[0093] (2) Encrypting and storing the ID card number and name in the SIM card's secure area (eSE) using a national cryptographic algorithm (such as SM4) can increase authentication security and achieve secure storage on the SIM card. The SIM card has hardware-level encryption and authentication functions, which can effectively prevent the leakage and forgery of identity information. Storing identity information in the SIM card can protect user privacy and prevent personal identity information from being stolen or abused by third parties during transmission and use.

[0094] (3) During the real-name authentication process, the user's name, ID card number, and communication number do not need to go through the business platform, which effectively solves the problem of personal information being transmitted and stored by multiple parties. At the same time, the user's name and ID card number are encrypted and can only be accessed by the authorized SIM card application. The first identity identifier code1 is generated by the mini-program embedded in the SIM card and is calculated in real time after the user authorizes it, ensuring that the information cannot be directly read by the outside. The convenient and fast authentication method is that the user only needs to insert the SIM card into the device and use the GPRS network environment of the local number, and the business system can complete the real-name authentication and realize the dynamic interaction of the SIM card. The user does not need to manually enter and verify the ID card number and name, which provides a more convenient and faster authentication experience.

[0095] (4) In the multi-factor dynamic confusion formula, the unique identifier of the SIM card (such as ICCID) is forcibly bound as the device binding factor. Combined with the mobile phone number, the uniqueness of the two effectively prevents the possibility of others impersonating others to conduct transactions or operations, and can prevent cloning or cross-device impersonation.

[0096] See Figure 5 , Figure 5 This is another flowchart of a user authentication method provided in an embodiment of the present invention. The user authentication method is applied to a communication service platform and includes: S21: Receive an identifier generation request sent by the authentication platform; wherein, the identifier generation request is sent by the authentication platform after receiving the first identity identifier sent by the terminal device, and the identifier generation request carries the user's communication number; S22: Query the identity information and security elements of the corresponding user stored in the local database based on the communication number; S23: Generate a second identity identifier based on the retrieved identity information and security elements, and send the second identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0097] In one optional embodiment, generating a second identity identifier based on the retrieved identity information and security elements includes: A multi-factor dynamic obfuscation strategy is applied to encrypt the queried security elements and identity information to generate the second identity identifier; The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

[0098] It should be noted that the working process of the user authentication method applied to the communication service platform described in the embodiments of the present invention can refer to the working process of the user authentication method applied to the terminal device described in the above embodiments, and the technical effect achieved is the same as that of the user authentication method described in the above embodiments, so it will not be repeated here.

[0099] See Figure 6 , Figure 6 This is a structural block diagram of a user authentication device provided in an embodiment of the present invention. The user authentication device is applied to a terminal device and includes: The first request receiving module 11 is used to receive a wake-up request sent by the authentication platform; wherein, the wake-up request is used to wake up the SIM card application built into the terminal device; the wake-up request is triggered by the authentication platform after receiving the user's instruction to confirm the real-name authentication authorization of the business platform; The first identifier generation module 12 is used to generate a first identity identifier through the SIM card application based on the user's identity information; The first identifier sending module 13 is used to send the first identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0100] In an optional embodiment, the first identifier generation module 12 includes: The first identity generation unit is used to encrypt the pre-stored security elements and identity information of the user by applying a multi-factor dynamic obfuscation strategy to the SIM card, and generate the first identity. The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

[0101] In one optional embodiment, the first identity generation unit includes: The first hash value calculation subunit is used to encrypt the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable using a preset message authentication code algorithm to obtain the first hash value; wherein, the time window variable is determined based on the current timestamp and the preset time window; The second hash value calculation subunit is used to perform hash calculation on the user's name to obtain a second hash value; The dynamic obfuscation subunit is used to dynamically obfuscate the first hash value and the second hash value to generate the first identity identifier.

[0102] In an optional embodiment, the first hash value calculation subunit includes: The first hash calculation subunit is used to perform hash calculations on the user's identity code and communication number respectively to obtain the third hash value corresponding to the identity code and the fourth hash value corresponding to the communication number; The splicing subunit is used to splice the third hash value, the fourth hash value, the device binding factor, and the time window variable to obtain the first authentication information; The dynamic salt value update subunit is used to dynamically update the initial seed of the dynamic salt and generate a dynamic salt value. The message authentication subunit is used to encrypt the dynamic salt value and the first information to be authenticated using the message authentication code algorithm to obtain the first hash value.

[0103] In one optional embodiment, the dynamic obfuscation subunit includes: A truncation subunit is used to truncate the first hash value to obtain a basic obfuscation value with a set number of bits; The left shift operation subunit is used to perform a cyclic left shift operation on the basic obfuscation value to obtain the fifth hash value; The right shift operation subunit is used to perform a circular right shift operation on the second hash value to obtain the sixth hash value; The dynamic time calculation subunit is used to calculate the dynamic random time value based on the time window variable and the first random number. The summation and modulo subunit is used to sum and modulo the fifth hash value, the sixth hash value, and the dynamic random time value to generate the first identity identifier.

[0104] In one optional embodiment, the dynamic salt value update subunit includes: The update subunit is used to update the initial seed of the dynamic salt according to the device binding factor and the time window variable through the key derivation function to obtain the dynamic salt value.

[0105] In one optional embodiment, the second identity identifier is generated by the communication service platform by encrypting the user's security elements and identity information stored in the local database using a multi-factor dynamic obfuscation strategy.

[0106] In an optional embodiment, the device further includes: The network access request module is used to receive a data write request sent by the communication service platform during the user's initial network access phase. The data writing module is used to write the user's identity information and security elements carried in the data writing request into the storage space of the SIM card application.

[0107] In one optional embodiment, the dynamic salt initial seed in the security element is a second random number generated by the communication service platform based on a cryptographically secure random number generator; The device binding factor in the security elements is generated by the communication service platform by reading the device identifier of the SIM card of the terminal device.

[0108] In an optional embodiment, the device further includes: The authentication result receiving module is used to receive the authentication result sent by the authentication platform; The authentication result is obtained by the authentication platform by comparing the first identity identifier with the second identity identifier; when the first identity identifier and the second identity identifier are consistent, the authentication result is successful; when the first identity identifier and the second identity identifier are inconsistent, the authentication result is unsuccessful.

[0109] It should be noted that the working process of each module in the user identity authentication device described in the embodiments of the present invention can refer to the working process of the user identity authentication method described in the above embodiments, and the technical effect achieved is the same as that of the user identity authentication method described in the above embodiments, so it will not be repeated here.

[0110] See Figure 7 , Figure 7 This is another structural block diagram of a user authentication device provided in an embodiment of the present invention. The user authentication device is applied to a communication service platform and includes: The second request receiving module 21 is used to receive an identifier generation request sent by the authentication platform; wherein, the identifier generation request is sent by the authentication platform after receiving the first identity identifier sent by the terminal device, and the identifier generation request carries the user's communication number; Information query module 22 is used to query the identity information and security elements of the corresponding user stored in the local database based on the communication number; The second identifier sending module 23 is used to generate a second identity identifier based on the queried identity information and security elements, and send the second identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

[0111] In an optional embodiment, the second identifier sending module 23 includes: The second identity generation unit is used to apply a multi-factor dynamic obfuscation strategy to encrypt the queried security elements and identity information to generate the second identity. The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

[0112] It should be noted that the working process of each module in the user identity authentication device described in the embodiments of the present invention can refer to the working process of the user identity authentication method described in the above embodiments, and the technical effect achieved is the same as that of the user identity authentication method described in the above embodiments, so it will not be repeated here.

[0113] See Figure 7 , Figure 7 This is a structural block diagram of a user authentication device provided in an embodiment of the present invention. The user authentication device includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, it implements the steps in the above-described user authentication method embodiments, such as steps S11-S13 or steps S21-S23.

[0114] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the user authentication device.

[0115] The user authentication device may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art will understand that the schematic diagram is merely an example of a user authentication device and does not constitute a limitation on the user authentication device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the user authentication device may also include input / output devices, network access devices, buses, etc.

[0116] The processor 31 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the user authentication device, connecting all parts of the user authentication device via various interfaces and lines.

[0117] The memory 32 can be used to store the computer programs and / or modules. The processor 31 implements various functions of the user authentication device by running or executing the computer programs and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0118] Wherein, if the modules / units integrated into the user authentication device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0119] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0120] The above description represents the preferred embodiments of the present invention. It should be noted that, for those skilled in the art, various improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A user authentication method, characterized in that, Applied to terminal devices, including: The system receives a wake-up request from the authentication platform; wherein the wake-up request is used to activate the SIM card application built into the terminal device; the wake-up request is triggered by the authentication platform after receiving an instruction from the user to confirm the real-name authentication authorization of the business platform. Based on the user's identity information, a first identity identifier is generated through the SIM card application; The first identity identifier is sent to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier; The step of generating a first identity identifier through the SIM card application based on the user's identity information includes: The SIM card application employs a multi-factor dynamic obfuscation strategy to encrypt the pre-stored security elements and identity information of the user, generating the first identity identifier; wherein, the identity information includes the user's name, identity identifier code, and communication number; the security elements include a dynamic salt initial seed and a device binding factor; The step of encrypting the pre-stored security elements and identity information of the user by applying a multi-factor dynamic obfuscation strategy to the SIM card application to generate the first identity identifier includes: The user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable are encrypted using a preset message authentication code algorithm to obtain a first hash value; wherein, the time window variable is determined based on the current timestamp and the preset time window. Perform a hash calculation on the user's name to obtain a second hash value; The first hash value and the second hash value are dynamically obfuscated to generate the first identity identifier.

2. The user authentication method as described in claim 1, characterized in that, The application's preset message authentication code algorithm encrypts the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable to obtain a first hash value, including: Hash calculations are performed on the user's identity code and communication number respectively to obtain a third hash value corresponding to the identity code and a fourth hash value corresponding to the communication number; The third hash value, the fourth hash value, the device binding factor, and the time window variable are concatenated to obtain the first authentication information. The initial seed of the dynamic salt is dynamically updated to generate a dynamic salt value; The message authentication code algorithm is applied to encrypt the dynamic salt value and the first information to be authenticated to obtain the first hash value.

3. The user authentication method as described in claim 1, characterized in that, The step of dynamically obfuscating the first hash value and the second hash value to generate the first identity identifier includes: The first hash value is truncated to obtain a basic obfuscation value with a set number of bits; Perform a circular left shift operation on the base obfuscation value to obtain the fifth hash value; Perform a circular right shift operation on the second hash value to obtain the sixth hash value; Calculate the dynamic random time value based on the time window variable and the first random number; The first identity identifier is generated by summing and moduloing the fifth hash value, the sixth hash value, and the dynamic random time value.

4. The user authentication method as described in claim 2, characterized in that, The step of dynamically updating the initial seed of the dynamic salt to generate a dynamic salt value includes: Based on the device binding factor and the time window variable, the initial seed of the dynamic salt is updated through the key derivation function to obtain the dynamic salt value.

5. The user authentication method as described in claim 1, characterized in that, The second identity identifier is generated by the communication service platform through encrypting the user's security elements and identity information stored in the local database using a multi-factor dynamic obfuscation strategy.

6. The user authentication method as described in claim 1, characterized in that, The method further includes: During the initial user network access phase, a data write request is received from the communication service platform; The user's identity information and security elements carried in the data write request are written into the storage space of the SIM card application.

7. The user authentication method as described in claim 1, characterized in that, The dynamic salt initial seed in the security element is a second random number generated by the communication service platform based on a cryptographically secure random number generator. The device binding factor in the security elements is generated by the communication service platform by reading the device identifier of the SIM card of the terminal device.

8. The user authentication method as described in claim 1, characterized in that, The method further includes: Receive the authentication result sent by the authentication platform; The authentication result is obtained by the authentication platform by comparing the first identity identifier with the second identity identifier; when the first identity identifier and the second identity identifier are consistent, the authentication result is successful; when the first identity identifier and the second identity identifier are inconsistent, the authentication result is unsuccessful.

9. A user authentication method, characterized in that, Applications in communication service platforms, including: The system receives an identifier generation request from an authentication platform. This request is sent after the authentication platform receives a first identity identifier from a terminal device, and the request carries the user's communication number. The first identity identifier is generated by encrypting pre-stored security elements and identity information of the user using a multi-factor dynamic obfuscation strategy applied by the SIM card application. The identity information includes the user's name, identity code, and communication number. The security elements include a dynamic salt initial seed and a device binding factor. The process of generating the first identity identifier by encrypting pre-stored security elements and identity information of the user using the multi-factor dynamic obfuscation strategy applied by the SIM card application includes: encrypting the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and a time window variable using a preset message authentication code algorithm to obtain a first hash value; wherein the time window variable is determined based on the current timestamp and a preset time window; performing a hash calculation on the user's name to obtain a second hash value; and dynamically obfuscating the first hash value and the second hash value to generate the first identity identifier. The system queries the local database to retrieve the corresponding user's identity information and security details based on the communication number. Based on the retrieved identity information and security elements, a second identity identifier is generated and sent to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

10. The user authentication method as described in claim 9, characterized in that, The step of generating a second identity identifier based on the retrieved identity information and security elements includes: A multi-factor dynamic obfuscation strategy is applied to encrypt the queried security elements and identity information to generate the second identity identifier; The identity information includes the user's name, identity code, and communication number; the security elements include the dynamic salt initial seed and the device binding factor.

11. A user authentication device, characterized in that, Applied to terminal devices, including: The first request receiving module is used to receive a wake-up request sent by the authentication platform; wherein, the wake-up request is used to wake up the SIM card application built into the terminal device; the wake-up request is triggered by the authentication platform after receiving the user's instruction to confirm the real-name authentication authorization of the business platform; The first identifier generation module is used to generate a first identity identifier through the SIM card application based on the user's identity information; The first identifier sending module is used to send the first identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier; The first identifier generation module includes: The first identity generation unit is used to encrypt the pre-stored security elements and identity information of the user by applying a multi-factor dynamic obfuscation strategy to the SIM card, and generate the first identity identifier; wherein, the identity information includes the user's name, identity code, and communication number; the security elements include dynamic salt initial seed and device binding factor; The first identity generation unit includes: The first hash value calculation subunit is used to encrypt the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and the time window variable using a preset message authentication code algorithm to obtain the first hash value; wherein, the time window variable is determined based on the current timestamp and the preset time window; The second hash value calculation subunit is used to perform hash calculation on the user's name to obtain a second hash value; The dynamic obfuscation subunit is used to dynamically obfuscate the first hash value and the second hash value to generate the first identity identifier.

12. A user authentication device, characterized in that, Applications in communication service platforms, including: The second request receiving module is used to receive an identifier generation request sent by the authentication platform. The identifier generation request is sent by the authentication platform after receiving a first identity identifier from the terminal device, and carries the user's communication number. The first identity identifier is generated by encrypting pre-stored security elements and identity information of the user using a multi-factor dynamic obfuscation strategy applied by the SIM card application. The identity information includes the user's name, identity code, and communication number. The security elements include a dynamic salt initial seed and a device binding factor. The process of encrypting the pre-stored security elements and identity information of the user using the multi-factor dynamic obfuscation strategy applied by the SIM card application to generate the first identity identifier includes: encrypting the user's identity code and communication number, the dynamic salt initial seed, the device binding factor, and a time window variable using a preset message authentication code algorithm to obtain a first hash value; wherein the time window variable is determined based on the current timestamp and a preset time window; performing a hash calculation on the user's name to obtain a second hash value; and dynamically obfuscating the first hash value and the second hash value to generate the first identity identifier. The information query module is used to query the identity information and security elements of the corresponding user stored in the local database based on the communication number; The second identifier sending module is used to generate a second identity identifier based on the queried identity information and security elements, and send the second identity identifier to the authentication platform so that the authentication platform can perform identity authentication based on the first identity identifier and the second identity identifier.

13. A user authentication device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the user authentication method as described in any one of claims 1 to 8 or the user authentication method as described in any one of claims 9 to 10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the user authentication method as described in any one of claims 1 to 8 or the user authentication method as described in any one of claims 9 to 10.

15. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the user authentication method as described in any one of claims 1 to 8 or the user authentication method as described in any one of claims 9 to 10.

Images