Authentication method and device

Abstract

The invention relates to an authentication method and device, a computer readable storage medium, a computer program product and a computer program. The method comprises the steps that a terminal sends a first message, the first message carries one or more pieces of authentication information, and the one or more pieces of authentication information are used for authenticating a first user using the terminal; different pieces of authentication information in the one or more pieces of authentication information are related to the feature information of the first user and feature recovery information of different users.

Description

Authentication methods and equipment Technical Field The present application relates to the field of communications, and more specifically, to an authentication method, a device, a computer-readable storage medium, a computer program product, and a computer program. Background Art With the development and popularization of electronic devices, there are many different types of terminals for users to use. For the same terminal, different users need different services when accessing it. However, the current authentication process is only for the terminal and cannot distinguish which user is using the terminal. Therefore, how to authenticate the user using the terminal becomes a problem that needs to be solved. Summary of the invention Embodiments of the present application provide an authentication method, device, computer-readable storage medium, computer program product, and computer program. The present application provides an authentication method, including: The terminal sends a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. The present application provides an authentication method, including: The first network device receives a first message, wherein the first message carries one or more authentication information, the one or more authentication information is used to authenticate a first user using a terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. The present application provides an authentication method, including: The second network device receives a first message sent by the terminal, wherein the first message carries one or more authentication information, the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users; The second network device sends a fourth message to the first network device, wherein the fourth message carries a verification result, and the verification result is related to the one or more authentication information. The present application provides an authentication method, including: The first network device receives a fourth message sent by the second network device, wherein the fourth message carries a verification result, and the verification result is related to one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. An embodiment of the present application provides a terminal, including: A first communication unit is used to send a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. An embodiment of the present application provides a first network device, including: A second communication unit is used to receive a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. An embodiment of the present application provides a second network device, including: A third communication unit is used to receive a first message sent by a terminal, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users; and send a fourth message to the first network device, wherein the fourth message carries a verification result, and the verification result is related to the one or more authentication information. An embodiment of the present application provides a first network device, including: A second communication unit is used to receive a fourth message sent by a second network device, wherein the fourth message carries a verification result, and the verification result is related to one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. The embodiment of the present application provides a terminal, including: a transceiver, a processor and a memory. The memory is used to store a computer program, the transceiver is used to communicate with other devices, and the processor is used to call and run the computer program stored in the memory, so that the terminal executes the above method. The embodiment of the present application provides a first network device, comprising: a transceiver, a processor and a memory. The memory is used to store a computer program, the transceiver is used to communicate with other devices, and the processor is used to call and run the computer program stored in the memory, so that the first network device executes the above method. The embodiment of the present application provides a second network device, including: a transceiver, a processor and a memory. The memory is used to store the calculation The transceiver is used to communicate with other devices, and the processor is used to call and run the computer program stored in the memory to enable the second network device to execute the above method. The embodiment of the present application provides a chip for implementing the above method. Specifically, the chip includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes the above method. An embodiment of the present application provides a computer-readable storage medium for storing a computer program, which enables a device to perform the above method when the computer program is executed by the device. An embodiment of the present application provides a computer program product, including computer program instructions, which enable a computer to execute the above method. An embodiment of the present application provides a computer program, which, when executed on a computer, enables the computer to execute the above method. By adopting the solution provided in this embodiment, the terminal can send the first message so that the network side can authenticate the first user using the terminal based on the authentication information generated by the feature recovery information of each user and the feature information of the current first user carried in the first message. In this way, when different users log in on the same terminal, the network side can distinguish and authenticate different users, thereby ensuring the security of each user. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present application. Figure 2 is a schematic diagram of the 5G network system architecture. FIG3 is a schematic flowchart of 5G-AKA authentication in a 5G network. FIG4 is a schematic flow chart of EPA-AKA authentication. 5a-5c are schematic diagrams of various scenarios of the corresponding relationship between terminals and users in different scenarios. FIG6 is a schematic flowchart of an authentication method according to an embodiment of the present application. FIG. 7 is a schematic flowchart of an authentication method according to another embodiment of the present application. FIG8 is a schematic flowchart of an authentication method according to another embodiment of the present application. FIG9 is a schematic flowchart of an authentication method according to another embodiment of the present application. FIG. 10 is a schematic diagram of a scenario in which biometric information of a user is calculated and identity information is generated according to an embodiment of the present application. FIG. 11 is a schematic diagram of a scenario according to the relevant principles of the authentication method in an embodiment of the present application. FIG. 12 is a schematic flowchart of an authentication method according to an embodiment of the present application. FIG. 13 is a schematic diagram of a scenario for calculating multiple protection information according to an embodiment of the present application. FIG. 14 is a schematic diagram of a scenario in which authentication processing is performed based on protection information* and protection information in one embodiment of the present application. FIG. 15 is another schematic flowchart of an authentication method according to an embodiment of the present application. FIG. 16 is a schematic diagram of a scenario in which authentication processing is performed on protection information* obtained by encryption calculation according to an embodiment of the present application. FIG. 17 is another schematic flowchart of an authentication method according to an embodiment of the present application. FIG18 is a schematic block diagram of a terminal according to an embodiment of the present application. FIG. 19 is a schematic block diagram of a first network device according to an embodiment of the present application. FIG. 20 is a schematic block diagram of a second network device according to an embodiment of the present application. FIG. 21 is a schematic block diagram of a communication device according to an embodiment of the present application. FIG. 22 is a schematic block diagram of a chip according to an embodiment of the present application. Figure 23 is a schematic block diagram of a communication system according to an embodiment of the present application. DETAILED DESCRIPTION The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: Long Term Evolution (LTE) system, Advanced long term evolution (LTE-A) system, New Radio (NR) system, NR system evolution system, LTE on unlicensed spectrum (LTE-based access to unlicensed spectrum, LTE-U) system, NR on unlicensed spectrum (NR-based access to unlicensed spectrum, NR-U) system, Non-Terrestrial Networks (NTN) system, Universal Mobile Telecommunication System (UMTS), Wireless Local Area Networks (WLAN), Wireless Fidelity (WiFi), fifth-generation communication (5th-Generation, 5G) system or other communication systems. Generally speaking, traditional communication systems support a limited number of connections and are easy to implement. However, with the development of communication technology, mobile communication systems will not only support traditional communications, but will also support, for example, device to device (D2D) communication, machine to machine (M2M) communication, machine type communication (MTC), vehicle to vehicle (V2V) communication, or vehicle to everything (V2X) communication, etc. The embodiments of the present application can also be applied to these communication systems. In one possible implementation, the communication system in the embodiments of the present application can be applied to a carrier. The carrier aggregation (CA) scenario can also be applied to the dual connectivity (DC) scenario, and can also be applied to the standalone (SA) networking scenario. In one possible implementation, the communication system in the embodiment of the present application can be applied to the unlicensed spectrum, where the unlicensed spectrum can also be considered as the shared spectrum; or, the communication system in the embodiment of the present application can also be applied to the licensed spectrum, where the licensed spectrum can also be considered as the unshared spectrum. The embodiments of the present application describe various embodiments in combination with network devices and terminal devices, wherein the terminal device may also be referred to as user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc. The terminal device may be a station (STAION, ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a next-generation communication system such as an NR network, or a terminal device in a future-evolved Public Land Mobile Network (PLMN) network, etc. In the embodiment of the present application, the terminal device can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). In the embodiment of the present application, the terminal device can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical, a wireless terminal device in smart grid, a wireless terminal device in transportation safety, a wireless terminal device in smart city, or a wireless terminal device in smart home, etc. As an example and not a limitation, in the embodiment of the present application, the terminal device can also be a wearable device. Wearable devices can also be called wearable smart devices. They are a general term for wearable devices that use wearable technology to intelligently design and develop wearable devices for daily wear, such as glasses, gloves, watches, clothing and shoes. Wearable devices are portable devices that are worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not just hardware devices, but also realize powerful functions through software support, data interaction, and cloud interaction.In a broad sense, wearable smart devices include those that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring. In an embodiment of the present application, a network device may be a device for communicating with a mobile device, and the network device may be an access point (AP) in a WLAN, a base station (BTS) in a GSM or CDMA, or a base station (NodeB, NB) in a WCDMA, or an evolved base station (eNB or eNodeB) in an LTE, or a relay station or access point, or a vehicle-mounted device, a wearable device, and a network device (gNB) in an NR network, or a network device in a future evolved PLMN network, or a network device in an NTN network, etc. As an example and not a limitation, in an embodiment of the present application, a network device may have a mobile feature, for example, the network device may be a mobile device. Optionally, the network device may be a satellite or a balloon station. For example, a satellite may be a low earth orbit (LEO) satellite, a medium earth orbit (MEO) satellite, a geostationary earth orbit (GEO) satellite, a high elliptical orbit (HEO) satellite, etc. Optionally, the network device may also be a base station set up in a location such as land or water. In an embodiment of the present application, the network device may provide services for a cell, and the terminal device communicates with the network device through the transmission resources (e.g., frequency domain resources, or spectrum resources) used by the cell. The cell may be a cell corresponding to the network device (e.g., a base station), and the cell may belong to a macro base station or a base station corresponding to a small cell. The small cells here may include: a metro cell, a micro cell, a pico cell, a femto cell, etc. These small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services. FIG1 exemplarily shows a communication system 100. The communication system includes a network device 110 and two terminal devices 120. In a possible implementation, the communication system 100 may include multiple network devices 110, and each network device 110 may include other number of terminal devices 120 within its coverage area, which is not limited in the embodiment of the present application. In a possible implementation, the communication system 100 may also include other network entities such as a Mobility Management Entity (MME) and an Access and Mobility Management Function (AMF), which is not limited in the embodiment of the present application. Among them, the network device may include an access network device and a core network device. That is, the wireless communication system also includes multiple core networks for communicating with the access network device. The access network equipment may be an evolved base station (evolutional node B, which may be referred to as eNB or e-NodeB) macro base station, micro base station (also called "small base station"), pico base station, access point (AP), transmission point (TP) or new generation Node B (gNodeB), etc. in a long-term evolution (LTE) system, a next-generation (mobile communication system) (next radio, NR) system or an authorized auxiliary access long-term evolution (LAA-LTE) system. It should be understood that the device with communication function in the network / system in the embodiment of the present application may be referred to as communication equipment. Taking the communication system shown in Figure 1 as an example, the communication equipment may include network equipment and terminal equipment with communication functions. The network equipment and terminal equipment may be specific equipment in the embodiment of the present application, which will not be repeated here; the communication The communication device may also include other devices in the communication system, such as a network controller, a mobile management entity, and other network entities, which is not limited in the embodiments of the present application. In order to facilitate understanding of the embodiments of the present application, the basic processes and basic concepts involved in the embodiments of the present application are briefly described below. It should be understood that the basic processes and basic concepts introduced below do not limit the embodiments of the present application. The 5G network system architecture is shown in Figure 2, which includes: NSSF (Network Slice Selection Function) is mainly used for the management of network slice related information, such as selecting network slices for terminal devices; AUSF (Authentication Server Function) is used to complete the identity authentication function of user access; UDM (Unified Data Management) is used to manage and store contract data and authentication data; AMF (Access and Mobility Management Function) is used to complete mobility management, security anchor and secure UE policy management, etc. In addition to UE mobility management, AMF is also responsible for forwarding session management related messages between UE and SMF; SMF (Session Management Function) is used to complete session management, UE IP address allocation and management, etc.; PCF (Policy Control Function) is responsible for formulating policies related to UE mobility management, session management, billing, etc.; AF (Application Function) is used for external application servers; UPF (User Plane Function) is used for external application servers; Function) is used for complex user plane processing, such as forwarding traffic between the wireless access network and the Internet, reporting traffic usage, and implementing QoS (Quality of Service) policies; DN (Data Network) is the 5GC external data network (such as the Internet, etc.). Data is transmitted through corresponding interfaces between the nodes of the 5GC (5G core network), between the user equipment (UE) and the nodes of the 5GC, between the UE and the radio access network (RAN), and between the nodes of the RAN and the 5GC. For example, as shown in Figure 2: data is transmitted between the AMF and NSSF in the 5GC through the interface N22; AMF transmits data with SMF through the interface N11; AMF transmits data with AUSF through N12; AMF and UDM transmit data through the N8 interface. Data is transmitted between SMF and UPF through the N4 interface. UPF transmits data with the external data network through the N6 interface and with the AN through the N3 interface. The UE establishes an access layer connection with the AN through the Uu port, exchanges access layer messages and wireless data transmission, and the UE establishes a non-access layer (NAS) connection with the AMF through the N1 port, exchanges NAS messages.Data is transmitted between RAN and AMF via the N2 interface, and data is transmitted between RAN and UPF via the N3 interface. It should be understood that only the interfaces between some nodes are described above, and other interfaces between other nodes of 5GC in Figure 2 are not described one by one. The terminal identifiers used in the current system include at least one of the following: SUPI (SUbscription Permanent Identifier), SUCI (Subscription Concealed Identifier), PEI (Permanent Equipment Identifier). Among them, the globally unique 5G subscription permanent identifier (SUPI) should be assigned to each user in the 5G system and provided in the UDM / UDR; SUPI is only used within the 3GPP system; SUPI can include at least one of the following: TS23.003

[0019] The IMSI (International Mobile Subscriber Identity) defined in TS 22.261[2] and the network specific identifier used for private networks defined in TS 22.261[2]. The Subscription Hidden Identifier (SUCI) is a privacy-preserving identifier containing a hidden SUPI. Within the scope of this release, the only format supported for the PEI parameter is the International Mobile Equipment Identity (IMEI). The current authentication mechanism is a two-way authentication, that is, the network needs to authenticate whether the SUPI reported by the terminal is legal, and whether the terminal authenticates the network side legally (to avoid fake base stations, etc.). In this process, the network side can determine what the SUPI (or IMSI) of the terminal is. This identifier is an important identifier stored in the SIM card. The 5G-AKA authentication process in the 5G network is shown in Figure 3, which may include the following steps: S301, UDM / ARPF generates (Generate) AV (authentication vector), where the authentication vector AV can be a 5G home network authentication vector (for example, it can be expressed as 5G HE AV); S302, UDM / ARPF sends an authentication get response (Nudm Authentication Get Response) to AUSF (carrying 5G HE AV, [SUPI]), where [] indicates optional; S303, AUSF saves the expected verification response (XRES*) in the 5G HE AV; S304, AUSF calculates the hash expected verification response (HXRES*); S305, AUSF sends a user access authentication response (Nausf UEAuthentication Authenticate Response) to SEAF (carrying 5G authentication vector (5G AV)); S306, SEAF sends an authentication request (Authentication Request) to UE Request); S307, UE calculates the authentication response (RES*); S308, UE sends the authentication response to SEAF, which may carry RES*; S309, SEAF calculates HRES* and compares HXRES*, and executes S310 when the two are consistent; S310, SERF sends a user access authentication request (Nausf UEAuthentication Authenticate Request) to AUSF, which carries RES*; S311, AUSF authenticates RES*; S312, AUSF sends a user access authentication response (Nausf UEAuthentication Authenticate Response) to SEAF, which may carry the authentication result (i.e., the authentication result of RES*), and optionally, may also carry SUPI. The EPA-AKA authentication process is shown in Figure 4 and may include the following steps: S401, UDM / ARPF generates AV (authentication vector); S402, UDM / ARPF sends a UE authentication acquisition response (Nudm_UEAuthentication_Get Response) to AUSF (carrying EAP-AKA'AV (Extensible Authentication Protocol-Authentication and Key Agreement Vector), [SUPI]), where [] indicates optional; S403, AUSF sends a user access authentication response (Nausf UEAuthentication Authenticate Response) to SEAF, which may optionally carry EAP Request (request) / AKA'-challenge (challenge); S404, SEAF sends an authentication request (Authentication Request) to the UE, which may optionally carry an EAP request-AKA challenge; S405, UE calculates the authentication response; S406, UE sends an authentication response to SEAF (Auth-Resp.), which may optionally carry an EAP request-AKA challenge; S407, SERF sends a user access authentication request (Nausf UEAuthentication Authenticate Request) to AUSF, which may optionally carry an EAP request-AKA challenge; S408, AUSF authentication response; Optionally, S409 may be executed, and AUSF interacts with the UE with other EAP messages; S410, AUSF sends a user access authentication response (Nausf UEAuthentication Authenticate Response) to SEAF, which may optionally carry EAP success||Anchor Key [SUPI]; S411, SEAF sends an N1 interface message (N1message) to the UE, which may optionally carry an indication of EAP Success. With the development and popularization of electronic devices, there are many different forms of terminals for consumers to use, and each form of terminal has its own advantages. For example, as shown in Figure 5a, a terminal-1 (in which USIM-1 is inserted) can be shared by multiple users (user-A, user-B, and user-C in Figure 5a); for example, as shown in Figure 5b, a user-A can use multiple terminals (such as terminal-1 (using USIM-1), terminal-2 (using USIM-2), and terminal-3 (using USIM-3) in Figure 5b); for example, as shown in Figure 5c, multiple terminals (such as terminal-1 (using USIM-1), terminal-2 (using USIM-2), and terminal-3 (using USIM-3) in Figure 5c) are shared by multiple users (user-A, user-B, and user-C in Figure 5c). For the same terminal, different users need different services when accessing it. Currently, the authentication (or certification process) based on SUPI / IMSI is only based on the terminal granularity, that is, the current authentication or certification process only distinguishes the USIM card using the terminal, but cannot distinguish which user is using the terminal. Therefore, it is necessary to introduce new algorithms, parameters and processes to realize the network's authentication of user biometrics; it is also necessary to introduce a new User ID to identify different users using the same terminal. It should be understood that the terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated with each other are in an "or" relationship. It should be understood that the "indication" mentioned in the embodiments of the present application can be a direct indication, an indirect indication, or an indication of an association relationship. For example, A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association relationship between A and B. In the description of the embodiments of the present application, the term "correspondence" can mean that there is a direct or indirect correspondence relationship between the two, or it can mean that there is an association relationship between the two, or it can mean that there is an indication and being indicated, configuration and being configured, etc. To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application. Fig. 6 is a schematic flow chart of an authentication method according to an embodiment of the present application. The method includes at least part of the following contents. S610. The terminal sends a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. Fig. 7 is a schematic flow chart of an authentication method according to another embodiment of the present application. The method includes at least part of the following contents. S710. A first network device receives a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using a terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. Fig. 8 is a schematic flow chart of an authentication method according to another embodiment of the present application. The method includes at least part of the following contents. S810. The second network device receives a first message sent by the terminal, wherein the first message carries one or more authentication information, the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users; S820. The second network device sends a fourth message to the first network device, wherein the fourth message carries a verification result, and the verification result is related to the one or more authentication information. Fig. 9 is a schematic flow chart of an authentication method according to another embodiment of the present application. The method includes at least part of the following contents. S910. The first network device receives a fourth message sent by the second network device, wherein the fourth message carries a verification result, and the verification result is related to one or more authentication information. The one or more authentication information are used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. Here, the first network device may be a first access network device or a first core network device. In one example, the first network device may be a first core network device. In this example, the first network device may include at least one of the following: a unified data management function (UDM), a unified data storage (UDR). It should be understood that the above is only an exemplary description. In actual processing, the above first network device is not limited to the core network elements listed above. All possible network elements of the first network device are exhaustively enumerated. The second network device may be a second access network device or a second core network device. In one example, the second network device may be a second core network device. In this example, the second network device may include at least one of the following: a verification network element, an access and mobility management function (AMF), an authentication server function (AUSF), a home subscriber server (HSS), and an authentication credential storage and processing function (ARPF). The verification network element may be a newly added core network element, for example, the verification network element may be a network element at least used to authenticate users. The terminal may be a 3GPP terminal, that is, a terminal that can access a 3GPP network to send and receive data. For example, the terminal may be a mobile phone, a watch, a tablet, a television, augmented reality (AR) / virtual reality (VR) glasses, etc. Alternatively, the terminal may also be a non-3GPP terminal. This embodiment does not exhaustively list and limit various possible types of terminals. In some possible implementations, on the terminal side, the feature recovery information of each of the one or more users is preconfigured. On the first network device side, the feature key of each of the one or more users is associated with the identifier of each user and the feature recovery information of each user and is stored. Each of the one or more users is a user who can use the terminal, and the one or more users include the first user. That is, the terminal will pre-configure the feature recovery information of each user in one or more users, and the first network device will pre-configure the identity information of each user in the one or more users. The identity information of each user may include: user identification, user feature recovery information, and user feature key. Taking any one of one or more users as an example, the user uses a local device (such as a terminal) to enter the user's feature information into a related device. The related device processes the user's feature information based on an extraction algorithm, and obtains the feature key and feature recovery information corresponding to the user output by the related device. The user can keep the user's feature recovery information locally (such as USIM (Universal Subscriber Identity Module)), and transmit the user's identifier, the user's feature key, and the user's feature recovery information as the user's identity information to the authentication server. Accordingly, the authentication server receives and associates and saves the user's identity information (i.e., the user's identifier, the user's feature key, and the user's feature recovery information). Optionally, the user's characteristic information may refer to the user's biometric characteristic information (CH, character), for example, the user's characteristic information may include at least one of the following: fingerprint, facial feature, voice feature, voiceprint, palmprint, etc. Optionally, the user's characteristic information may include processed biometric information of the user. In this example, the user's characteristic information may include at least one of the following: processed fingerprints, processed facial features, processed voice features, processed voiceprint features, processed palmprint features, etc. As for the method of processing the user's biometric information, any algorithm capable of processing biometric information may be used, which is not limited here. The relevant device may be any device with data processing capabilities, such as a server or a computing device, etc. The possible device types of the relevant devices are not limited or enumerated here. The extraction algorithm can be set according to actual conditions, for example, it can be a Gen (Generation) algorithm, or a Fuzzy Extractor algorithm, or a Fuzzy Extractor Generation algorithm, etc., which are not exhaustively listed here. The input of the extraction algorithm is the user's feature information, and the output is the user's feature key and the user's feature recovery information. The user's character key can be recovered through the user's character recovery information and the user's character information. The user's character key can also be called the user's biometric secret information or the user's biometric key (CHK, character key). The user's characteristic recovery information can be calculated together with the user's characteristic information to obtain the user's characteristic key. The user's characteristic recovery information may be the user's recovery value or the user's Assisted recovery value (AR). The user identifier may be an ID that can uniquely identify the user, such as a User ID. The user identifier may be generated or allocated manually or in advance, and the examples are not exhaustive or limited here. The authentication server may be the first network device in this embodiment. Taking any user as user A as an example, an exemplary description is given in conjunction with FIG10. The biometric information CH (such as at least one of face, fingerprint, palm print, voice print, and sound features) of user A is entered through the relevant equipment, and the fuzzy extraction algorithm A (such as the Gen (Fuzzy Extractor Generation) algorithm) built into the relevant equipment is responsible for processing the biometric information (CH), generating a biometric key (CHK) and an auxiliary recovery value (AR), and storing AR locally (such as USIM); CHK, AR and user A's User ID (used to retrieve CHK and AR) are transmitted to the network side (such as an authentication server, which can be the first network device of this embodiment, such as UDM / UDR) through a secure method, and the network side stores user A's User ID, CHK, and AR. Through the processing shown in FIG8, user A's identity information (AR\CHK\User ID) can be stored on the network side (such as the first network device, such as UDM / UDR), and the AR in the identity information of user A can be written into the USIM card, and the operator can allocate the USIM card with user A's AR written into it to the contracted user A for use. Furthermore, if multiple users can share a USIM card or a terminal corresponding to the USIM card, the identity information is generated for each of the multiple users, and then the same storage method as the identity information of user A is adopted to store the identity information of each user. Part or all of the identity information is stored in the USIM and the network side respectively, wherein the CHK of any user can be calculated through the AR and CH of the user. In some possible implementations, the terminal interacts with the first network device, and the first network device completes authentication processing for the first user using the terminal. Before the terminal sends the first message, the method may further include: the terminal receives the second message. Correspondingly, before the first network device receives the first message, the method may further include: the first network device sends the second message. The first network device sending the second message may refer to: the first network device sending the second message to the terminal through one or more other network devices. The terminal receiving the second message may include: the terminal receiving the second message sent by the first network device through one or more other network devices. The second message carries a verification requirement (Require) for a user using the terminal. The one or more other network devices may include other core network devices, access network devices serving the terminal, etc. The number of the other core network devices may be one or more. Exemplarily, the other core network devices may include a second network device. The description of the second network device is the same as that in the above embodiment and will not be repeated. Before the terminal receives the second message, the processing of the terminal may further include: the terminal sends a verification request to the first network device through one or more other network devices. Correspondingly, before the first network device sends the second message, it may further include: the first network device receives the verification request sent by the terminal through one or more other network devices. The verification request may be a request for authenticating the first user who uses the terminal. It should be understood that this is only a possible example of the terminal triggering the first network device to perform verification. In some other examples, the second network device may send a verification request to the first network device, and the verification request may at least carry the identifier of the terminal. Accordingly, before the first network device sends the second message, the first network device may include: the first network device receives the verification request sent by the second network device. In some possible implementations, after receiving the second message, the terminal may calculate one or more authentication information, where the one or more authentication information is obtained based on the feature information of the first user and feature recovery information of the one or more users. The one or more authentication information is used to authenticate the first user using the terminal, which may mean that the one or more authentication information is used to authenticate the first user, and the first user is a user using the terminal; wherein the first user being a user using the terminal may mean that the first user is a user currently using the terminal, or a user currently needing to use the terminal. After the terminal calculates and obtains one or more authentication information, it sends a first message carrying the one or more authentication information. Accordingly, after the first network device receives the first message, it may include: the first network device authenticates the first user using the terminal based on the one or more authentication information and one or more verification information, wherein the one or more verification information is associated with the identification information of one or more users who can use the terminal, and different verification information is associated with the identification information of different users, and the identification information of each of the one or more users includes at least one of the following: the identifier of each user, the number of each user, and the one or more users include the first user. The first user may refer to the user currently using the terminal. The number of each user may also be referred to as the code of each user, or the serial number of each user, etc. The number of each user may be generated by the first network device, and the number of each user corresponds to the identification of each user. The first network device may also store an association or correspondence between the number of each user and the identification of the user. The user number may be used to uniquely identify a user between the first network device and other network devices. In one embodiment, the one or more authentication information includes one or more feature authentication keys, wherein the one or more feature authentication keys are obtained based on the feature information of the first user and the feature recovery information of the one or more users. The one or more verification information includes a feature key of each user in the one or more users. The characteristic information of the first user may be the biometric information of the first user, or may be the processed biometric information of the first user. The biometric information of the first user may be obtained by the terminal through a collection component. The collection component may include at least one of a camera, a touch collection screen, a sensor, etc. The embodiment does not limit the manner in which the collection component of the terminal obtains the biometric information of the first user. Any one of the one or more authentication information may be a feature authentication key. Taking any one of the authentication information as the i-th feature authentication key (i is a positive integer) as an example, the terminal may calculate the i-th feature authentication key based on the feature information of the first user and the feature recovery information of the i-th user. Exemplarily, the i-th feature authentication key may be expressed as CHK-i*. The i-th user is any one of the one or more users. Wherein, the terminal calculates the i-th feature authentication key based on the feature information of the first user and the feature recovery information of the i-th user, which may be: the terminal adopts a recovery algorithm to calculate the feature information of the first user and the feature recovery information of the i-th user to obtain the i-th feature authentication key. Wherein, the recovery algorithm corresponds to the extraction algorithm, for example, the extraction algorithm may be a Fuzzy Extractor Generation algorithm, and correspondingly, the recovery algorithm may be a fuzzy extraction recovery (Rep, or Fuzzy Extractor Recovery) algorithm. Since the calculation method of each feature authentication key is the same as the calculation method of the i-th feature authentication key, they will not be described one by one. Any one of the one or more verification information is a feature key of any user who can use the terminal. Taking any user as the i-th user as an example, in the first network device, the feature key of the i-th user is associated with the identification of the i-th user who can use the terminal. The specific manner in which the first network device associates and saves the feature key of each user and the identification of each user has been described in detail in the aforementioned embodiment and will not be repeated here. Exemplarily, the feature key of the i-th user can be expressed as CHK-i. The first network device authenticates the first user using the terminal based on the one or more authentication information and the one or more verification information, which may include: the first network device compares the jth feature authentication key among the one or more feature authentication keys with the feature key of each user, and when the jth feature authentication key matches the feature key of the kth user, uses the identifier of the kth user associated with the feature key of the kth user as the identifier of the first user, and determines that the first user using the terminal is authenticated; wherein j and k are both positive integers, and the kth user is any one of the one or more users. The processing of the first network device may also include: when the jth feature authentication key does not match the feature key of each user, the first network device compares the j+1th feature authentication key among the one or more feature authentication keys with the feature key of each user, and so on, until it is determined that the judgment of each feature authentication key is completed. In addition, the method may further include: when the first network device completes the judgment on each feature authentication key and no feature authentication key matches the feature key of any user, it may determine that the authentication of the first user fails. It should be noted that the processing of the first network device may also include: when the jth feature authentication key matches the feature key of the kth user, the first network device uses the jth feature authentication key as the feature authentication key matching the first user. In one embodiment, the one or more authentication information is obtained based on the first parameter and one or more feature authentication keys, and the one or more feature authentication keys are obtained based on the feature information of the first user and the feature recovery information of the one or more users. Correspondingly, the one or more verification information is obtained based on the first parameter and the feature key of each of the one or more users. In this embodiment, the verification information may also be referred to or alternatively represented as protection information; the authentication information may be represented as “protection information*”. The description of the characteristic information of the first user and one or more characteristic authentication keys will not be repeated here. Optionally, the first parameter may be generated by the first network device. When the first parameter is generated by the first network device, the first parameter may be a random number, and this embodiment does not limit the manner in which the first network device generates the random number. In this case, the second message may also carry the first parameter. Optionally, the first parameter may be generated by the terminal or preconfigured. When the first parameter is generated by the terminal, the first parameter may be a random number. This embodiment does not limit the manner in which the terminal generates the random number. When the first parameter is generated by the terminal, the processing of the terminal may further include: the terminal sends the first parameter. Correspondingly, the processing of the first network device may further include: the first network device receives the first parameter. Specifically, the terminal sending the first parameter may include: the terminal sending the first parameter to the first network device. The first network device receiving the first parameter may include: the first network device receives the first parameter sent by the terminal. The terminal may send the first parameter simultaneously with the aforementioned first message, and the first parameter may be carried by the first message. Alternatively, the terminal may carry the first parameter in any uplink message and send it to the first network device before sending the first message. When the first parameter is pre-configured, the first parameter may be the same parameter pre-configured in the terminal and the first network device. For example, the first parameter may be a parameter related to the terminal, and the parameter related to the terminal may be at least one of an identifier of the terminal, a device-related parameter of the terminal, and the like. For example, taking the first parameter as an identifier of the terminal as an example, the first parameter may be the IMSI in the SIM card of the terminal. Taking any authentication information as the i-th authentication information as an example, the terminal calculates the processing method of the i-th authentication information, which may include: the terminal calculates the i-th feature authentication key based on the feature information of the first user and the feature recovery information of the i-th user, and calculates the i-th authentication information based on the first parameter and the i-th feature authentication key using the first calculation method. The first calculation method may include one of the following: a first authentication function (for example, it may be the f1 function defined by 3GPP), a second authentication function (for example, it may be the f2 function defined by 3GPP), a third key generation function (for example, it may be the f3 function defined by 3GPP), a fourth key generation function (for example, it may be the f4 function defined by 3GPP), a fifth key generation function (for example, it may be the f5 function defined by 3GPP), and a hash algorithm. The hash algorithm may include HMAC-SHA-256 (Hash based Message Authentication Code-Secure Hash Algorithm-256, or other hash algorithms, which are not exhaustive in this embodiment. In this embodiment, the first network device calculates the one or more verification information at a time before the first network device sends a second message to the terminal, or after the first network device receives a first message sent by the terminal. Optionally, if the first parameter is preconfigured in both the terminal and the first network device, or the first parameter is generated by the first network device, the first network device may calculate the one or more verification information before sending the second message to the terminal, or the first network device may generate the first parameter. The device calculates one or more verification information after receiving the first message sent by the terminal. Optionally, if the first parameter is generated by the terminal and the first parameter is sent by the terminal to the first network device through other uplink messages before the first network device sends the second message, the first network device may calculate the one or more verification information before sending the second message to the terminal, or calculate the one or more verification information after the first network device receives the first message sent by the terminal. Optionally, if the first parameter is generated by the terminal, and the terminal carries the first parameter in a first message and sends it to the first network device, the first network device calculates one or more verification information after receiving the first message sent by the terminal. Taking any verification information as the i-th verification information as an example, the first network device calculates the i-th verification information in the following manner: the first network device uses a first calculation method to calculate the i-th verification information based on a first parameter and a characteristic key of the i-th user. In addition, when the first network device calculates the i-th verification information, it can also associate the i-th verification information with the identification of the i-th user. Since the calculation method of each verification information is the same as that of the i-th verification information, it will not be described one by one. The first network device authenticates the first user using the terminal based on the one or more authentication information and the one or more verification information, which may include: the first network device compares the j-th authentication information among the one or more authentication information with each verification information, and when the j-th authentication information matches the k-th verification information, uses the identifier of the k-th user associated with the k-th verification information as the identifier of the first user, and determines that the first user using the terminal is authenticated; wherein j and k are both positive integers, and the k-th user is any one of the one or more users. Among them, using the identifier of the kth user associated with the kth verification information as the identifier of the first user may refer to: determining the identification information of the kth user associated with the kth verification information, and when the identification information of the kth user includes the identifier of the kth user, using the identifier of the kth user as the identifier of the first user; and / or determining the identification information of the kth user associated with the kth verification information, and when the identification information of the kth user includes the number of the kth user, using the identifier of the kth user corresponding to the number of the kth user as the identifier of the first user. The processing of the first network device may also include: when the jth authentication information does not match each verification information, the first network device compares the j+1th authentication information among one or more authentication information with each verification information, and so on, until it is determined that the judgment on each authentication information is completed. In addition, the method may further include: when the first network device completes the judgment on each authentication information and no authentication information matches any verification information, it may determine that the authentication of the first user fails. It should be pointed out that the processing of the first network device may also include at least one of the following: when the j-th authentication information matches the k-th verification information, the first network device uses the j-th authentication information as the authentication information matched by the first user; when the j-th authentication information matches the k-th verification information, the first network device uses the feature key of the i-th user associated with the k-th verification information as the feature authentication key matched by the first user. In one embodiment, the one or more authentication information is obtained by encrypting the one or more feature authentication keys based on the first parameter. The one or more authentication information includes a feature key of each user in the one or more users. Taking any authentication information as the i-th authentication information as an example, the processing method for the terminal to calculate the i-th authentication information is described as follows: the terminal calculates the i-th feature authentication key based on the feature information of the first user and the feature recovery information of the i-th user, encrypts the i-th feature authentication key based on the first parameter, obtains the encrypted i-th feature authentication key, and uses the encrypted i-th feature authentication key as the i-th authentication information. Among them, the encryption algorithm used for the encryption calculation is not limited in this embodiment. Exemplarily, the i-th feature authentication key can be expressed as CHK*; the i-th authentication information can be expressed as "encrypted CHK-i*", or the i-th authentication information can also be expressed as "protection information i*". The first network device authenticates the first user using the terminal based on the one or more authentication information and the one or more verification information, including: the first network device decrypts the one or more authentication information based on a first parameter to obtain one or more feature authentication keys; the first network device authenticates the first user using the terminal based on the one or more feature authentication keys and the one or more verification information, wherein the one or more verification information includes a feature key for each of the one or more users. The first network device decrypts the one or more authentication information based on the first parameter to obtain one or more feature authentication keys, which may include: the first network device decrypts the i-th authentication information in the one or more authentication information based on the first parameter to obtain the i-th feature authentication key in the one or more feature authentication keys. The decryption algorithm used in the decryption calculation corresponds to the encryption algorithm, which is not limited in this embodiment. The first network device authenticates the first user using the terminal based on the one or more feature authentication keys and the one or more verification information, which may include: the first network device compares the jth feature authentication key among the one or more feature authentication keys with the feature key of each user, and when the jth feature authentication key matches the feature key of the kth user, uses the identifier of the kth user associated with the feature key of the kth user as the identifier of the first user, and determines that the first user is authenticated; wherein j and k are both positive integers, and the kth user is any one of the one or more users. The processing of the first network device may also include: when the jth feature authentication key does not match the feature key of each user, the first network device compares the j+1th feature authentication key among the one or more feature authentication keys with the feature key of each user, and so on, until it is determined that the judgment of each feature authentication key is completed. In addition, it may also include: when the first network device completes the judgment on each feature authentication key and no feature authentication key matches the feature key of any user, it may determine that the first user authentication of the terminal fails. It should be noted that the processing of the first network device may also include: when the jth feature authentication key matches the feature key of the kth user, the first network device uses the jth feature authentication key as the feature authentication key matching the first user. In some possible implementations, after the first network device receives the first message, the method further includes: the first network device sends a third message. Correspondingly, after the terminal sends the first message, the method further includes: the terminal receives a third message. The first network device sending the third message may include: the first network device sending the third message to the terminal through one or more other network devices. The terminal receiving the third message may include: the terminal receiving the third message sent by the first network device through one or more other network devices. The third message is used to determine the authentication result of the first user. In one case, the third message may implicitly indicate the authentication result of the first user, for example, the terminal may determine the authentication result of the first user through the content carried by the third message. In another case, the third message may explicitly indicate the authentication result of the first user, for example, the third message may carry a first indication, and the first indication is used to indicate the authentication result of the first user. In one embodiment, the third message may implicitly indicate the authentication result of the first user. In this embodiment, the third message carries the identification-related information of the first user, and the identification-related information of the first user includes at least one of the following: the identification of the first user and the temporary identification of the first user. The temporary identification of the first user may be allocated by the first network device, and this embodiment does not limit the generation method of the temporary identification of the first user. After the terminal receives the third message, the method further includes: the terminal saving the identification-related information of the first user. Further, the terminal can determine that the authentication result of the first user is that the first user is authenticated if the third message carries the identification-related information of the first user. That is, after the first network device authenticates the first user, it can implicitly indicate that the first user has been authenticated by carrying the first user's identification-related information in the third message. Correspondingly, when the terminal receives the third message and the third message carries the first user's identification-related information, the terminal can determine that the first user's authentication result is authentication success and save the first user's identification-related information. In one embodiment, the third message may display an authentication result indicating the first user. In this embodiment, the third message may carry a first indication, and the first indication is used to indicate the authentication result of the first user. Accordingly, after receiving the third message, the terminal determines the authentication result of the first network device on the first user based on the first indication carried by the third message. The authentication result of the first user may include: the authentication of the first user is passed, or the authentication of the first user is not passed. The authentication of the first user is passed, which may refer to: the authentication of the first user using the terminal is passed, or the authentication of the first user using the terminal is successful, or the identity authentication of the first user using the terminal is successful (or passed), etc. The authentication of the first user is not passed, which may refer to: the authentication of the first user using the terminal is not passed, or the authentication of the first user using the terminal fails, or the identity authentication of the first user using the terminal fails (or fails), etc. Optionally, when the first indication carried in the third message is used to indicate that the first user is authenticated successfully, the third message may also carry information related to the identification of the first user. Accordingly, after the terminal receives the third message, the terminal may save the information related to the identification of the first user. Further, the terminal may determine, based on the first indication, that the authentication result of the first user is that the first user is authenticated successfully. Optionally, when the first indication carried by the third message is used to indicate that the authentication of the first user is not passed, the third message may not carry other content. Accordingly, after the terminal receives the third message, the terminal may determine that the authentication result of the first user is that the authentication of the first user is not passed based on the first indication. In one embodiment, the terminal saves the identification-related information of the first user, which may include at least one of the following: the terminal saves the correspondence between the identification-related information of the first user and the authentication information matching the first user; the terminal saves the correspondence between the identification-related information of the first user and the first parameter matching the first user. The third message may also carry at least one of the following: authentication information matched by the first user, and a feature authentication key matched by the first user. The manner in which the first network device determines at least one of the authentication information matched by the first user and the feature authentication key matched by the first user has been described in detail in the aforementioned embodiment and will not be repeated here. Optionally, the third message may carry authentication information matched by the first user. In this case, the terminal stores the corresponding relationship between the identification-related information of the first user and the authentication information matched by the first user. Optionally, the third message may also carry a feature authentication key that matches the first user. In this case, the terminal stores the corresponding relationship between the identification-related information of the first user and the feature authentication key that matches the first user. Optionally, the third message carries authentication information matched by the first user and a feature authentication key matched by the first user. In this case, the terminal stores the corresponding relationship between the identification-related information of the first user and the authentication information matched by the first user, and the terminal stores the corresponding relationship between the identification-related information of the first user and the feature authentication key matched by the first user. After the terminal saves the correspondence between the identification-related information of the first user and the authentication information matching the first user, and / or the terminal saves the correspondence between the identification-related information of the first user and the first parameter matching the first user, the processing of the terminal may further include at least one of the following: In one case, when the terminal obtains the feature information of the second user, the terminal obtains one or more feature authentication keys corresponding to the second user based on the feature information of the second user and feature recovery information of one or more users; when the one or more feature authentication keys corresponding to the second user are the same as the feature authentication keys matched with the first user, it can be directly determined that the second user is the same user as the first user, and the identification related information of the first user is used for subsequent communication; In one case, when the terminal obtains the characteristic information of the second user, the terminal obtains one or more characteristic authentication keys corresponding to the second user based on the characteristic information of the second user and characteristic recovery information of one or more users, and obtains one or more authentication information corresponding to the second user based on the one or more characteristic authentication keys and the first parameter; when the one or more authentication information corresponding to the second user is the same as the authentication information matching the first user, it can be directly determined that the second user is the same user as the first user, and the identification-related information of the first user can be used for subsequent communication. In addition, the processing of the terminal may further include: when it is determined that the second user is different from the first user, the second user may be treated as a new first user and the same authentication process as the first user is performed, which will not be repeated here. After such processing, the next time the same user logs in or uses the terminal (for example, after locking the screen, unlocking it again with a fingerprint), when the terminal generates the same CHK* (i.e., feature authentication key) or "protection information*" (i.e., authentication information), the user's identity (or user identity) and / or the user's temporary identity (or temporary user identity) can be directly confirmed. In some possible implementations, the terminal interacts with the second network device and the first network device, and the first network device and the second network device jointly implement authentication processing for a first user using the terminal. In this implementation manner, before the terminal sends the first message, the method may further include: the terminal receives a second message. The terminal receiving the second message includes: the terminal receiving the second message sent by the second network device. Correspondingly, before the second network device receives the first message sent by the terminal, it may also include: the second network device receives the fifth message sent by the first network device, wherein the fifth message carries the one or more verification information; the second network device sends a second message to the terminal, wherein the second message carries the verification requirements for the user using the terminal. The processing by the first network device may include: the first network device sends a fifth message to the second network device, wherein the fifth message carries one or more verification information. Optionally, in addition to carrying the one or more verification information, the fifth message may also carry a verification requirement (Require) for a user using the terminal. The processing of the second network device sending the second message to the terminal may include: after the second network device receives the fifth message, the second network device saves one or more verification information in the fifth message locally, and the second network device sends the second message to the terminal, and the second message carries the verification requirement (Require) for the user using the terminal. It should be understood that the second network device can also send the second message to the terminal through one or more other network devices, and the one or more other network devices may include the access network device corresponding to the terminal, other core network devices, etc., which are not exhaustively listed and limited here. In some embodiments, before the terminal receives the second message, the processing of the terminal may further include: the terminal sends a verification request to the first network device through one or more other network devices. Correspondingly, before the first network device sends the fifth message to the second network device, the processing may further include: the first network device receives the verification request sent by the terminal. The first network device may receive the verification request sent by the terminal through the second network device and the one or more other network devices. It should be understood that this is only a possible example of the terminal triggering the first network device to perform verification. In some other examples, the second network device may send a verification request to the first network device, and the verification request may at least carry the identifier of the terminal. Accordingly, before the first network device sends the fifth message to the second network device, it may include: the first network device receives the verification request sent by the second network device. In some possible implementations, after receiving the second message, the terminal may calculate one or more authentication information, where the one or more authentication information is obtained based on the feature information of the first user and feature recovery information of the one or more users. After the terminal calculates and obtains one or more authentication information, the terminal sends a first message carrying the one or more authentication information. In this embodiment, the terminal sending the first message may include: the terminal sending the first message to the second network device. Accordingly, after the second network device receives the first message sent by the terminal and before the second network device sends the fourth message to the first network device, one of the following may be included: the second network device determines the first verification information from the one or more verification information based on the one or more authentication information; the second network device determines the first verification information from the one or more verification information based on the one or more authentication information. or determine first verification information from multiple verification information, and determine identification information of a user associated with the first verification information. After the first network device receives the fourth message sent by the second network device, the method may include: the first network device determines the identification of the first user based on the verification result, and determines that the first user who uses the terminal is authenticated. The verification result includes at least one of the following: first verification information, identification information of a user associated with the first verification information, and the first verification information is one of the one or more verification information. In one embodiment, the one or more authentication information includes one or more feature authentication keys, wherein the one or more feature authentication keys are obtained based on the feature information of the first user and the feature recovery information of the one or more users. The one or more verification information includes a feature key of each user in the one or more users. The characteristic information of the first user and the description of the terminal calculating each characteristic authentication key are the same as those in the above embodiment and will not be repeated. Also, as in the above embodiment, any characteristic authentication key can be represented as CHK-i*. In the first network device, the one or more verification information are associated with identification information of one or more users who can use the terminal, and the identification information of each of the one or more users includes at least one of the following: an identifier of each user, a number of each user, and the one or more users include the first user. Optionally, the fifth message sent by the first network device to the second network device carries one or more verification information. In this case, any one of the one or more verification information is a feature key of any user who can use the terminal. In the first network device, the feature key of each of the one or more users is associated with the identifier of each user and the feature recovery information of each user and is stored; in the second network device, only the feature key of each user obtained through the fifth message (as verification information) is stored. The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, which may include: the second network device compares the j-th feature authentication key among the one or more feature authentication keys with the feature key of each user, and when the j-th feature authentication key matches the feature key of the k-th user, uses the feature key of the k-th user as the first verification information. The processing of the second network device may also include: when the jth feature authentication key does not match the feature key of each user, the second network device compares the j+1th feature authentication key of one or more feature authentication keys with the feature key of each user, and so on, until it is determined that the judgment of each feature authentication key is completed. In addition, it may also include: when the second network device completes the judgment of each feature authentication key and no feature authentication key matches the feature key of any user, the second network device sends a verification result to the first network device, and the verification result is used to indicate that one or more authentication information has no matching verification information. In this case, the verification result carried by the fourth message may only include the first verification information. Further, since each verification information in this embodiment is a feature key, the first verification information refers to the first feature key of the user. After the first network device receives the fourth message sent by the second network device, the method further includes: the first network device determines the identification of the first user based on the verification result, and determines that the first user who uses the terminal is authenticated. Specifically, the first network device determines the identification of the user associated with the first feature key of the user in the verification result, uses the identification of the user as the identification of the first user, and determines that the first user who uses the terminal is authenticated. Optionally, the fifth message sent by the first network device to the second network device carries one or more verification information, and the fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users, the one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user. In this case, any one of the one or more verification information is a feature key of any user who can use the terminal. In the first network device, the feature key of each of the one or more users is associated with the identifier of each user and the feature recovery information of each user and saved, and the first network device can also assign a user number corresponding to the identifier of each user; the second network device can obtain the feature key of each user (as verification information) and the identification information of the user associated with the feature key of each user through the fifth message. The number of each user may also be referred to as the code of each user, or the serial number of each user. The number of each user may be generated by the first network device, and the number of each user corresponds to the identification of each user. The function of the number of the user may be to uniquely identify a user at least between the first network device and the second network device. Exemplarily, the correspondence between the number of user A and the identification of user A is stored on the first network device side, so that user A can be uniquely identified at least by transmitting the number of user A between the first network device and the second network device. The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, and determines the identification information of the user associated with the first verification information, which may include: the second network device compares the j-th feature authentication key of the one or more feature authentication keys with the feature key of each user, and when the j-th feature authentication key matches the feature key of the k-th user, uses the feature key of the k-th user as the first verification information, and determines the first verification information. Identification information of the user associated with the information. The processing of the second network device may also include: when the jth feature authentication key does not match the feature key of each user, the second network device compares the j+1th feature authentication key of one or more feature authentication keys with the feature key of each user, and so on, until it is determined that the judgment of each feature authentication key is completed. In addition, it may also include: when the second network device completes the judgment of each feature authentication key and no feature authentication key matches the feature key of any user, the second network device sends a verification result to the first network device, and the verification result is used to indicate that one or more authentication information has no matching verification information. In this case, the verification result carried by the fourth message may include at least one of the first verification information and the identification information of the user associated with the first verification information. Further, since each verification information in this embodiment is a feature key of each user, the first verification information may be the first feature key of the user. The first network device determines the identification of the first user based on the verification result, and determines that the first user who uses the terminal is authenticated, which may include at least one of the following: The first network device extracts the first feature key of the user in the verification result, obtains the identifier of the user associated with the first feature key of the user, uses the identifier of the user as the identifier of the first user, and determines that the first user using the terminal is authenticated; The first network device directly uses the user identifier associated with the first feature key of the user in the verification result as the identifier of the first user, and determines that the first user using the terminal is authenticated; The first network device extracts the user number associated with the user's first feature key in the verification result, uses the user identifier corresponding to the user number as the identifier of the first user, and determines that the first user using the terminal is authenticated. It should be noted that the processing of the first network device may also include: the first network device uses the first feature key of the user as a feature authentication key matched by the first user. In one embodiment, on the terminal side, the one or more authentication information is obtained based on the first parameter and one or more feature authentication keys, and the one or more feature authentication keys are obtained based on the feature information of the first user and the feature recovery information of the one or more users. On the first network device side, the one or more verification information is obtained based on the first parameter and the feature key of each of the one or more users. Optionally, the first parameter may be generated by the first network device. When the first parameter is generated by the first network device, the first parameter may be a random number, and this embodiment does not limit the manner in which the first network device generates the random number. In this case, the fifth message also carries the first parameter, and the second message also carries the first parameter. That is, the first network device sends the first parameter to the second network device through the fifth message, and the second network device sends the first parameter to the terminal through the second message. Optionally, the first parameter may be generated by the terminal. When the first parameter is generated by the terminal, the first parameter may be a random number, and this embodiment does not limit the manner in which the terminal generates the random number. When the first parameter is generated by the terminal, the processing of the terminal may further include: the terminal sending the first parameter. Specifically, the terminal sending the first parameter may include: before the terminal sends the first message, the terminal sends the first parameter to the second network device. The terminal may carry the first parameter in any uplink message and send it to the second network device before sending the first message. Correspondingly, before the second network device receives the fifth message sent by the first network device, the method further includes: the second network device receives the first parameter sent by the terminal; the second network device sends the first parameter to the first network device. Before the first network device sends the fifth message to the second network device, the method further includes: the first network device receives the first parameter sent by the second network device. Optionally, the first parameter is preconfigured. When the first parameter is preconfigured, the first parameter may be the same parameter preconfigured in the terminal and the first network device. For example, the first parameter may be a relevant parameter of the terminal, and the relevant parameter of the terminal may be at least one of an identifier of the terminal, a device-related parameter of the terminal, and the like. The processing method for the terminal to calculate any authentication information is the same as that in the above embodiment, and will not be repeated here. On the side of the first network device, the one or more verification information are obtained based on the first parameter and the characteristic key of each user among one or more users. Among them, one or more verification information may also be one or more protection information; correspondingly, one or more authentication information may also be expressed as one or more "protection information*". The way in which the first network device calculates any verification information is the same as that in the aforementioned embodiment, and will not be repeated. In addition, when the first network device calculates any verification information, it may also associate the verification information with the user's identification. It should be pointed out that the first network device calculates the one or more verification information before the first network device sends the fifth message to the second network device. Optionally, the fifth message sent by the first network device to the second network device carries one or more verification information. In this case, the first network device may store the following content: the one or more verification information is associated with identification information of one or more users who can use the terminal, and different verification information is associated with identification information of different users, and the one or more users include the The second network device only has the verification information obtained through the fifth message. The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, which may include: the second network device compares the j-th authentication information in the one or more authentication information with each verification information respectively, and when the j-th authentication information matches the k-th verification information, uses the k-th verification information as the first verification information. The processing of the second network device may also include: when the jth authentication information does not match each verification information, the first network device compares the j+1th authentication information of one or more authentication information with each verification information, and so on, until it is determined that the judgment of each authentication information is completed. In addition, it may also include: when the second network device completes the judgment of each authentication information and no authentication information matches the verification information of any user, the second network device sends a verification result to the first network device, and the verification result is used to indicate that one or more authentication information has no matching verification information. In this case, the verification result carried by the fourth message may only include the first verification information. After the first network device receives the fourth message sent by the second network device, the method further includes: the first network device determines the identifier of the first user based on the verification result, and determines that the first user who uses the terminal is authenticated. Specifically, the first network device determines the identification information of the user associated with the first verification information in the verification result, determines the identifier of the user based on the identification information of the user, uses the identifier of the user as the identifier of the first user, and determines that the first user who uses the terminal is authenticated. Wherein, determining the identifier of the user based on the identification information of the user may include: directly determining the identifier of the user when the identification information of the user includes the identifier of the user; and / or determining the identifier of the user corresponding to the number of the user when the identification information of the user includes the number of the user. Optionally, the fifth message sent by the first network device to the second network device carries one or more verification information, and the fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users, the one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user. In this case, the following contents are saved in the first network device: the one or more verification information are associated with the identifiers of one or more users who can use the terminal, and different verification information are associated with the identifiers of different users, and the one or more users include the first user; each verification information that can be obtained by the second network device through the fifth message, and the identification information of the user associated with each verification information. The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, and determines the identification information of the user associated with the first verification information, which may include: the second network device compares the j-th authentication information in the one or more authentication information with each verification information respectively, and when the j-th authentication information matches the k-th verification information, uses the k-th verification information as the first verification information, and determines the identification information of the user associated with the first verification information. The processing of the second network device may also include: when the jth authentication information does not match each verification information, the first network device compares the j+1th authentication information of one or more authentication information with each verification information, and so on, until it is determined that the judgment of each authentication information is completed. In addition, it may also include: when the second network device completes the judgment of each authentication information and no authentication information matches the verification information of any user, the second network device sends a verification result to the first network device, and the verification result is used to indicate that one or more authentication information has no matching verification information. In this case, the verification result carried by the fourth message may include at least one of the first verification information and identification information of a user associated with the first verification information. The first network device determines the identification of the first user based on the verification result, and determines that the first user who uses the terminal is authenticated, which may include at least one of the following: The first network device extracts the first verification information in the verification result, obtains the identifier of the user associated with the first verification information, uses the identifier of the user as the identifier of the first user, and determines that the first user using the terminal is authenticated; The first network device directly uses the identifier of the user associated with the first verification information in the verification result as the identifier of the first user, and determines that the authentication of the first user using the terminal is passed; The first network device extracts the user number associated with the first verification information in the verification result, uses the user identifier corresponding to the user number as the identifier of the first user, and determines that the first user using the terminal is authenticated. It should be noted that the processing by the first network device may also include: the first network device uses the first verification information as authentication information matched by the first user. In one embodiment, the one or more authentication information is obtained by encrypting the one or more feature authentication keys based on the first parameter. The one or more authentication information includes a feature key of each user in the one or more users. The processing method for the terminal to calculate each i-th authentication information is the same as that in the above-mentioned embodiment, and will not be repeated here. Optionally, the fifth message sent by the first network device to the second network device carries one or more verification information. In this case, any one of the one or more verification information is a feature key of any user who can use the terminal. In the first network device, the feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user; in the second network device, only the feature key of each user obtained through the fifth message (as verification information) is available. The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, including: the second network device decrypts the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; the second network device determines the first verification information from the one or more verification information based on the one or more feature authentication keys, wherein the one or more verification information includes a feature key of each user in one or more users. The decryption algorithm used in the decryption calculation corresponds to the encryption algorithm, which is not limited in this embodiment. The second network device determines the first verification information from the one or more verification information based on the one or more feature authentication keys, which may include: the second network device compares the jth feature authentication key of the one or more feature authentication keys with the feature key of each user, and when the jth feature authentication key matches the feature key of the kth user, uses the feature key of the kth user as the first verification information. The processing of the second network device may also include: when the second network device completes the judgment of each feature authentication key and no feature authentication key matches the feature key of any user, the second network device sends a verification result to the first network device, and the verification result is used to indicate that one or more authentication information has no matching verification information. In this case, the verification result carried by the fourth message may only include the first verification information. Further, since each verification information in this embodiment is a feature key, the first verification information refers to the first feature key of the user. Accordingly, the processing of the first network device is the same as that of the first network device in the aforementioned embodiment when the fourth message carries the first verification information and the first verification information is specifically the first feature key of the user, so it will not be repeated. Optionally, the fifth message sent by the first network device to the second network device carries one or more verification information, and the fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users, the one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user. In this case, any one of the one or more verification information is a feature key of any user who can use the terminal. In the first network device, the feature key of each of the one or more users is associated with the identifier of each user and the feature recovery information of each user and saved, and the first network device can also assign a user number corresponding to the identifier of each user; the second network device can obtain the feature key of each user (as verification information) and the identification information of the user associated with the feature key of each user through the fifth message. The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, and determines the identification information of the user associated with the first verification information, which may include: the second network device decrypts the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; the second network device determines the first verification information from the one or more verification information based on the one or more feature authentication keys, and determines the identification information of the user associated with the first verification information. Among them, the second network device decrypts the one or more authentication information based on the first parameter to obtain one or more feature authentication keys, and the second network device determines the first verification information from the one or more verification information based on the one or more feature authentication keys, are the same as the above-mentioned embodiments, and are not described in detail. In this case, the verification result carried by the fourth message may include at least one of the first verification information and the identification information of the user associated with the first verification information. Further, since each verification information in this embodiment is a feature key for each user, the first verification information may be the first feature key of the user. Regarding the processing of the first network device, the relevant processing of the first network device is the same as in the case where the fourth message carries the first verification information and the identification information of the user associated with it, and the first verification information is specifically the first feature key of the user in the aforementioned embodiment, so it will not be repeated. In some possible implementations, after the first network device receives the fourth message sent by the second network device, the method further includes: the first network device sends a sixth message to the second network device. After the second network device sends the fourth message to the first network device, the method further includes: the second network device receives the sixth message sent by the first network device, wherein the sixth message carries the identifier of the first user; the second network device sends a third message to the terminal, wherein the third message carries the identifier-related information of the first user, and the identifier-related information of the first user includes at least one of the following: the identifier of the first user, and the temporary identifier of the first user. Correspondingly, after the terminal sends the first message, the method further includes: the terminal receiving a third message. Wherein, the terminal receiving the third message means: the terminal receiving the third message sent by the second network device. Optionally, the sixth message also carries a temporary identifier of the first user, and the method further comprises: the first network device assigns a temporary identifier of the first user. In this case, the second network device may carry the identifier of the first user and the temporary identifier of the first user in the third message sent to the terminal; or the second network device may only carry the temporary identifier of the first user in the third message. Optionally, the first network device does not allocate a temporary identifier for the first user, and the second network device allocates a temporary identifier for the first user. In this case, the sixth message carries only the identifier of the first user. The second network device sends a third Before the second network device sends the temporary identifier of the first user to the third message, the method further includes: the second network device assigns a temporary identifier of the first user. After the second network device assigns the temporary identifier of the first user, the second network device may carry the identifier of the first user and the temporary identifier of the first user in the third message; or the second network device may only carry the temporary identifier of the first user in the third message. The third message is used by the terminal to determine the authentication result of the first user; correspondingly, the sixth message can also be used by the terminal to determine the authentication result of the first user. The third message (and the sixth message) is used to determine the authentication result of the first user. There may be two possible situations. In one situation, the third message (and the sixth message) may implicitly indicate the authentication result of the first user, for example, the terminal may determine the authentication result of the first user through the content carried by the third message (and the sixth message). In another situation, the third message (and the sixth message) may explicitly indicate the authentication result of the first user, for example, the third message (and the sixth message) may carry a first indication, and the first indication is used to indicate the authentication result of the first user. In one embodiment, the third message and the sixth message may implicitly indicate the authentication result of the first user. In this embodiment, the sixth message carries the identifier of the first user, or the sixth message carries the identifier of the first user and the temporary identifier of the first user; accordingly, the third message carries the identifier-related information of the first user. After the terminal receives the third message sent by the second network device, the method further includes: the terminal saves the identifier-related information of the first user. Further, the terminal can determine that the authentication result of the first user is that the first user is authenticated if the third message carries the identifier-related information of the first user. That is, after determining that the first user has been authenticated, the first network device can implicitly indicate that the first user has been authenticated by carrying at least the identifier of the first user in the sixth message. After receiving the sixth message on the second network device side, the third message is sent to the terminal. Accordingly, when the terminal receives the third message sent by the second network device and the third message carries the identifier-related information of the first user, the terminal can determine that the authentication result of the first user is authenticated and save the identifier-related information of the first user. In one embodiment, the third message and the sixth message may display an authentication result indicating the first user. In this embodiment, the sixth message may carry a first indication, and the first indication is used to indicate the authentication result of the first user. Correspondingly, the third message also carries the first indication. After receiving the third message sent by the second network device, the terminal determines the authentication result of the first network device for the first user based on the first indication carried by the third message. The authentication result of the first user may include: the authentication of the first user is passed, or the authentication of the first user is failed. Optionally, when the first indication carried in the sixth message is used to indicate that the first user is authenticated, the sixth message may also carry the identifier of the first user, or the sixth message may carry the identifier of the first user and the temporary identifier of the first user; accordingly, the third message may carry the first indication indicating that the first user is authenticated and the identifier-related information of the first user. After the terminal receives the third message sent by the second network device, the terminal may save the identifier-related information of the first user. Further, the terminal may determine that the authentication result of the first user is that the first user is authenticated based on the first indication. Optionally, when the first indication carried by the sixth message is used to indicate that the authentication of the first user is not passed, the sixth message may no longer carry other content; accordingly, the third message may also only carry the first indication used to indicate that the authentication of the first user is not passed, without carrying other content. After the terminal receives the third message sent by the second network device, the terminal may determine, based on the first indication, that the authentication result of the first user is that the authentication of the first user is not passed. In one embodiment, the terminal saves the identification-related information of the first user, which may include at least one of the following: the terminal saves the correspondence between the identification-related information of the first user and the authentication information matching the first user; the terminal saves the correspondence between the identification-related information of the first user and the first parameter matching the first user. The sixth message may also carry at least one of the following: authentication information matched by the first user, and a feature authentication key matched by the first user. The manner in which the first network device determines at least one of the authentication information matched by the first user and the feature authentication key matched by the first user has been described in detail in the aforementioned embodiment and will not be repeated here. Similarly, the third message may also carry at least one of the following: authentication information matched by the first user, and a feature authentication key matched by the first user. Regarding the relevant processing of the terminal saving the correspondence between the identification-related information of the first user and the authentication information matching the first user after the terminal receives the third message, and / or the corresponding processing of the terminal saving the identification-related information of the first user and the first parameter matching the first user, they are the same as the above-mentioned embodiments and will not be elaborated upon. In conjunction with Figure 11, the relevant principles of the authentication method provided in this embodiment are exemplified. On the basis that the USIM card of the terminal stores the user's feature recovery information (such as the AR in Figure 11) and the network side stores the user's identity information (including AR / CHK / user ID), it is assumed that user A enters biometric information CH' at the terminal (this information may be different from the CH in the registration phase), and then the terminal uses the user's AR stored in the local USIM and uses algorithm B (such as the fuzzy extraction technology Rep (Fuzzy Extractor Recovery) algorithm) to take CH' and the user's AR as input to obtain the output CHK*. At this time, the user and the network side have the same secret information (such as the CHK* corresponding to the user and the CHK on the network side). Based on the uniqueness of the biometrics, the secret information is unique. At this time, a (single or two-way) authentication process (such as the interactive process of EAP-PSK) can be implemented based on the secret information. Furthermore, if the terminal side The USIM card stores the identity information of multiple users (specifically, the AR of multiple users). Since the terminal cannot distinguish which user is currently using the terminal, it is necessary to use the processing method shown in Figure 11 to use each stored identity information (here refers to the AR of each user) and the current user's biometric information (here refers to the biometric information of user A) to generate CHK* for authentication of the user currently using the terminal. The authentication method provided in this embodiment is exemplarily described below in combination with various embodiments. In conjunction with Figure 12, taking the terminal as a UE (UE / USIM in Figure 12 is illustrated to indicate feature recovery information of one or more users pre-configured in the USIM of the UE), the first network device as a UDM / UDR, and the second network device as a verification network element as an example, an exemplary description of the aforementioned authentication method is given: Step 1200 (optional): The verification request is triggered by the UE, AMF or a node in the verification network element. If the verification request is triggered by the UE, the AMF and the verification network element are required to forward the request to the UDM / UDR, or the AMF or the verification network element directly sends the verification request to the UDM / UDR. Step 1201: UDM / UDR triggers a verification requirement (require). The verification requirement may carry at least one of the following: a first parameter (optional), protection information, a number or an identifier. Among them, the protection information may be one or more, and the one or more protection information is the one or more verification information in the aforementioned embodiment; the number refers to the user's number, and the identifier refers to the user's identifier, and the number or identifier is the user's identification information in the aforementioned embodiment. The verification requirement may be sent by the UDM / UDR to the verification network element, and the verification requirement may be the fifth message in the aforementioned embodiment. The first parameter is used to generate protection information* (i.e., one or more authentication information in the aforementioned embodiment) on the UE side, and the first parameter may be a random value randomly generated by the UDM / UDR or a parameter related to the UE. If the verification requirement does not contain a "first parameter", the UE and the UDM / UDR may use a statically configured or agreed "first parameter", such as using the IMSI stored in the SIM card of the UE as the first parameter for the subsequent authentication steps; Protection information, and its corresponding user identifier or number (optional). The protection information is generated by a specific algorithm (such as a HASH algorithm, not limited here) through the CHK (i.e., the characteristic key of each user in the aforementioned embodiment) corresponding to the user (user identifier) ​​and the first parameter. With reference to Figure 13, if the IMSI / SUPI of a UE corresponds to multiple users, such as user A (identifier), user B (identifier), and user C (identifier) ​​in Figure 13, then the "protection information" corresponding to each user is generated based on each user's CHK (i.e., CHK-A, CHK-B, CHK-C in Figure 13) and the first parameter. For example, in Figure 13, protection information A corresponding to user A, protection information B for user B, and protection information C corresponding to user C are generated respectively. The protection information is used for subsequent verification and comparison by the user. When the protection information is carried in this message, it will be kept by the verification network element (see step 1202). It should be noted that the user ID (or user ID) refers to the ID assigned by the operator to the user, which is an unchanging parameter. The number can be a number temporarily assigned to each user to correspond to different protection information, and the UDM / UDR can also correspond to the actual user ID. Step 1202: The verification network element receives the verification request from the UDM / UDR and stores the protection information (if any) for subsequent verification. Step 1203-Step 1204: The verification network element sends a verification request to the AMF, and if there is a first parameter, it is sent to the AMF; the AMF sends a downlink NAS message to the UE such as the verification request, and if there is a first parameter, it carries the first parameter and sends it to the UE. The verification request sent by the verification network element to the UE through the AMF may be the second message in the aforementioned embodiment. Step 1205: After receiving the verification request, the UE generates CHK* (ie, one or more feature authentication keys in the aforementioned embodiments) according to the user's biometric information. For example, it is generated using the terminal side method in Figure 11, and no repetition is given here. In the UE, if the auxiliary information AR of multiple users (i.e., the feature recovery information of each user in one or more users in the aforementioned embodiment) is entered into the USIM card, for example, the three users are user A, user B, and user C, then it is necessary to use the biometric information of the three users and each AR stored in the USIM to generate three CHK-A*, CHK-B*, and CHK-C* respectively. It should be understood that the method of generating each CHK* is not limited to the method shown in Figure 11, and CHK* can also be generated based on biometric information using other parameters and algorithms, which are not exhaustively listed and limited here. Step 1206: After generating one or more CHK*, the UE uses the first parameter and CHK* as input to generate "protection information*" (the protection information* is the authentication information in the aforementioned embodiment). Here, the generation algorithm for generating the protection information* is not limited or exhaustive, for example, it can be a hash algorithm. It should be understood that if the USIM card stores auxiliary information AR of multiple users, then "protection information*" of each of the multiple users is generated. The processing is consistent with the principle of UDM / UDR generating one or more protection information in step 1201. Step 1207-Step 1208: The UE sends the generated "protection information*" to the AMF via an uplink NAS message such as a verification reply, and the AMF sends the verification reply to the verification network element. The verification reply may be the first message in the aforementioned embodiment. Step 1209: The verification network element obtains one or more "protection information*" from the AMF, and compares the protection information stored in step 1202 with the received protection information* to obtain a verification result. The verification network element can determine which protection information* is consistent with the protection information* (or within a certain error range), and this comparison can be a many-to-many comparison. In conjunction with Figure 14, taking users A, B, and C as an example, the AR of user A, the AR of user B, and the AR of user C are saved in the UE / USIM, and the biometric information of user B is respectively calculated with the above multiple ARs to obtain CHK-A*, CHK-B*, and CHK-C*; then based on the first parameter and CHK-A*, CHK-B*, and CHK-C*, protection information A*, protection information B*, and protection information C* are respectively calculated. Since the UE inputs the biometric information of user B, only the CHK-B* generated using the AR corresponding to user B is correct, and then only the "protection information*" corresponding to user B is correct. Since the protection information of users A, B, and C generated by the UDM / UDR are all generated using the correct CHK, the protection information A, protection information B, and protection information C received by the network side network element (in this example, it can be the verification network element) from the UDM / UDR are all correct. In this way, the network side network element (which can be the verification network element in this example) can compare that only the "protection information*" corresponding to user B is consistent with the "protection information" received from the UDM / UDR. It should be understood that this example is explained by taking the network side network element as the verification network element as an example. In actual processing, the network side network element in the scenario shown in Figure 14 can also be replaced by other possible network elements, but this example is not exhaustive, and Figure 14 is not intended to limit all possible scenarios. It should be noted that this comparison process may require that each protection information x* be compared with each protection information x one by one. For example, the existing protection information A* is compared with the protection information A / B / C respectively, and then the protection information B* is compared with the protection information A / B / C respectively, and so on. In the end, only one protection information x* and the corresponding protection information x can be compared and found to be consistent. Step 1210: The verification network element sends the verification result, i.e., the protection information that matches, one or more of the corresponding user identification or number, to the UDM / UDR, and the UDM / UDR determines the user identity of the terminal (determines the user identification) based on the verification result. If the verification network element only sends the protection information to the UDM / UDR, the UDM / UDR can determine the user identity based on the correspondence between the verification information and the user identification stored locally. The verification result can be carried by the fourth message in the aforementioned embodiment. It should also be pointed out that the comparison in the process of Figure 12 is performed on the verification network element, but it can also be performed on other network elements, such as sending the "protection information*" to the UDM / UDR for comparison. In addition, since the "protection information" is used for comparison, the algorithm for generating the protection information can be a one-way irreversible algorithm, such as the HASH algorithm, so that CHK cannot be inferred based on the "protection information", ensuring the security of CHK. In conjunction with Figure 15, taking the terminal as a UE (UE / USIM is illustrated in Figure 12 to indicate feature recovery information of one or more users pre-configured in the USIM of the UE), the first network device as a UDM / UDR, and the second network device as a verification network element as an example, another exemplary description of the aforementioned authentication method is given: Step 1500 is the same as step 1200, and the steps are described repeatedly. Step 1501 is similar to step 1201, except that it is not necessary to carry the "protection information" because the "protection information" is saved by the UDM / UDR and used for subsequent verification. Steps 1502 to 1503 are similar to steps 1203 to 1204, except that the verification network element does not need to save information, and thus will not be described repeatedly. Step 1504: After receiving the verification request, the UE generates CHK* according to the user's biometric information; wherein the number of CHK* may be one or more, namely, one or more feature authentication keys in the aforementioned embodiment. Step 1505: After the UE generates one or more CHK*, it generates "protection information*" (the protection information* is the authentication information in the aforementioned embodiment) based on the first parameter and each CHK*. Here, the algorithm for generating each "protection information*" from each CHK* and the first parameter needs to be a reversible algorithm, that is, the CHK* can be decrypted by the other end for comparison. Generally, an algorithm similar to symmetric encryption can be used, which is not limited here. Step 1506 is the same as the aforementioned step 1207 and will not be described in detail. Step 1507: AMF sends a message carrying one or more "protection information*" to UDM / UDR. For example, it can be sent through the verification network element or directly. Step 1508: UDM / UDR uses the first parameter to perform reverse reasoning (decryption) on each "protected information*" to obtain each CHK*, and compares it with each CHK corresponding to the IMSI / SUPI stored in UDM / UDR to obtain a CHK that can be matched, and its corresponding user identifier is the user currently using the terminal. For example, in conjunction with FIG. 16, an exemplary description is given. Taking users A, B, and C as an example, the AR of user A, the AR of user B, and the AR of user C are stored in the UE / USIM. The biometric information of user B is respectively calculated with the above multiple ARs to obtain CHK-A*, CHK-B*, and CHK-C*; then, based on the first parameter and CHK-A*, CHK-B*, and CHK-C*, encryption calculations are performed to obtain protection information A*, protection information B*, and protection information C*. Since the UE inputs the biometric information of user B, only the CHK-B* generated using the AR corresponding to user B is correct, and thus only the "protection information*" corresponding to user B is correct. The network side network element (such as UDM / UDR) decrypts and calculates based on the first parameter and protection information A*, protection information B* and protection information C*, respectively, to obtain CHK-A*, CHK-B*, CHK-C*, and compares CHK-A*, CHK-B*, CHK-C* with its own stored CHK-A, CHK-B, CHK-C; since the CHK-A, CHK-B, CHK-C stored by the network side network element (such as UDM / UDR) are all correct, the network side network element (such as UDM / UDR) can compare and find out that only the CHK-B* corresponding to user B is consistent with the CHK-B stored by the network side network element (such as UDM / UDR). It should be understood that this example is based on the example of the network side network element being UDM / UDR. It is noted that in actual processing, the network-side network elements in the scenario illustrated in FIG16 may also be replaced by other possible network elements, such as verification network elements, etc. However, this example is not exhaustive, and FIG16 is not intended to limit all possible scenarios. It should be understood that encryption / decryption can prevent CHK from being directly transmitted, thereby improving security. However, this solution can also transmit CHK directly. If this is the case, there is no need for the terminal or network side to generate "protection information". In the process shown in Figure 15, UDM / UDR is allowed to compare CHK because CHK is relatively sensitive information and should not be exposed to other network elements or nodes, which is safer. However, this solution can also be extended to allow other nodes to perform CHK comparisons, such as allowing the verification network element to perform CHK comparisons. If this is the case, step 1501 needs to include protection information, corresponding algorithms, or a displayed CHK list given to the verification network element. The relevant processing has been detailed in the previous embodiment and will not be repeated here. In conjunction with Figure 17, taking the terminal as a UE (UE / USIM in Figure 17 is illustrated to indicate feature recovery information of one or more users pre-configured in the USIM of the UE), the first network device as a UDM / UDR, and the second network device as a verification network element as an example, another exemplary description of the aforementioned authentication method is given: Steps 1701 to 1703: After verification, the UDM / UDR confirms that the user identity of the UE is being used, and carries the user identity in the verification result and sends it to the verification network element, which carries the user identity (and / or temporary user identity) in the verification result and sends it to the AMF. The verification result sent by the UDM / UDR is the sixth message in the aforementioned embodiment. The user identification is the identification of the first user in the aforementioned embodiment. Optionally, the UDM / UDR may also generate a corresponding temporary user identifier (ie, the temporary identifier of the first user in the aforementioned embodiment) and send it to the verification network element. Optionally, the temporary user identifier may also be generated on the verification network element or AMF, in which case the verification network element or AMF has a corresponding relationship between the user identifier and the temporary user representation. Step 1704: AMF notifies the UE of the verification result (i.e., the third message in the aforementioned embodiment) through a downlink NAS message, including at least one of the following: whether the verification is successful (whether the user is allowed to use the terminal); the user identifier of the user; the temporary user identifier of the user. Step 1705: After receiving the verification result, the UE saves the user ID or temporary user ID. Optionally, the UE can also save the CHK* and / or "protection information*" generated during the verification process and associate it with the user ID / temporary user ID so that the user identity can be directly confirmed when the same user logs in later. For example, the next time the same user logs in (for example, after locking the screen, unlocking it again with a fingerprint), the user ID / temporary user ID of the user can be directly confirmed when the same CHK or "protection information" is generated locally. It should be noted that other network devices such as RAN are also illustrated in Figures 12, 15 and 17. The RAN may be an access network device serving the UE, and the role of the RAN in the examples of Figures 12, 15 and 17 is also not limited. By adopting the solution provided in the above embodiment, the terminal can send the first message so that the network side can authenticate the first user using the terminal based on the various authentication information generated by the feature recovery information of each user and the feature information of the current first user carried in the first message. In this way, when different users log in on the same terminal, the network side can distinguish and authenticate different users, thereby ensuring the security of each user. In addition, when the network side authenticates the first user, the first user's identifier and / or the first user's temporary identifier can also be determined, thereby achieving the accuracy of identifying different users using the same terminal. Furthermore, since the terminal can save the relevant authentication parameters corresponding to the authenticated user, the subsequent authentication process when the same user logs in again on the same terminal can be avoided, thereby improving the processing efficiency. Again, the authentication method provided by this application utilizes existing processes and mechanisms and has better compatibility. FIG18 is a schematic diagram of a terminal structure according to an embodiment of the present application, including: The first communication unit 1801 is used to send a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. The one or more authentication information include one or more feature authentication keys, wherein the one or more feature authentication keys are obtained based on feature information of the first user and feature recovery information of one or more users. The one or more authentication information are obtained based on the first parameter and one or more feature authentication keys, and the one or more feature authentication keys are obtained based on feature information of the first user and feature recovery information of one or more users. The one or more authentication information are obtained by encrypting the one or more feature authentication keys based on the first parameter. The characteristic recovery information of each user among the one or more users is preconfigured, the one or more users are users who can use the terminal, and the one or more users include the first user. The first communication unit is used to receive a second message, wherein the second message carries a verification requirement for a user using the terminal. The second message also carries a first parameter. The first parameter is generated or preconfigured by the terminal. When the first parameter is generated by the terminal, the first communication unit is used to send the first parameter. The first communication unit is used to receive a third message, wherein the third message carries information related to the identification of the first user, and the information related to the identification of the first user includes at least one of the following: the identification of the first user and the temporary identification of the first user. As shown in FIG. 18 , the terminal further includes: a first processing unit 1802 , configured to store identification-related information of the first user. The first processing unit is used to perform at least one of the following: saving the correspondence between the identification-related information of the first user and the authentication information matching the first user; saving the correspondence between the identification-related information of the first user and the feature authentication key matching the first user. The third message is used by the terminal to determine the authentication result of the first user. FIG. 19 is a schematic diagram of a composition structure of a first network device according to an embodiment of the present application, including: The second communication unit 1901 is used to receive a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. As shown in Figure 19, the first network device also includes: a second processing unit 1902, which is used to authenticate the first user using the terminal based on the one or more authentication information and the one or more verification information, wherein the one or more verification information is associated with the identification information of one or more users who can use the terminal, and different verification information is associated with the identification information of different users, and the identification information of each user in the one or more users includes at least one of the following: the identification of each user, the number of each user, and the one or more users include the first user. The one or more authentication information include one or more feature authentication keys; the one or more verification information include a feature key of each of the one or more users. The one or more verification information are obtained based on the first parameter and a feature key of each user among the one or more users. The second processing unit is used to decrypt the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; based on the one or more feature authentication keys and the one or more verification information, authenticate the first user using the terminal, wherein the one or more verification information includes the feature key of each user among the one or more users. The second communication unit is used to send a second message, wherein the second message carries a verification requirement for a user using the terminal. The second message carries a first parameter, where the first parameter is generated by the first network device. The first parameter is preconfigured. The second communication unit is used to receive the first parameter. The feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user. The second communication unit is used to send a third message, wherein the third message carries information related to the identification of the first user, wherein the information related to the identification of the first user includes at least one of the following: the identification of the first user, and the temporary identification of the first user. The third message is used by the terminal to determine the authentication result of the first user. The first network device includes at least one of the following: a unified data management function UDM and a unified data storage UDR. FIG20 is a schematic diagram of a structure of a second network device according to an embodiment of the present application, including: The third communication unit 2001 is used to receive a first message sent by the terminal, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users; and send a fourth message to the first network device, wherein the fourth message carries a verification result, and the verification result is related to the one or more authentication information. The third communication unit is used to receive a fifth message sent by the first network device, wherein the fifth message carries the one or more verification information; and send a second message to the terminal, wherein the second message carries a verification requirement for a user using the terminal. The fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users. The one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user. As shown in Figure 20, the second network device also includes a third processing unit 2002, which is used to perform one of the following: based on the one or more authentication information, determine the first verification information from the one or more verification information; based on the one or more authentication information, determine the first verification information from the one or more verification information, and determine the identification information of the user associated with the first verification information. The one or more authentication information include one or more feature authentication keys; the one or more verification information include a feature key of each of the one or more users. The third processing unit is used to decrypt the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; based on the one or more feature authentication keys, determine the first verification information from the one or more verification information, wherein the one or more verification information includes the feature key of each user among one or more users. The verification result includes at least one of the following: the first verification information, and identification information of a user associated with the first verification information. The fifth message also carries the first parameter, and the second message also carries the first parameter. The third communication unit is used to receive the first parameter sent by the terminal; and send the first parameter to the first network device. The third communication unit is used to receive a sixth message sent by the first network device, wherein the sixth message carries the identifier of the first user; and send a third message to the terminal, wherein the third message carries information related to the identifier of the first user, and the information related to the identifier of the first user includes at least one of the following: the identifier of the first user and the temporary identifier of the first user. The sixth message also carries the temporary identifier of the first user. The third processing unit is configured to allocate a temporary identifier to the first user. The third message is used by the terminal to determine the authentication result of the first user. The first network device includes at least one of the following: a unified data management function UDM, a unified data storage UDR; the second network device includes at least one of the following: a verification network element, an access and mobility management function AMF, an authentication server function AUSF, a home subscriber server HSS, and an authentication credential storage and processing function ARPF. An embodiment of the present application further provides a first network device, the first network device comprising: A second communication unit is used to receive a fourth message sent by a second network device, wherein the fourth message carries a verification result, and the verification result is related to one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users. The second communication unit is used to send a fifth message to the second network device, wherein the fifth message carries one or more verification information. The one or more verification information are associated with identification information of one or more users who can use the terminal, and the identification information of each of the one or more users includes at least one of the following: an identifier of each user, a number of each user, and the one or more users include the first user. The fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users. The one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user. The one or more authentication information includes a feature key for each of the one or more users. The one or more verification information are obtained based on the first parameter and a feature key of each user among the one or more users. The verification result includes at least one of the following: first verification information, and identification information of a user associated with the first verification information, and the first verification information is one of the one or more verification information. The first network device also includes a second processing unit, which is used to determine the identification of the first user based on the verification result, and determine that the authentication of the first user using the terminal is successful. The feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user. The first parameter is preconfigured. The fifth message also carries the first parameter, where the first parameter is generated by the first network device. The second communication unit is used to receive the first parameter sent by the second network device. The second communication unit is used to send a sixth message to the second network device, wherein the sixth message carries the identifier of the first user. The second processing unit is configured to allocate a temporary identifier to the first user. The first network device includes at least one of the following: a unified data management function UDM, a unified data storage UDR; the second network device includes at least one of the following: a verification network element, an access and mobility management function AMF, an authentication server function AUSF, a home subscriber server HSS, and an authentication credential storage and processing function ARPF. The device of the embodiment of the present application can realize the corresponding functions of each device in the aforementioned authentication method embodiment. The process, function, implementation method and beneficial effect corresponding to each module (submodule, unit or component, etc.) in the terminal device, or the first network device, or the second network device can be referred to the corresponding description in the above method embodiment, which will not be repeated here. It should be noted that the functions described in the terminal device, or the first network device, or each module (submodule, unit or component, etc.) in the second network device of the application embodiment can be implemented by different modules (submodules, units or components, etc.), or by the same module (submodule, unit or component, etc.). FIG21 is a schematic structural diagram of a communication device 2100 according to an embodiment of the present application. The communication device 2100 includes a processor 2110, The processor 2110 can call and run a computer program from the memory so that the communication device 2100 implements the method in the embodiment of the present application. In a possible implementation, the communication device 2100 may also include a memory 2120. Among them, the processor 2110 can call and run a computer program from the memory 2120 so that the communication device 2100 implements the method in the embodiment of the present application. Among them, the memory 2120 can be a separate device independent of the processor 2110, or it can be integrated in the processor 2110. In a possible implementation, the communication device 2100 may also include a transceiver 2130, and the processor 2110 can control the transceiver 2130 to communicate with other devices, specifically, it can send information or data to other devices, or receive information or data sent by other devices. Among them, the transceiver 2130 may include a transmitter and a receiver. The transceiver 2130 may further include an antenna, and the number of antennas may be one or more. In one possible implementation, the communication device 2100 may be a terminal device, or a first network device, or a second network device in an embodiment of the present application, and the communication device 2100 may implement the corresponding processes implemented by the terminal device, or the first network device, or the second network device in each method of the embodiment of the present application, which will not be repeated here for the sake of brevity. Figure 22 is a schematic structural diagram of a chip 2200 according to an embodiment of the present application. The chip 2200 includes a processor 2210, and the processor 2210 can call and run a computer program from a memory to implement the method in the embodiment of the present application. In a possible implementation, the chip 2200 may also include a memory 2220. Among them, the processor 2210 can call and run a computer program from the memory 2220 to implement the method performed by the first device or the target second device in the embodiment of the present application. Among them, the memory 2220 can be a separate device independent of the processor 2010, or it can be integrated in the processor 2210. In a possible implementation, the chip 2200 may also include an input interface 2230. Among them, the processor 2010 can control the input interface 2230 to communicate with other devices or chips, specifically, it can obtain information or data sent by other devices or chips. In a possible implementation, the chip 2200 may also include an output interface 2240. The processor 2210 may control the output interface 2240 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips. In a possible implementation, the chip can be applied to the terminal device, or the first network device, or the second network device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the terminal device, or the first network device, or the second network device in each method of the embodiment of the present application, for the sake of brevity, it is not repeated here. It should be understood that the chip mentioned in the embodiment of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc. The above-mentioned processor can be a general-purpose processor, a digital signal processor (digital signal processor, DSP), a field programmable gate array (field programmable gate array, FPGA), an application specific integrated circuit (application specific integrated circuit, ASIC) or other programmable logic devices, transistor logic devices, discrete hardware components, etc. Among them, the above-mentioned general-purpose processor can be a microprocessor or any conventional processor, etc. The above-mentioned memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM). It should be understood that the above-mentioned memory is an exemplary but not restrictive description. For example, the memory in the embodiment of the present application can also be a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDR SDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DR RAM), etc. That is to say, the memory in the embodiment of the present application is intended to include but is not limited to these and any other suitable types of memory. Figure 23 is a schematic block diagram of a communication system 2300 according to an embodiment of the present application. The communication system 2300 includes a terminal 2330, a first network device 2310, and a second network device 2320. Among them, the terminal 2330 can be used to implement the corresponding functions implemented by the terminal in the above method. The first network device 2310 can be used to implement the corresponding functions implemented by the first network device in the above method. The second network device 2320 can be used to implement the corresponding functions implemented by the second network device in the above method. For the sake of brevity, it will not be repeated here. In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)). It should be understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claim.

Claims

1. An authentication method, comprising: The terminal sends a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users.

2. The method according to claim 1, wherein: The one or more authentication information include one or more feature authentication keys, wherein the one or more feature authentication keys are obtained based on feature information of the first user and feature recovery information of one or more users.

3. The method according to claim 1, wherein: The one or more authentication information are obtained based on the first parameter and one or more feature authentication keys, and the one or more feature authentication keys are obtained based on feature information of the first user and feature recovery information of one or more users.

4. The method according to claim 3, wherein: The one or more authentication information are obtained by encrypting the one or more feature authentication keys based on the first parameter.

5. The method according to any one of claims 2 to 4, wherein: The characteristic recovery information of each user among the one or more users is preconfigured, the one or more users are users who can use the terminal, and the one or more users include the first user.

6. The method according to any one of claims 1 to 5, wherein: Before the terminal sends the first message, the method further includes: The terminal receives a second message, wherein the second message carries a verification requirement for a user using the terminal.

7. The method according to claim 6, wherein: The second message also carries a first parameter.

8. The method according to claim 3 or 4, wherein: The first parameter is generated or preconfigured by the terminal.

9. The method according to claim 8, wherein: In a case where the first parameter is generated by the terminal, the method further includes: the terminal sending the first parameter.

10. The method according to any one of claims 1 to 9, wherein: After the terminal sends the first message, the method further includes: The terminal receives a third message, wherein the third message carries information related to the identifier of the first user, and the information related to the identifier of the first user includes at least one of the following: the identifier of the first user and a temporary identifier of the first user.

11. The method according to claim 10, wherein: After the terminal receives the third message, the method further includes: The terminal stores the identification-related information of the first user.

12. The method according to claim 11, wherein: The terminal stores the identification-related information of the first user, including at least one of the following: The terminal stores a correspondence between the identification-related information of the first user and the authentication information matching the first user; The terminal stores a correspondence between the identification-related information of the first user and a feature authentication key matching the first user.

13. The method according to any one of claims 10 to 12, wherein: The third message is used by the terminal to determine the authentication result of the first user.

14. An authentication method, comprising: The first network device receives a first message, wherein the first message carries one or more authentication information, the one or more authentication information is used to authenticate a first user using a terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users.

15. The method according to claim 14, wherein: After the first network device receives the first message, the method further includes: The first network device authenticates a first user using the terminal based on the one or more authentication information and the one or more verification information, wherein the one or more verification information are associated with identification information of one or more users who can use the terminal, and different verification information are associated with identification information of different users, and the identification information of each of the one or more users includes at least one of the following: an identifier of each user and a number of each user, and the one or more users include the first user.

16. The method according to claim 15, wherein: The one or more authentication information include one or more feature authentication keys; the one or more verification information include a feature key of each of the one or more users.

17. The method according to claim 15, wherein: The one or more verification information are obtained based on the first parameter and a feature key of each user among the one or more users.

18. The method according to claim 15, wherein: The first network device authenticates a first user using the terminal based on the one or more authentication information and the one or more verification information, including: The first network device decrypts the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; The first network device authenticates a first user using the terminal based on the one or more feature authentication keys and the one or more authentication information, wherein the one or more authentication information includes a feature key for each of the one or more users.

19. The method according to any one of claims 14 to 18, wherein: Before the first network device receives the first message, the method further includes: The first network device sends a second message, wherein the second message carries a verification requirement for a user using the terminal.

20. The method according to claim 19, wherein: The second message carries a first parameter, where the first parameter is generated by the first network device.

21. The method according to claim 17 or 18, wherein: The first parameter is preconfigured.

22. The method according to claim 17 or 18, wherein: The method further comprises: The first network device receives the first parameter.

23. The method according to any one of claims 16 to 18, wherein: The feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user.

24. The method according to any one of claims 14 to 23, wherein: After the first network device receives the first message, the method further includes: The first network device sends a third message, wherein the third message carries information related to the identifier of the first user, wherein the information related to the identifier of the first user includes at least one of the following: the identifier of the first user, and a temporary identifier of the first user.

25. The method according to claim 24, wherein: The third message is used by the terminal to determine the authentication result of the first user.

26. The method according to any one of claims 14 to 25, wherein: The first network device includes at least one of the following: a unified data management function UDM and a unified data storage UDR.

27. An authentication method, comprising: The second network device receives a first message sent by the terminal, wherein the first message carries one or more authentication information, the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users; The second network device sends a fourth message to the first network device, wherein the fourth message carries a verification result, and the verification result is related to the one or more authentication information.

28. The method according to claim 27, wherein: Before the second network device receives the first message sent by the terminal, the method further includes: The second network device receives a fifth message sent by the first network device, wherein the fifth message carries the one or more verification information; The second network device sends a second message to the terminal, wherein the second message carries a verification requirement for a user using the terminal.

29. The method according to claim 28, wherein: The fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users. The one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user.

30. The method according to claim 28 or 29, wherein: Before the second network device sends the fourth message to the first network device, the method further includes one of the following: The second network device determines first verification information from the one or more verification information based on the one or more authentication information; The second network device determines first verification information from the one or more verification information based on the one or more authentication information, and determines identification information of a user associated with the first verification information.

31. The method according to claim 30, wherein: The one or more authentication information include one or more feature authentication keys; the one or more verification information include a feature key of each of the one or more users.

32. The method of claim 30, wherein: The second network device determines the first verification information from the one or more verification information based on the one or more authentication information, including: The second network device decrypts the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; The second network device determines first authentication information from the one or more authentication information based on the one or more feature authentication keys, wherein the one or more authentication information includes a feature key for each of the one or more users.

33. The method according to any one of claims 30 to 32, wherein: The verification result includes at least one of the following: the first verification information, and identification information of a user associated with the first verification information.

34. The method according to any one of claims 28 to 33, wherein: The fifth message also carries a first parameter, and the second message also carries the first parameter.

35. The method according to any one of claims 28 to 33, wherein: Before the second network device receives the fifth message sent by the first network device, the method further includes: The second network device receives a first parameter sent by the terminal; The second network device sends the first parameter to the first network device.

36. The method according to any one of claims 27 to 35, wherein: After the second network device sends the fourth message to the first network device, the method further includes: The second network device receives a sixth message sent by the first network device, wherein the sixth message carries an identifier of the first user; The second network device sends a third message to the terminal, wherein the third message carries information related to the identifier of the first user, and the information related to the identifier of the first user includes at least one of the following: the identifier of the first user and a temporary identifier of the first user.

37. The method of claim 36, wherein: The sixth message also carries the temporary identifier of the first user.

38. The method of claim 36, wherein: Before the second network device sends the third message to the terminal, the method further includes: The second network device allocates a temporary identifier of the first user.

39. The method according to any one of claims 36 to 38, wherein: The third message is used by the terminal to determine the authentication result of the first user.

40. The method according to any one of claims 27 to 39, wherein: The first network device includes at least one of the following: a unified data management function UDM, a unified data storage UDR; The second network device includes at least one of the following: a verification network element, an access and mobility management function AMF, an authentication server function AUSF, a home subscriber server HSS, and an authentication credential storage and processing function ARPF.

41. An authentication method, comprising: The first network device receives a fourth message sent by the second network device, wherein the fourth message carries a verification result, and the verification result is related to one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users.

42. The method according to claim 41, wherein: Before the first network device receives the fourth message sent by the second network device, the method further includes: The first network device sends a fifth message to the second network device, wherein the fifth message carries one or more verification information.

43. The method of claim 42, wherein: The one or more verification information are associated with identification information of one or more users who can use the terminal, and the identification information of each of the one or more users includes at least one of the following: an identifier of each user, a number of each user, and the one or more users include the first user.

44. The method of claim 42, wherein: The fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users. The one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user.

45. The method according to any one of claims 42 to 44, wherein: The one or more authentication information includes a feature key for each of the one or more users.

46. ​​The method according to any one of claims 42 to 44, wherein: The one or more verification information are obtained based on the first parameter and a feature key of each user among the one or more users.

47. The method according to any one of claims 43 to 46, wherein: The verification result includes at least one of the following: first verification information, and identification information of a user associated with the first verification information, and the first verification information is one of the one or more verification information.

48. The method of claim 47, wherein: After the first network device receives the fourth message sent by the second network device, the method further includes: The first network device determines the identification of the first user based on the verification result, and determines that the first user who uses the terminal is authenticated.

49. The method according to claim 45 or 46, wherein: The feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user.

50. The method of claim 46, wherein: The first parameter is preconfigured.

51. The method according to any one of claims 42 to 49, wherein: The fifth message also carries a first parameter, where the first parameter is generated by the first network device.

52. The method according to any one of claims 42 to 49, wherein: Before the first network device sends the fifth message to the second network device, the method further includes: The first network device receives a first parameter sent by the second network device.

53. The method according to any one of claims 41 to 52, wherein: After the first network device receives the fourth message sent by the second network device, the method further includes: The first network device sends a sixth message to the second network device, wherein the sixth message carries the identifier of the first user.

54. The method of claim 53, wherein: The sixth message also carries a temporary identifier of the first user, and the method further includes: The first network device allocates a temporary identifier of the first user.

55. The method according to any one of claims 41 to 54, wherein: The first network device includes at least one of the following: a unified data management function UDM, a unified data storage UDR; The second network device includes at least one of the following: a verification network element, an access and mobility management function AMF, an authentication server function AUSF, a home subscriber server HSS, and an authentication credential storage and processing function ARPF.

56. A terminal, comprising: A first communication unit is used to send a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users.

57. The terminal according to claim 56, wherein: The one or more authentication information include one or more feature authentication keys, wherein the one or more feature authentication keys are obtained based on feature information of the first user and feature recovery information of one or more users.

58. The terminal according to claim 56, wherein: The one or more authentication information are obtained based on the first parameter and one or more feature authentication keys, and the one or more feature authentication keys are obtained based on feature information of the first user and feature recovery information of one or more users.

59. The terminal according to claim 58, wherein: The one or more authentication information are obtained by encrypting the one or more feature authentication keys based on the first parameter.

60. The terminal according to any one of claims 57 to 59, wherein: The characteristic recovery information of each user among the one or more users is preconfigured, the one or more users are users who can use the terminal, and the one or more users include the first user.

61. The terminal according to any one of claims 56 to 60, wherein: The first communication unit is used to receive a second message, wherein the second message carries a verification requirement for a user using the terminal.

62. The terminal according to claim 61, wherein: The second message also carries a first parameter.

63. The terminal according to claim 58 or 59, wherein: The first parameter is generated or preconfigured by the terminal.

64. The terminal according to claim 63, wherein: When the first parameter is generated by the terminal, the first communication unit is used to send the first parameter.

65. The terminal according to any one of claims 56 to 64, wherein: The first communication unit is used to receive a third message, wherein the third message carries information related to the identification of the first user, and the information related to the identification of the first user includes at least one of the following: the identification of the first user and the temporary identification of the first user.

66. The terminal according to claim 65, wherein: The terminal further includes a first processing unit configured to store identification-related information of the first user.

67. The terminal according to claim 66, wherein: The first processing unit is used to perform at least one of the following: saving the correspondence between the identification-related information of the first user and the authentication information matching the first user; saving the correspondence between the identification-related information of the first user and the feature authentication key matching the first user.

68. The terminal according to any one of claims 65 to 67, wherein: The third message is used by the terminal to determine the authentication result of the first user.

69. A first network device, comprising: A second communication unit is used to receive a first message, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users.

70. The first network device according to claim 69, wherein: The first network device also includes a second processing unit, which is used to authenticate a first user using the terminal based on the one or more authentication information and one or more verification information, wherein the one or more verification information is associated with identification information of one or more users who can use the terminal, and different verification information is associated with identification information of different users, and the identification information of each of the one or more users includes at least one of the following: an identifier of each user, a number of each user, and the one or more users include the first user.

71. The first network device according to claim 70, wherein: The one or more authentication information include one or more feature authentication keys; the one or more verification information include a feature key of each of the one or more users.

72. The first network device according to claim 70, wherein: The one or more verification information are obtained based on the first parameter and a feature key of each user among the one or more users.

73. The first network device according to claim 70, wherein: The second processing unit is used to decrypt the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; A first user using the terminal is authenticated based on the one or more feature authentication keys and the one or more verification information, wherein the one or more verification information includes a feature key for each of the one or more users.

74. The first network device according to any one of claims 69 to 73, wherein: The second communication unit is used to send a second message, wherein the second message carries a verification requirement for a user using the terminal.

75. The first network device according to claim 74, wherein: The second message carries a first parameter, where the first parameter is generated by the first network device.

76. The first network device according to claim 72 or 73, wherein: The first parameter is preconfigured.

77. The first network device according to claim 72 or 73, wherein: The second communication unit is used to receive the first parameter.

78. The first network device according to any one of claims 71 to 73, wherein: The feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user.

79. The first network device according to any one of claims 69 to 78, wherein: The second communication unit is used to send a third message, wherein the third message carries information related to the identification of the first user, wherein the information related to the identification of the first user includes at least one of the following: the identification of the first user, and the temporary identification of the first user.

80. The first network device according to claim 79, wherein: The third message is used by the terminal to determine the authentication result of the first user.

81. The first network device according to any one of claims 69 to 80, wherein: The first network device includes at least one of the following: a unified data management function UDM and a unified data storage UDR.

82. A second network device, comprising: A third communication unit is used to receive a first message sent by a terminal, wherein the first message carries one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users; and send a fourth message to the first network device, wherein the fourth message carries a verification result, and the verification result is related to the one or more authentication information.

83. The second network device according to claim 82, wherein: The third communication unit is used to receive a fifth message sent by the first network device, wherein the fifth message carries the one or more verification information; and send a second message to the terminal, wherein the second message carries a verification requirement for a user using the terminal.

84. The second network device according to claim 83, wherein: The fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users. The one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user.

85. The second network device according to claim 83 or 84, wherein: The second network device also includes a third processing unit, which is used to perform one of the following: based on the one or more authentication information, determining the first verification information from the one or more verification information; based on the one or more authentication information, determining the first verification information from the one or more verification information, and determining the identification information of the user associated with the first verification information.

86. The second network device according to claim 85, wherein: The one or more authentication information include one or more feature authentication keys; the one or more verification information include a feature key of each of the one or more users.

87. The second network device according to claim 85, wherein: The third processing unit is used to decrypt the one or more authentication information based on the first parameter to obtain one or more feature authentication keys; Based on the one or more feature authentication keys, first authentication information is determined from the one or more authentication information, wherein the one or more authentication information includes a feature key for each of the one or more users.

88. The second network device according to any one of claims 85 to 87, wherein: The verification result includes at least one of the following: the first verification information, and identification information of a user associated with the first verification information.

89. The second network device according to any one of claims 83 to 88, wherein: The fifth message also carries a first parameter, and the second message also carries the first parameter.

90. The second network device according to any one of claims 83 to 88, wherein: The third communication unit is used to receive the first parameter sent by the terminal; and send the first parameter to the first network device.

91. The second network device according to any one of claims 82 to 90, wherein: The third communication unit is used to receive a sixth message sent by the first network device, wherein the sixth message carries the identifier of the first user; and send a third message to the terminal, wherein the third message carries information related to the identifier of the first user, and the information related to the identifier of the first user includes at least one of the following: the identifier of the first user and the temporary identifier of the first user.

92. The second network device according to claim 91, wherein: The sixth message also carries the temporary identifier of the first user.

93. The second network device according to claim 91, wherein: The third processing unit is configured to allocate a temporary identifier to the first user.

94. The second network device according to any one of claims 91 to 93, wherein: The third message is used by the terminal to determine the authentication result of the first user.

95. The second network device according to any one of claims 82 to 94, wherein: The first network device includes at least one of the following: a unified data management function UDM, a unified data storage UDR; the second network device includes at least one of the following: a verification network element, an access and mobility management function AMF, an authentication server function AUSF, a home subscriber server HSS, and an authentication credential storage and processing function ARPF.

96. A first network device, comprising: A second communication unit is used to receive a fourth message sent by a second network device, wherein the fourth message carries a verification result, and the verification result is related to one or more authentication information, and the one or more authentication information is used to authenticate a first user using the terminal, and different authentication information in the one or more authentication information is related to feature information of the first user and feature recovery information of different users.

97. The first network device according to claim 96, wherein: The second communication unit is used to send a fifth message to the second network device, wherein the fifth message carries one or more verification information.

98. The first network device according to claim 97, wherein: The one or more verification information are associated with identification information of one or more users who can use the terminal, and the identification information of each of the one or more users includes at least one of the following: an identifier of each user, a number of each user, and the one or more users include the first user.

99. The first network device according to claim 97, wherein: The fifth message also carries identification information of one or more users who can use the terminal and are associated with the one or more verification information, and different verification information is associated with identification information of different users. The one or more users include the first user, and the identification information of each user in the one or more users includes at least one of the following: an identifier of each user and a number of each user.

100. The first network device according to any one of claims 97-99, wherein: The one or more authentication information includes a feature key for each of the one or more users.

101. The first network device according to any one of claims 97-99, wherein: The one or more verification information are obtained based on the first parameter and a feature key of each user among the one or more users.

102. The first network device according to any one of claims 98 to 101, wherein: The verification result includes at least one of the following: first verification information, and identification information of a user associated with the first verification information, and the first verification information is one of the one or more verification information.

103. The first network device according to claim 102, wherein: The first network device further includes a second processing unit, configured to determine an identification of the first user based on the verification result, and determine that authentication of the first user using the terminal is successful.

104. The first network device according to claim 100 or 101, wherein: The feature key of each user among the one or more users is stored in association with the identifier of each user and the feature recovery information of each user.

105. The first network device according to claim 101, wherein: The first parameter is preconfigured.

106. The first network device according to any one of claims 97 to 104, wherein: The fifth message also carries the first parameter, where the first parameter is generated by the first network device.

107. The first network device according to any one of claims 97 to 104, wherein: The second communication unit is used to receive the first parameter sent by the second network device.

108. The first network device according to any one of claims 96-107, wherein: The second communication unit is used to send a sixth message to the second network device, wherein the sixth message carries the identifier of the first user.

109. The first network device according to claim 108, wherein: The second processing unit is configured to allocate a temporary identifier to the first user.

110. The first network device according to any one of claims 96-109, wherein: The first network device includes at least one of the following: a unified data management function UDM, a unified data storage UDR; the second network device includes at least one of the following: a verification network element, an access and mobility management function AMF, an authentication server function AUSF, a home subscriber server HSS, and an authentication credential storage and processing function ARPF.

111. A terminal comprising: A transceiver, a processor and a memory, the memory being used to store a computer program, the transceiver being used to communicate with other devices, and the processor being used to call and run the computer program stored in the memory, so that the terminal executes the method as claimed in any one of claims 1 to 13.

112. A first network device, comprising: A transceiver, a processor and a memory, the memory being used to store a computer program, the transceiver being used to communicate with other devices, and the processor being used to call and run the computer program stored in the memory so that the first network device executes the method as claimed in any one of claims 16 to 26 or claims 41 to 55.

113. A second network device, comprising: A transceiver, a processor and a memory, the memory being used to store a computer program, the transceiver being used to communicate with other devices, and the processor being used to call and run the computer program stored in the memory so that the second network device executes the method as described in any one of claims 27 to 40.

114. A chip, comprising: A processor, configured to call and run a computer program from a memory so that a device equipped with the chip executes a method as described in any one of claims 1 to 13, or claims 14 to 26, or claims 27 to 40, or claims 41 to 55.

115. A computer-readable storage medium for storing a computer program, which, when executed by a device, causes the device to perform the method as claimed in any one of claims 1 to 13, or claims 14 to 26, or claims 27 to 40, or claims 41 to 55.

116. A computer program product comprising computer program instructions, the computer program instructions causing a computer to perform the method of any one of claims 1 to 13, or claims 14 to 26, or claims 27 to 40, or claims 41 to 55.

117. A computer program causing a computer to perform the method of any one of claims 1 to 13, or claims 14 to 26, or claims 27 to 40, or claims 41 to 55.

Images