Identity authentication method and server

Abstract

The application discloses an identity authentication method and a server, and belongs to the technical field of information security. The method comprises the following steps: receiving an authentication request initiated by a terminal, wherein the authentication request comprises a digital signature and a device unique identifier; verifying the validity of the digital signature; and checking whether the device unique identifier is consistent with pre-stored association relationship data. Only when both the double verifications pass, the terminal is authorized to access. The credential of the application can be a pluggable hardware security medium, or a software security module running in a trusted execution environment of the terminal, thereby uniformly adapting special hardware terminals and general computing devices. The application realizes high-security, wide-application, and flexible-deployment unified identity authentication.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to an identity authentication method and server. Background Technology

[0002] With the rapid development of information technology, network communication has permeated all aspects of social life. In key industries such as government, finance, and military, communications conducted via Internet Protocol (IP) carry a large amount of highly sensitive information, making their security paramount. However, existing IP communication systems generally face severe security challenges.

[0003] First, network communication data is easily intercepted and eavesdropped on during transmission, posing a serious risk of data leakage. Second, the security of widely used public-key encryption algorithms such as RSA and Elliptic Curve Cryptography (ECC) relies on mathematical problems such as large number factorization. With the development of quantum computing technology, these traditional encryption algorithms will face the risk of being easily cracked in the future, posing a fundamental threat to existing security systems. Furthermore, attackers can obtain user account passwords through phishing, social engineering, and other means, impersonating legitimate identities to access systems and commit fraud or steal information, resulting in a high risk of identity forgery.

[0004] To address these challenges, the industry has proposed several identity authentication solutions. For example, while Public Key Infrastructure (PKI)-based systems offer high security, their certificate management processes are complex, and deployment and maintenance costs are high, making large-scale deployment difficult. Software certificate solutions that store private keys as files locally on the terminal are highly vulnerable to malware attacks and theft, resulting in weak security. Traditional account password solutions, on the other hand, cannot guarantee the authenticity of the user's identity or prevent account theft across multiple devices.

[0005] A more secure approach is to bind the user's identity to a dedicated hardware terminal and a hardware security medium (such as a Subscriber Identity Module, or SIM card). However, this purely hardware-based binding solution lacks flexibility and cannot be applied to general-purpose computing devices without physical card slots (such as smartphones and personal computers), making it difficult to meet the growing security needs of mobile office and remote collaboration.

[0006] Therefore, existing technologies still face challenges in providing a unified identity authentication solution that can both resist future quantum computing threats and achieve strong binding between user identity and device, while also being flexible enough to adapt to different terminal forms and easy to deploy. Summary of the Invention

[0007] To address the problems of insufficient security, complex deployment, poor flexibility, and inability to resist future quantum computing attacks in existing identity authentication schemes, this invention provides an identity authentication method and server.

[0008] This invention provides an identity authentication method for authenticating a terminal. The terminal is configured with a credential associated with a user's identity, and the credential stores a private key. The method is executed by an authentication server, which pre-stores association data that associates the user's identity, a unique identifier of the credential, and a unique device identifier of the authorized terminal. The method includes: receiving an authentication request initiated by the terminal to the authentication server, the authentication request including: a digital signature generated based on the private key in the credential, and the unique device identifier of the terminal; verifying the validity of the digital signature using a pre-stored public key associated with the credential; verifying whether the unique device identifier carried in the authentication request is consistent with the unique device identifier recorded in the association data associated with the credential; and authorizing the terminal to access the network only when both the verification of the digital signature and the verification of the unique device identifier pass.

[0009] In one implementation, the credential is a software security module running in a trusted execution environment on the terminal.

[0010] In one implementation, the terminal is a general-purpose computing device with client software installed.

[0011] In one implementation, upon initial activation, the software security module obtains and stores its unique asymmetric key pair from the authentication server via a secure channel, the asymmetric key pair including the private key and the public key.

[0012] In one embodiment, the credential is a pluggable hardware security medium, which has a pre-installed, non-derivative asymmetric key pair including the private key and the public key.

[0013] In one embodiment, the terminal is a dedicated hardware terminal having a physical card slot for inserting the hardware security medium.

[0014] In one implementation, the association data is created by an administrator entering the user identity, the unique identifier of the credential, and the unique identifier of the device into the authentication server.

[0015] In one implementation, the unique device identifier includes at least one of the following: MAC address, IMEI, UDID, or device hardware fingerprint.

[0016] In one implementation, the private key and the pre-stored public key constitute an asymmetric key pair based on a post-quantum cryptography algorithm.

[0017] This invention also provides an identity authentication server for authenticating a terminal. The terminal is configured with a credential associated with a user's identity, and the credential stores a private key. The authentication server pre-stores association data that associates the user's identity, a unique identifier of the credential, and a unique device identifier of the authorized terminal. The server includes: a receiving module configured to receive an authentication request initiated by the terminal to the authentication server, the authentication request including: a digital signature generated based on the private key in the credential, and a unique device identifier of the terminal; and a processing module configured to use a pre-stored public key associated with the credential to verify the validity of the digital signature; verify whether the unique device identifier carried in the authentication request is consistent with the unique device identifier recorded in the association data associated with the credential; and authorize the terminal to access the network only when both the verification of the digital signature and the verification of the unique device identifier pass.

[0018] The present invention also provides an authentication terminal configured with a credential associated with a user's identity, the credential storing a private key. The authentication terminal includes: a processing module for generating a digital signature based on the private key in the credential; and a request module for initiating an authentication request to an authentication server, the authentication request including the digital signature and the authentication terminal's own unique device identifier.

[0019] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the preceding claims.

[0020] Compared with the prior art, the present invention has the following beneficial effects: 1. Unified framework, broad applicability: This invention constructs and applies the association data binding user-credential-device, and introduces a software security module as an equivalent replacement for hardware security medium, seamlessly extending the high-strength authentication mechanism from dedicated hardware terminals to general computing devices, enabling high-security identity authentication to cover multiple application scenarios such as fixed office and mobile office.

[0021] 2. Tiered Security, Flexible Selection: By simultaneously supporting both hardware-based security media and software-based security modules as credential forms, this invention provides users with a tiered security and flexible deployment solution. Users can choose the appropriate credential form based on the security level requirements and cost budget of different scenarios, balancing maximum security with cost-effectiveness.

[0022] 3. Safe and reliable, reducing the risk of counterfeiting: This invention uses a dual verification mechanism of digital signature verification and device identification verification to ensure that every access request comes from a legitimate user, legitimate credentials, and legitimate device, effectively preventing various security risks such as identity impersonation, credential theft, and terminal counterfeiting, forming a closed-loop security authentication.

[0023] 4. Future-oriented and long-term effective: This invention can use post-quantum cryptography algorithms to generate key pairs, which can effectively resist potential attacks from future quantum computers, ensuring the long-term effectiveness and security of the authentication system, and conforming to cryptographic management standards and future technological development trends. Attached Figure Description

[0024] Figure 1 This is a flowchart of the identity authentication method according to an embodiment of the present invention.

[0025] Figure 2 This is a flowchart illustrating the identity authentication method based on hardware security media in an embodiment of the present invention.

[0026] Figure 3 This is a flowchart illustrating the identity authentication method based on a software security module in an embodiment of the present invention.

[0027] Figure 4 This is a schematic diagram of the architecture of the identity authentication system in an embodiment of the present invention.

[0028] Figure 5 This is a schematic diagram of the identity authentication server according to an embodiment of the present invention. Detailed Implementation

[0029] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0030] Figure 1 The flowchart of the identity authentication method provided by the present invention is as follows: Figure 1 Each step in the process will be explained in detail.

[0031] Step S110: Receive the authentication request initiated by the terminal to the authentication server.

[0032] The authentication request includes: a digital signature generated based on the private key within the credentials, and the terminal's unique device identifier.

[0033] This invention is used to authenticate a terminal. The terminal is configured with a credential associated with the user's identity. The credential stores a private key. The method is executed by an authentication server. The authentication server pre-stores association data that associates the user's identity, the unique identifier of the credential, and the unique identifier of the authorized terminal's device.

[0034] The authentication server first receives the authentication request initiated by the terminal. This request must contain two key pieces of information: a digital signature generated based on the private key stored in the credential, and a unique device identifier for the terminal initiating the request. Including the digital signature ensures that the source of the request indeed possesses legitimate credentials; while including the unique device identifier provides a basis for verifying the device's legitimacy.

[0035] Step S120: Use the pre-stored public key associated with the credential to verify the validity of the digital signature.

[0036] Upon receiving an authentication request, the authentication server performs a two-factor authentication process. The first step is signature verification, where the authentication server uses its pre-stored public key associated with the credential to verify the validity of the digital signature in the authentication request. Successful completion of this step proves that the request was indeed issued by a legitimate credential, effectively preventing credential forgery or identity impersonation.

[0037] Step S130: Verify whether the unique device identifier carried in the authentication request is consistent with the unique device identifier recorded in the association data and associated with the credential.

[0038] The second layer of verification is device verification. The authentication server extracts the unique device identifier carried in the authentication request and compares it with the unique device identifier recorded in the association data that is bound to the credential. Successful completion of this step proves that the terminal initiating the authentication is a pre-authorized legitimate device. This design ensures that even if the credential is stolen, authentication will fail on an unauthorized device, thus effectively preventing credential abuse.

[0039] Step S140: The authorized terminal accesses the network if and only if both the verification of the digital signature and the verification of the device's unique identifier pass.

[0040] Ultimately, the authentication server's authorization decision is rigorous. Only when both the digital signature verification and the device's unique identifier verification successfully pass will the authentication server determine the authentication request to be legitimate and valid, and return permission to the terminal to access the network. This dual-verification mechanism tightly integrates the cryptographic proof of identity (signature) with the identity proof of the physical device (or logical device) (device identifier). By applying relational data, it achieves a strict binding between the user, credentials, and device. Compared to traditional solutions that rely solely on passwords or hardware, this enhances the overall security of the system and effectively resists various attack methods such as identity forgery, account sharing, and terminal spoofing.

[0041] Building upon the methods described above, credentials can take various forms to suit different scenarios. As a preferred implementation, the credential can be a software security module. This software security module is not ordinary software, but rather runs in the Trusted Execution Environment (TEE) of the terminal. The TEE provides a secure execution space for code and data, isolated from the main operating system. By deploying the software security module there, it is possible to ensure that the private key stored therein and the process of performing signature operations are protected at the hardware level. Even if the terminal's regular operating system is compromised by malware, it is extremely difficult to steal or misuse the private key. Thus, a high level of secure key storage is achieved without relying on additional physical hardware.

[0042] Accordingly, when the credentials take the form of a software security module, the terminal is typically a general-purpose computing device with client software installed, such as a common smartphone, tablet, or personal computer. This configuration expands the applicability of the authentication scheme of this invention, allowing users to obtain high-strength security authentication capabilities on their everyday personal devices by installing a client software (Application, App). This design aligns with the trend of mobile office and remote collaboration, providing users with great convenience, while also reducing the cost and complexity of hardware procurement and distribution for large-scale enterprise deployment.

[0043] To further ensure the security and usability of the software credential scheme, the initialization process of the software security module has been carefully designed. Specifically, during its initial activation phase, the software security module communicates with the authentication server through a secure channel to obtain and store its unique asymmetric key pair, which includes the private and public keys required for subsequent authentication. The authentication server's unified issuance and distribution of keys ensures the authority and manageability of the key source; while secure transmission prevents eavesdropping or tampering during distribution. This online activation and key acquisition mechanism automates the entire credential deployment process, providing a smooth user experience and extremely low management costs.

[0044] As another preferred implementation to address higher security requirements, the credentials can also be a physically pluggable hardware security medium. This type of hardware security medium typically exists in the form of a TF (TransFlash) card or SIM card, which integrates a dedicated security chip and pre-installs a non-exportable asymmetric key pair, including a private key and a public key. "Non-exportable" means that the private key cannot be read outside the medium in any way throughout its entire lifecycle. All signature operations are performed within the security chip inside the medium. This design provides the highest level of physical security for the private key under current technological conditions, completely immunizing against all software-level attacks from the terminal operating system, including viruses and Trojans.

[0045] Matching the form of hardware credentials, when the credentials utilize hardware security media, the terminal is typically a dedicated hardware terminal. A typical characteristic of this dedicated hardware terminal is that it physically possesses a standard physical card slot for inserting the hardware security media, such as a desktop IP phone or video conferencing terminal. This combination of dedicated terminal and hardware media constructs a physically isolated, highly controllable secure authentication environment, ideally suited for classified or critical business scenarios in government, military, and finance sectors with extremely stringent information security requirements. By embedding authentication capabilities onto specific physical devices and media, potential security risks arising from device universality are minimized.

[0046] Regarding the establishment of trust foundations in the authentication system, the creation process of relational data needs to ensure its authority and accuracy. In one embodiment of the present invention, this relational data is created by the system administrator manually entering the user's identity, the unique identifier of the credential matching the user, and the unique identifier of the authorized terminal device in the management interface of the authentication server. For example, the administrator binds the user Zhang San's identity identifier (ID), the serial number of the hardware security medium he received, and the Media Access Control Address (MAC) of the dedicated hardware terminal on his desk. This manual review and entry method ensures that each binding relationship has been confirmed by trusted personnel, providing a reliable trust starting point for the entire authentication system.

[0047] To accurately identify devices across different types of terminals, the selection of a unique device identifier should be stable and unique. In a specific implementation of this invention, the unique device identifier may include, but is not limited to: the network's MAC address, the International Mobile Equipment Identity (IMEI) of the mobile communication device, the Unique Device Identifier (UDID) of Apple devices, or at least one of the following generated by collecting information from various hardware components (such as the Central Processing Unit (CPU) serial number, motherboard serial number, hard drive serial number, etc.). By supporting multiple types of device identifiers, the authentication method of this invention can flexibly adapt to various terminals, from dedicated hardware to general-purpose computers and mobile smart devices, ensuring the wide applicability and feasibility of the solution.

[0048] With a focus on future security threats, particularly potential attacks from quantum computing, this invention demonstrates foresight in its choice of cryptographic algorithms. In a preferred embodiment, the private key stored within the credential and the public key pre-stored on the authentication server together constitute an asymmetric key pair based on a post-quantum cryptography algorithm. Post-quantum cryptography algorithms are currently a hot research topic in cryptography, designed to ensure security even in the face of powerful quantum computers. By employing such algorithms, such as lattice-based, encoding-based, hash-based, or multivariate-based public-key cryptosystems, the authentication method of this invention possesses the ability to resist quantum computing attacks, ensuring the security and effectiveness of the authentication system for a considerable period in the future, and aligning with the national strategy of developing cryptographic management towards independent control and resistance to quantum attacks.

[0049] To more clearly illustrate the technical solution of the present invention, a detailed description is provided below in conjunction with the accompanying drawings and specific embodiments.

[0050] In a specific application scenario, such as a classified organization with extremely high physical security requirements, a hardware-based security medium authentication scheme can be adopted. The organization first deploys an authentication server in its internal data center. Then, each employee (e.g., user Zhang San) is equipped with a dedicated hardware terminal and issued a unique hardware security medium in the form of a TF card.

[0051] During the system account opening and binding phase, the IT administrator needs to create association data for user Zhang San in the authentication server's management backend. Specifically, the administrator creates a new user account, Zhang San, and enters the user's identity information (such as employee ID), the unique serial number of the hardware security medium they received (e.g., SN:QS-2026007), and the MAC address of the dedicated hardware terminal on their desk (e.g., AA-BB-CC-DD-EE-FF) into the system. This operation establishes a user-credential-device binding association in the authentication server. This process, through explicit authorization and data entry, provides a secure and reliable foundation for subsequent automated authentication.

[0052] like Figure 2 The diagram illustrates the authentication process in this scenario. When the user (Zhang San) inserts his hardware security medium into the TF card slot of the designated dedicated hardware terminal on his desk and connects the power, the authentication process is automatically triggered. The terminal's built-in client software first communicates with the hardware security medium to read its public key and other information. Subsequently, the terminal sends an authentication request to the authentication server. This request includes the terminal's unique device identifier (i.e., MAC address: AA-BB-CC-DD-EE-FF) and a digital signature generated by the hardware security medium using its internal, non-derivative private key to calculate a challenge message (such as a timestamp or random number issued by the server).

[0053] Upon receiving the authentication request, the authentication server immediately performs two-factor authentication. First, it uses a pre-stored public key associated with serial number SN:QS-2026007 to verify the digital signature in the request, confirming its validity. This confirms that the request indeed originates from the legitimate hardware security medium. Next, the authentication server verifies that the MAC address carried in the request is exactly the same as the MAC address AA-BB-CC-DD-EE-FF bound to user Zhang San. This confirms that the device initiating the authentication is indeed the authorized terminal. Only after both verifications are successful will the authentication server return a successful authentication response, and the terminal will be allowed to access the internal encrypted communication network. This embodiment fully demonstrates how to achieve extremely high-security identity authentication through hardware, effectively preventing the risk of credentials being stolen and used on other devices.

[0054] This invention is not only applicable to the aforementioned high-security fixed scenarios, but can also be flexibly applied to mobile office environments with higher convenience requirements. Another embodiment will be described below, suitable for modern enterprises with mobile office needs, such as financial institutions or group executives, who require secure and convenient encrypted communication solutions on their smartphones. The enterprise first deploys an authentication server in the cloud. Then, it notifies employees (e.g., Mr. Wang) to download and install a client software app from the app store on their smartphones.

[0055] like Figure 3 The first part of the diagram illustrates the initial activation and binding process in this scenario. When user Mr. Wang first opens the client software app and logs in using his employee ID and initial password, the app's built-in client software automatically executes the activation and binding process in the background. First, the client software invokes the underlying security capabilities of the mobile operating system to initialize a software security module within a Trusted Execution Environment (TEE). Next, this newly created software security module generates a unique module ID, serving as its unique credential identifier. Simultaneously, the client software obtains the smartphone's unique device identifier, such as its IMEI number.

[0056] Subsequently, the App will report the triplet information—the user's identity (Mr. Wang), the newly generated unique credential identifier (module ID), and the phone's unique device identifier (IMEI)—to the authentication server via an encrypted secure channel. Upon receiving the binding request, the authentication server will dynamically issue an asymmetric key pair based on post-quantum cryptography for this new software security module and securely send the encrypted private key back to the App, which will then store it within the software security module in the TEE. Simultaneously, the authentication server creates a Mr. Wang-Module ID-IMEI association record in its database. This completes the initial activation and binding process, which is transparent to the user and requires no administrator intervention, achieving secure and automated credential distribution and binding.

[0057] like Figure 3The latter half of the diagram illustrates the authentication process for daily use after initial activation. When user Mr. Wang needs to use the client software app daily, he can simply unlock the app using his phone's built-in fingerprint or facial recognition function, resulting in a very smooth user experience. Without the user's awareness, the app's client software automatically completes the authentication process in the background. Specifically, the client software requests the software security module in the TEE to sign a challenge message using its securely stored private key and obtains the signature result. Then, the app packages this newly generated digital signature, along with the phone's unique device identifier (IMEI), into an authentication request and sends it to the authentication server.

[0058] After receiving the authentication request from Mr. Wang's mobile app, the authentication server executes the same verification logic as the previous hardware-based embodiment, namely, strict two-factor authentication. It uses the public key stored for Mr. Wang's software security module to verify the validity of the signature, and simultaneously checks whether the IMEI in the request matches the IMEI bound to Mr. Wang in the database. Only when both the signature and device identifier match successfully will the authentication server return a successful authentication result, authorizing the app to access the encrypted communication network. This embodiment demonstrates how the present invention seamlessly extends a high-strength binding authentication model to general-purpose computing devices, effectively balancing security, mobility, and convenience.

[0059] The security model based on relational data constructed in this invention exhibits extremely high robustness in dealing with abnormal situations. Taking the aforementioned mobile office scenario as an example, suppose an attacker successfully obtains Mr. Wang's App login password through phishing or other means. The attacker installs the client software App on another new mobile phone and attempts to log in using Mr. Wang's account and password. At this point, authentication will inevitably fail. This is because when the App runs for the first time on the new phone, it initializes a completely new software security module. The ID of this new module is completely different from the legitimate module ID bound to Mr. Wang in the authentication server. Simultaneously, the device unique identifier (such as IMEI) of this new phone does not match the IMEI of Mr. Wang's phone recorded in the authentication server database. Therefore, when the authentication request reaches the authentication server, both signature verification (because the attacker does not have a legitimate private key) and device unique identifier verification will fail. The authentication server's dual authentication mechanism will effectively prevent this unauthorized access, thereby ensuring Mr. Wang's account security. This fully demonstrates that this solution can effectively eliminate the risk of identity theft caused by leaked account passwords.

[0060] like Figure 4The diagram shown illustrates the architecture of an identity authentication system according to an embodiment of the present invention. This system aims to provide a highly secure and widely applicable unified identity authentication solution. Its core idea lies in constructing and rigorously verifying an association that binds user identity, unique credential identifier, and unique device identifier. The system mainly comprises two entities: an authentication terminal and an authentication server D. The authentication terminal can take various forms; for example, it can be a dedicated hardware terminal with a physical card slot for use with pluggable hardware security media; or it can be a general-purpose computing device with specific client software installed, running a software security module internally. The authentication server is responsible for storing the association data binding the user, credential, and device, and executing the final authentication decision. This unified architecture design allows both fixed and mobile office scenarios to be incorporated into a unified security management system, achieving consistency in authentication strategies.

[0061] Next, refer to Figure 5 The identity authentication server provided by this invention will be described.

[0062] refer to Figure 5 An identity authentication server 500 is used to authenticate a terminal, wherein the terminal is configured with a credential associated with a user's identity, the credential storing a private key, and the authentication server pre-stores association data that associates the user's identity, the unique identifier of the credential, and the unique identifier of the authorized terminal's device. The server 500 includes: The receiving module 510 is configured to receive an authentication request initiated by the terminal to the authentication server. The authentication request includes: a digital signature generated based on the private key in the credential, and the terminal's unique device identifier. The processing module 520 is configured to use a pre-stored public key associated with the credential to verify the validity of the digital signature; verify whether the device unique identifier carried in the authentication request is consistent with the device unique identifier associated with the credential recorded in the association data; and authorize the terminal to access the network only when both the verification of the digital signature and the verification of the device unique identifier pass.

[0063] Corresponding to the above method embodiments, the present invention also provides an authentication terminal. This authentication terminal is configured with a credential associated with a user's identity, and the credential securely stores a private key. The authentication terminal includes a processing module and a request module. The processing module is configured to generate a digital signature based on the private key within the credential. The request module is configured to construct and initiate an authentication request to an authentication server, the authentication request containing the digital signature generated by the processing module and the unique device identifier of the authentication terminal itself. These modules can be physical hardware units or software functional modules running on the terminal processor; they work together to enable the terminal to proactively and securely prove its identity.

[0064] This invention also provides an identity authentication system designed to achieve end-to-end secure authentication. The system includes the aforementioned authentication terminal and authentication server. In the system, the authentication terminal is responsible for generating and sending authentication requests, while the authentication server is responsible for receiving and verifying the requests and ultimately making authorization decisions. The two communicate and interact via a network, jointly completing the identity authentication process based on relational data, thus forming a complete, closed-loop secure authentication solution.

[0065] Finally, the present invention also provides a computer-readable storage medium on which a computer program can be pre-stored. When the computer program is executed by one or more processors, it can implement the aforementioned authentication method. This allows the technical solution of the present invention to be delivered and deployed in the form of a software product, whether deployed on a server to implement the function of an authentication server or deployed on a terminal device to implement the function of an authentication terminal, demonstrating the practicality and implementability of the technical solution of the present invention.

[0066] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An authentication method for authenticating a terminal, wherein the terminal is configured with a credential associated with a user's identity, the credential storing a private key, the method being executed by an authentication server, the authentication server pre-stores association data linking the user's identity, a unique identifier of the credential, and a unique device identifier of the authorized terminal, characterized in that... The method includes: The system receives an authentication request initiated by the terminal to the authentication server. The authentication request includes: a digital signature generated based on the private key in the credential, and a unique device identifier of the terminal. The validity of the digital signature is verified using the pre-stored public key associated with the credential; Verify whether the unique device identifier carried in the authentication request is consistent with the unique device identifier associated with the credential recorded in the association data; The terminal is authorized to access the network only if both the verification of the digital signature and the verification of the device's unique identifier pass.

2. The method according to claim 1, characterized in that, The credentials are software security modules running in the Trusted Execution Environment (TEX) of the terminal.

3. The method according to claim 2, characterized in that, The terminal is a general-purpose computing device with client software installed.

4. The method according to claim 2, characterized in that, Upon initial activation, the software security module obtains and stores its unique asymmetric key pair from the authentication server via a secure channel. The asymmetric key pair includes the private key and the public key.

5. The method according to claim 1, characterized in that, The credential is a pluggable hardware security medium, which contains a non-derivative asymmetric key pair including the private key and the public key.

6. The method according to claim 5, characterized in that, The terminal is a dedicated hardware terminal equipped with a physical card slot for inserting the hardware security medium.

7. The method according to claim 1, characterized in that, The association data is created by the administrator entering the user identity, the unique identifier of the credential, and the unique identifier of the device into the authentication server.

8. The method according to claim 1, characterized in that, The unique identifier of the device includes at least one of the following: MAC address, IMEI, UDID, or device hardware fingerprint.

9. The method according to claim 1, characterized in that, The private key and the pre-stored public key constitute an asymmetric key pair based on a post-quantum cryptography algorithm.

10. An identity authentication server for authenticating a terminal, wherein the terminal is configured with a credential associated with a user identity, the credential storing a private key, and the authentication server pre-stores association data that associates the user identity, a unique identifier of the credential, and a unique device identifier of the authorized terminal, characterized in that... The server includes: The receiving module is configured to receive an authentication request initiated by the terminal to the authentication server, the authentication request including: a digital signature generated based on the private key in the credential, and a unique device identifier of the terminal; The processing module is configured to use a pre-stored public key associated with the credential to verify the validity of the digital signature; verify whether the device unique identifier carried in the authentication request is consistent with the device unique identifier associated with the credential recorded in the association data; and authorize the terminal to access the network if and only if both the verification of the digital signature and the verification of the device unique identifier pass.

Images