Security authentication method and device

Abstract

A security authentication method and a device. The method comprises: a first terminal generates fingerprint information, a first public key, and a first private key corresponding to the first public key, and sends the first public key to a server; the first terminal receives a second public key encrypted on the basis of the first public key and a first random number corresponding to the first terminal, which are sent by the server, wherein the first random number is used for performing identity verification on the first terminal and / or the server; the first terminal generates a first session key on the basis of the second public key and the first private key, and encrypts the fingerprint information by using the first session key; and the first terminal sends the encrypted fingerprint information to the server, wherein the fingerprint information is used for performing identity authentication on the first terminal.

Description

Security authentication method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application number 2024101443617, filed on January 31, 2024, entitled “Security Authentication Method and Apparatus,” which is incorporated herein by reference in its entirety. Technical Field

[0003] The present application relates to the field of information security technology, and in particular to a security authentication method and device. Background Art

[0004] With the development of information technologies such as 5G, mobile internet, and the Internet of Things, data security has become increasingly important. For example, in the cloud computing paradigm of the Internet of Things, cloud computing centers need to interact with a vast number of terminal devices, involving a large amount of data.

[0005] Currently, most security authentication solutions are based on Public Key Infrastructure (PKI), a powerful framework for secure communications that uses digital certificates and asymmetric encryption to ensure secure identity authentication and data confidentiality. However, PKI systems are relatively complex, encompassing multiple aspects, including certificate issuance, certificate management, and key lifecycle management. Deploying and maintaining PKI requires specialized knowledge and may be prohibitively cumbersome for small organizations. Summary of the Invention

[0006] In order to solve the problems existing in the prior art, the embodiments of the present application provide a security authentication method and device.

[0007] In a first aspect, the present application provides a security authentication method, comprising:

[0008] The first terminal generates fingerprint information, a first public key, and a first private key corresponding to the first public key, and sends the first public key to the server;

[0009] The first terminal receives, from the server, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0010] The first terminal generates a first session key based on the second public key and the first private key, and encrypts the fingerprint information using the first session key;

[0011] The first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to perform identity authentication on the first terminal.

[0012] In a second aspect, the present application provides a security authentication method, comprising:

[0013] The server receives the first public key sent by the first terminal;

[0014] The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal, and sends the second public key encrypted based on the first public key and the first random number corresponding to the first terminal to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0015] The server receives fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0016] In a third aspect, the present application provides a security authentication device, comprising:

[0017] A processing module, configured to generate fingerprint information, a first public key, and a first private key corresponding to the first public key;

[0018] A sending module, configured to send the first public key to a server;

[0019] a receiving module, configured to receive a second public key encrypted based on the first public key and a first random number corresponding to the first terminal, sent by a server; the first random number is used to authenticate the first terminal and / or the server;

[0020] The processing module is further configured to generate a first session key based on the second public key and the first private key, and encrypt the fingerprint information using the first session key;

[0021] The sending module is further configured to send the encrypted fingerprint information to the server; the fingerprint information is used to perform identity authentication on the first terminal.

[0022] In a fourth aspect, the present application provides a security authentication device, comprising:

[0023] A receiving module, configured to receive a first public key sent by a first terminal;

[0024] a processing module, configured to generate a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal;

[0025] a sending module, configured to send, to the first terminal, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0026] The receiving module is further configured to receive fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0027] In a fifth aspect, the present application also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the security authentication method described above is implemented.

[0028] In a sixth aspect, the present application also provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, it implements any of the security authentication methods described above.

[0029] In a seventh aspect, the present application also provides a computer program product, comprising a computer program, which, when executed by a processor, implements any of the security authentication methods described above.

[0030] The security authentication method and device provided by the present application are as follows: the first terminal generates fingerprint information, a first public key and a first private key corresponding to the first public key, and sends the first public key to the server; the first terminal receives the second public key encrypted based on the first public key and the first random number corresponding to the first terminal sent by the server; the first random number is used to authenticate the first terminal and / or the server. Since the terminal and the server can be authenticated, security is improved; further, the first terminal generates a first session key based on the second public key and the first private key, and uses the first session key to encrypt the fingerprint information; the first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to authenticate the first terminal. Since the first session key is used for communication, the security of communication between the user terminal and the server can be effectively improved, and the solution does not depend on the specific hardware architecture and implementation, and has strong scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0032] FIG1 is a flow chart of a security authentication method according to an embodiment of the present invention;

[0033] FIG2 is a schematic diagram of fingerprint level information of a security authentication method provided in an embodiment of the present application;

[0034] FIG3 is a schematic diagram of the interactive process of the security authentication method provided in an embodiment of the present application;

[0035] FIG4 is a schematic diagram of the terminal identity authentication principle of the security authentication method provided in an embodiment of the present application;

[0036] FIG5 is a schematic diagram of a server identity authentication principle of a security authentication method provided in an embodiment of the present application;

[0037] FIG6 is a second schematic diagram of the server identity authentication principle of the security authentication method provided in an embodiment of the present application;

[0038] FIG7 is a schematic diagram of the public key commitment principle of the security authentication method provided in an embodiment of the present application;

[0039] FIG8 is a schematic diagram of the key hierarchy of the security authentication method provided in an embodiment of the present application;

[0040] FIG9 is a second flow chart of a security authentication method according to an embodiment of the present application;

[0041] FIG10 is a schematic diagram of a structure of a security authentication device according to an embodiment of the present application;

[0042] FIG11 is a second structural diagram of a security authentication device according to an embodiment of the present application;

[0043] FIG12 is a schematic structural diagram of a terminal provided in an embodiment of the present application;

[0044] FIG13 is a schematic diagram of the structure of the server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0046] First, the application scenarios involved in the embodiments of this application are introduced:

[0047] The application scenario of the embodiments of this application can be a communication system. The communication entities involved in this communication system include servers and distributed terminals, which is also the typical communication entity structure in the cloud computing paradigm. The server is responsible for verifying the identity authenticity of the user terminal and exchanging information with the user terminal. The terminal can also verify the identity authenticity of the server, request access to resources, and exchange information with the server.

[0048] Currently, most security authentication solutions are implemented based on public key infrastructure (PKI). However, PKI systems are relatively complex, encompassing multiple aspects such as certificate issuance, certificate management, and key lifecycle management. Deploying and maintaining PKI requires specialized knowledge and may be too cumbersome for small organizations. Furthermore, as network size increases, PKI systems may face scalability issues. Managing large numbers of certificates, key pairs, and user terminals can become complex, especially in large organizations or complex network environments. Finally, if core components of a PKI system, such as certificate authorities, are attacked or malfunction, the entire system may be affected. The security of PKI is based on trust in the issuing authority. If users or systems do not trust the issuing authority, the security of the entire system is threatened. PKI-based solutions typically assume the security of the central certificate authority (CA). Identity authentication is typically performed only on terminal devices, ignoring the authentication of CA nodes, which also poses certain security risks.

[0049] The technical solutions of the embodiments of the present application are described in detail below with reference to Figures 1 to 13. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0050] FIG1 is a flow chart of a security authentication method according to an embodiment of the present application. As shown in FIG1 , the method according to the embodiment includes:

[0051] Step 101: The first terminal generates fingerprint information, a first public key, and a first private key corresponding to the first public key, and sends the first public key to the server;

[0052] Specifically, the generation of fingerprint information can be combined with information of multiple dimensions of the first terminal. Optionally, an appropriate encryption algorithm or key generation algorithm can be selected to generate fingerprint information that is deeply bound to the first terminal. In order to avoid collisions, the generation of the first private key can select information of some dimensions or be directly based on the fingerprint information through an encryption algorithm. This encryption algorithm is not limited in the embodiment of the present application. The generation of the first private key can be related to the fingerprint information or unrelated to the fingerprint information. If the fingerprint information is used as the root key to generate the first private key, it is necessary to ensure that the fingerprint information cannot be reversed from the generated first private key. Optionally, the first private key can also be generated based on other information, such as a random number, which is not limited in the embodiment of the present application.

[0053] Optionally, the first public key is generated by the first private key. For example, the first private key is recorded as SK i , the first public key is recorded as PK i , i corresponds to the first terminal T i .

[0054] Step 102: The first terminal receives a second public key encrypted based on the first public key and a first random number corresponding to the first terminal, which are sent by the server; the first random number is used to authenticate the first terminal and / or the server;

[0055] Specifically, the server stores the first public key PK uploaded by the first terminal i , and generate the first terminal T i Dedicated public-private key pair (i.e., the second public key and the second private key, denoted as (PK′ i ,SK′ i )) and the first random number

[0056] The first random number in this step Can be used for server authentication, the first random number It can also be used for identity verification of the first terminal.

[0057] The server uses the first public key PK i Encrypted second public key PK′ i and the first random number And send it to the first terminal T i Optionally, the encryption algorithm can be an asymmetric encryption algorithm such as RSA, elliptic curve encryption algorithm, etc., such as using PK i As the encryption key, the encrypted ciphertext is sent to the first terminal T i , achieving PK′ i and secure transmission.

[0058] Step 103: The first terminal generates a first session key based on the second public key and the first private key, and encrypts the fingerprint information using the first session key;

[0059] Step 104: The first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to authenticate the first terminal.

[0060] Specifically, the first terminal T i Use the first private key SK i Decrypt the encrypted second public key PK′ received in step 102 i and the first random number And use the second public key PK′ i With the first private key SK i Combined generated first session key, encrypted fingerprint information fp i Then, the first terminal T i Upload encrypted fingerprint information

[0061] The fingerprint information can be used to authenticate the identity of the first terminal.

[0062] Optionally, the fingerprint information fp i Symmetric encryption may be used for encryption, such as using the Advanced Encryption Standard (AES) algorithm.

[0063] Optionally, the server decrypts Get fp i and store.

[0064] In the method of this embodiment, the first terminal generates fingerprint information, a first public key and a first private key corresponding to the first public key, and sends the first public key to the server; the first terminal receives the second public key encrypted based on the first public key and the first random number corresponding to the first terminal sent by the server; the first random number is used to authenticate the first terminal and / or the server. Since the terminal and the server can be authenticated, security is improved; further, the first terminal generates a first session key based on the second public key and the first private key, and uses the first session key to encrypt the fingerprint information; the first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to authenticate the first terminal. Since the first session key is used for communication, the security of communication between the user terminal and the server can be effectively improved, and the solution does not depend on the specific hardware architecture and implementation and has strong scalability.

[0065] Optionally, the fingerprint information is generated based on information from at least one layer, as shown in Figure 2. The at least one layer includes at least one of the following: electronic device layer, network and protocol layer, plug-in layer, and behavior authentication layer. The information from the electronic device layer is information inherent to the electronic device of the first terminal, the information from the network protocol layer is configuration information for the network protocol class, the information from the plug-in layer is information about plug-ins and / or drivers installed in the first terminal, and the information from the behavior authentication layer is information generated based on the interaction between the user and the first terminal or the interaction between the terminal and the server. Specifically, the generation of fingerprint information requires combining information from at least one layer, including at least one of the following: electronic device layer, network and protocol layer, plug-in layer, and behavior authentication layer.

[0066] For example, an appropriate key generation algorithm such as a hash algorithm can be selected to generate fingerprint information that is deeply bound to the first terminal. To avoid collisions, the generation of the first private key can be achieved by selecting information from at least one layer or directly based on the fingerprint information using any encryption algorithm.

[0067] Optionally, the information of the electronic device layer refers to the physical data of the electronic devices inherent in the first terminal, such as information of various hardware devices including the central processing unit CPU, registers, sound card, network card, scrambler, encryptor, underlying registers, system clock and clock drift, permanent cookies, etc.

[0068] The information of the network and protocol layer refers to the configuration information of various network and protocol classes of the first terminal, including but not limited to the Media Access Control (MAC) address, Domain Name System (DNS) resolution configuration information, Transmission Control Protocol (TCP) / IP configuration information, geographic location information, TCP / IP configuration information, and wireless local area network (such as IEEE 802.11) configuration information.

[0069] The information of the plug-in layer includes, for example, various plug-ins and / or driver information installed in the first terminal to implement various functions, such as various plug-ins and / or driver information downloaded during network operations, information on various plug-ins and / or drivers locally installed on the first terminal, and version information of the operating system and related software.

[0070] The information in the behavior authentication layer is the behavioral data information generated by various interactive behaviors between users and terminals, and various interactive behaviors between terminals and servers. For example, it includes measurable system performance, calibration errors of hardware sensors, various log information, and user historical browsing records. Due to the diversity of terminal behaviors, the information in the behavior authentication layer needs to have a certain degree of fault tolerance.

[0071] In one possible implementation, after the first terminal encrypts and uploads fingerprint information using a first session key, the server stores the fingerprint information. For example, when the server needs to verify the first terminal's true identity, it can set the weights of each level and verify the user's fingerprint information. As long as the error is within a reasonable range, the verification will pass. The terminal then locally generates its own public-private key pair and establishes an authentication relationship with the server. The secure fingerprint information enhances key security.

[0072] Optionally, the first terminal generates a first public key and a first private key corresponding to the first public key, including:

[0073] The first terminal generates the first private key using a first encryption algorithm according to the fingerprint information or the information of the at least one level;

[0074] The first terminal generates the first public key using a second encryption algorithm according to the first private key.

[0075] In a possible implementation, the first public key and the first private key may be generated in the following manner, for example:

[0076] The first terminal uses the fingerprint information or the information of at least one level as a key and a preset second random number as a message to generate the first private key using a message authentication code algorithm based on a hash function;

[0077] The first terminal obtains the first public key using an elliptic curve encryption algorithm according to a preset base point on the elliptic curve and the first private key.

[0078] Specifically, the first encryption algorithm is, for example, a keyed-hashing for message authentication algorithm (HMAC) based on a hash function. A root key and a message can be combined to generate an authentication code, which is used as the generated first private key. Specifically, the first terminal can use fingerprint information or at least one level of information as the root key, select a second random number as the message, and then calculate an HMAC value, which is used as the generated first private key SK i The specific calculation process is as follows:

[0079] Among them, opad and ipad are specific constants, key is fingerprint information or at least one level of information, and message is the second random number. represents an exclusive-or operation, || represents a concatenation operation, and Hash represents the selected hash function, such as SHA-256, SHA-512, etc.

[0080] First public key PK i The generation of PK can be achieved by the Elliptic Curve Cryptography (ECC) algorithm. After selecting a suitable elliptic curve and the base point G on the elliptic curve, the base point G is multiplied by the first private key using the point multiplication operation on the elliptic curve to obtain the first public key, i.e., PK i =SK i· G.

[0081] Optionally, generate (PK i ,SK i ), (PK′ i ,SK′ i ) can use the same method, for example, both use HMAC algorithm and elliptic curve encryption algorithm to encrypt the fingerprint information fp i Symmetric encryption is used for encryption, and the server can use PK i· SK′ i More convenient decryption

[0082] Optionally, the first terminal may also generate identity information using a third encryption algorithm according to the fingerprint information or information of at least one level.

[0083] For example, the HMAC algorithm can be used to generate the identity information. The terminal uses the fingerprint information or at least one level of information as the key and the preset random number as the message to generate the identity information using the HMAC algorithm. That is, the identity information ID of the first terminal i You can take the first private key SK i The same generation method. The fingerprint information fp i Or at least one level of information as a key, select a preset random number as the message and then calculate an HMAC value as the identity information ID of the first terminal i .

[0084] In the above implementation, the first private key is generated by fingerprint information or at least one level of information, and the first public key is generated based on the first private key, thereby improving the security of the key.

[0085] Optionally, sending the first public key to the server can be achieved in the following ways:

[0086] Converting the fingerprint information into elements of a finite field, and encrypting the elements of the finite field to obtain a first intermediate number;

[0087] Obtaining a second intermediate number using a fourth encryption algorithm according to the first public key and the first intermediate number;

[0088] Obtaining certification information according to the elements of the finite field, the second intermediate number, and the first private key;

[0089] The first public key, the first intermediate number, and the certification information are sent to the server.

[0090] Specifically, the first terminal directly uploads the first public key and binds the first public key to the fingerprint information of the first terminal. That is, the first public key and the fingerprint information of the first terminal are in one-to-one correspondence.

[0091] For example, using a zero-knowledge proof method to i and fingerprint information fp i Bind them together and upload the proof information π and the first public key PK at the same time i Specifically, the first terminal first performs fingerprint information fp i Processed into a finite field The element m on the matrix is ​​encrypted using the elliptic curve algorithm, that is, M=m·G. In other embodiments, M can also be implemented using other encryption algorithms, such as discrete logarithm encryption algorithm, lattice encryption algorithm, etc., which is not limited in the embodiments of the present application.

[0092] The first terminal T i To calculate the second intermediate number, for example, a hash algorithm can be used: c = hash (PK i ,M), then based on the element m of the finite field, the second intermediate number c and the first private key SK i Calculate proof information, such as π = m + c × SK i , the first terminal uploads triplet information (PK i ,M,π) to the server.

[0093] In the above implementation, the first public key and the fingerprint information can be bound by the zero-knowledge proof method, which has a simple implementation scheme, high efficiency and high security.

[0094] Optionally, the method further includes:

[0095] The first terminal receives the business key sent by the server, where the business key is a business key encrypted based on the second session key and has a timestamp; the timestamp includes the valid time information of the business key; the business key is used for the target business of the first terminal; and the second session key is generated based on the first public key and the second private key corresponding to the second public key.

[0096] Specifically, in the communication channel between the first terminal and the server, only the first terminal T i The first public key PK i Even if the attacker obtains PK i , nor can it be achieved through PK alone i The server can obtain other confidential information (such as a private key). In addition, the server can use the second session key to send encrypted data to the first terminal, for example, by using symmetric encryption for secure communication. For example, the server uses the second session key to encrypt the service key with a timestamp and sends it to the first terminal T. i The service key is a special key for a certain target service. The timestamp may include the validity time information of the service key.

[0097] In the above implementation, the service key is encrypted with the second session key and then sent, which has higher security.

[0098] Exemplarily, as shown in FIG3 , the method includes the following steps:

[0099] Step 1: The first terminal uploads the first public key to the server;

[0100] Step 2: The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal;

[0101] Step 3: The server sends the second public key and the first random number encrypted based on the first public key to the first terminal;

[0102] Step 4: The first terminal decrypts the encrypted second public key and the first random number based on the first private key to obtain the second public key and the first random number;

[0103] Step 5: The first terminal uploads the fingerprint information encrypted based on the first session key to the server; the first session key is obtained based on the second public key and the first private key;

[0104] Step 6: The server decrypts the encrypted fingerprint information based on the second session key and stores it; the second session key is obtained based on the first public key and the second private key;

[0105] Step 7: The server encrypts the service key based on the second session key and sends the encrypted data to the first terminal.

[0106] Optionally, as shown in FIG4 , the method further includes:

[0107] After receiving the verification request from the server, the first terminal sends the encrypted fingerprint information and / or the encrypted first random value to the server.

[0108] Specifically, in order to protect the legitimate first terminal Ti The legitimate rights and interests of resisting false T' i Attack, the server can continuously verify T i Fingerprint information fp i To determine the identity of the first terminal, the server may require the first terminal T i Upload the fp it owns i The encrypted value, such as fp i The server decrypts the hash value and matches it with the fingerprint information previously stored on the server. If the match is successful, the first terminal T i In addition to verifying the identity of the first terminal T i Fingerprint information fp i To determine the identity of the first terminal, the first random number To carry out T i Identity verification, as fingerprint information fp i Supplementary means of verification, such as the first terminal sending a first random number The server decrypts the hash value and matches it with the first random number generated previously. If the match is successful, the first terminal T i The authentication is passed.

[0109] In the above implementation, identity authentication of the first terminal can be achieved through fingerprint information or the first random number, and the implementation scheme is simple, efficient, and secure.

[0110] Optionally, the method further includes:

[0111] The first terminal sends a verification request to the server;

[0112] The first terminal receives an encrypted first random number sent by the server based on the verification request;

[0113] The first terminal performs identity authentication on the server based on the encrypted first random number.

[0114] Specifically, the server is the main body in the communication process and stores a large amount of confidential information of the terminals. In many existing solutions, it is assumed that the server is absolutely authentic and secure. If it is counterfeited, it will cause damage to many terminals. i The rights and security of the user are seriously threatened. In the embodiment of the present application, the terminal can use the first random number The server's identity is verified using the first secret and the second public key to avoid security issues.

[0115] As shown in FIG5 , for the first random number To verify the identity of the server, for example, a heartbeat verification method can be used, where each first terminal requires the server to produce a first random number previously issued. (which can be called a heartbeat) is an encrypted version, such as Each first terminal is based on the server Verify, if the server issues The first terminal previously received If the encrypted versions are consistent, a score is awarded, otherwise no score is awarded. The scores calculated by each first terminal are counted. If the score is greater than the preset threshold, the server passes the verification, otherwise the verification fails. The number of first terminals n and the preset threshold can be set according to security requirements. The larger the n and the preset threshold are, the stronger the security is. It is assumed here that the capabilities of the fake server are equal to the real server. Then the probability of a fake server successfully passing the verification is approximately

[0116] Optionally, the first terminal receives a first secret sent by the server; the first secret is used to authenticate the server;

[0117] The first terminal obtains a second secret using Lagrange interpolation based on identity information of multiple second terminals and the second public key as a secret share; the multiple second terminals include the first terminal;

[0118] If the second secret is consistent with the first secret, it is determined that the identity authentication of the server is successful.

[0119] Specifically, a trapdoor can be buried by secret sharing to facilitate the later verification of the server. For example, construct an n-1 degree polynomial f(x) = a0+a1x+…+a n x n-1 In this polynomial, a0 is the secret that each party needs to recover to verify the server, and the coefficient a i (i∈{1,2,…,n}) is selected using a random number generation method, and a0 can also be a random number.

[0120] The server also needs to publish the encrypted secret A0=a0·G, which is the first secret. For example, the second private key SK′ i You can take SK′ i =f(ID i ), (ID i , SK′ i ) can be used as a secret share, optionally, a second public key PK′ i Can be based on SK′ iEncryption is obtained, for example, by using the point multiplication operation on the elliptic curve, multiplying the base point G by the second private key to obtain the second public key, namely PK′ i =SK′ i ·G.

[0121] Optionally, the first secret may be broadcasted by the central server. As shown in FIG6 , n first terminals T i Select the verification function to enter the verification area and contribute the received second public key PK' i , PK′ i =SK′ i G, will (ID i ,PK′ i ) as a secret share and using the Lagrange interpolation polynomial, the coefficient a0 in the original polynomial can be recovered to obtain the second secret A′0 encrypted by the base point. If the recovered A′0 is consistent with the A0 previously published by the server, the verification is successful, otherwise the verification fails.

[0122] In the above implementation, the identity authentication of the server can be achieved in different ways, which improves security and has greater flexibility.

[0123] Optionally, before step 101, the following steps are further included:

[0124] The first terminal sends a third random number corresponding to the first terminal to the server, where the third random number is used to generate a commitment value, and the commitment value is generated based on the first public keys of multiple second terminals in a preset range and the corresponding third random numbers.

[0125] Optionally, the method further includes:

[0126] The first terminal generates an updated first private key, obtains difference information based on the updated first private key and the first private key before the update, and sends the encrypted difference information to the server.

[0127] Specifically, to improve key security, a commitment value can be generated based on a vector commitment approach. This vector commitment locks the key, preventing tampering and enabling verification by any party. This solution offers the advantages of convenient storage and the ability to modify the private key without revealing the details of the new private key when uploaded.

[0128] As shown in FIG7 , the server performs vector commitment on the first public keys of multiple first terminals, that is, generates a commitment value where d i The first terminal T iA random number is selected and reported to the server. The subsequent key update or identity cancellation of the first terminal can be performed based on the commitment value. For example, the bilinear mapping method can be used to verify whether the public key commitment is correct. Specifically, the key update can include two parts. First, the first terminal updates the first private key by itself. Assume that the first terminal T i The updated first private key is Then the first terminal only needs to encrypt the upload with the first session key That is, the difference information of the first public key. Similarly, the server can also select a new key, that is, select a new second public key PK' i After being encrypted with the second session key, it is sent to the first terminal. The first terminal T i It is combined with its own first private key to form a new first session key.

[0129] Optionally, if some first terminals need to be deleted due to account cancellation, this can be done by simply modifying the commitment value in the vector commitment (deleting the sub-commitment and sub-proof of the first terminal), completely invalidating the first public key of the first terminal and its first session key. Furthermore, the server and the first terminal must continuously synchronize time. In this embodiment, timestamps are updated and checked to ensure their timeliness and accuracy.

[0130] In the above implementation, the key and other related confidential information can be updated, which greatly enhances the security of the system.

[0131] As shown in Figure 8, the embodiment of the present application proposes the concept of a key hierarchy, namely, three layers of keys. The first layer is the root key, such as the fingerprint information of the terminal; the second layer is the first private key (static master key) of the user terminal and the second public key (dynamic master key) dedicated to the user terminal by the server. The first private key of the user terminal is randomly generated using the root key as a seed, and the second public key dedicated to the user terminal is generated by the server. The first private key and the second public key dedicated to the user terminal are combined to form a session key, which is used for communication between the server and the terminal; the third layer is the business key, that is, the server transmits a dedicated key for a certain business through the session key generated with the terminal.

[0132] The method includes:

[0133] The terminal generates a first public key and a first private key corresponding to the first public key, and sends the first public key to the server;

[0134] The terminal receives a second public key encrypted based on the first public key and sent by the server; the second public key has a corresponding second private key;

[0135] The terminal generates a first session key based on the second public key and the first private key, where the first session key is used when the terminal sends data to the server.

[0136] In summary, the security key system and identity authentication scheme provided by the embodiment of the present application can effectively improve the security of communication between the user terminal and the server, and can well protect data resources so that they can only be accessed by authorized legal users. In addition, the scheme does not depend on the specific hardware architecture and implementation, and has strong scalability. Optionally, a lightweight encryption algorithm is used when encrypting. For example, when uploading fingerprint information fp i Symmetric encryption can be used to significantly speed up encryption and decryption. When performing various random number verification challenges, both parties must compare the hash values ​​of the random numbers, making hash operations extremely fast. Furthermore, when using asymmetric encryption, this solution can employ elliptic curve encryption, which is more efficient than RSA when the key lengths are the same. Overall, this solution offers excellent scalability, high efficiency, and high security, making it highly valuable in various scenarios, such as copyright protection.

[0137] FIG9 is a second flow chart of the security authentication method provided in an embodiment of the present application. As shown in FIG9 , the method provided in this embodiment includes:

[0138] Step 901: The server receives a first public key sent by a first terminal;

[0139] Step 902: The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal, and sends the second public key encrypted with the first public key and the first random number corresponding to the first terminal to the first terminal; the first random number is used to authenticate the first terminal and / or the server.

[0140] Step 903: The server receives fingerprint information of the first terminal encrypted based on the first session key, where the first session key is generated based on the second public key and the first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0141] Optionally, the server generates a second public key and a second private key corresponding to the second public key, including:

[0142] The server generates the second private key using a third encryption algorithm according to the identity information of the terminal;

[0143] The server generates the second public key according to the second private key.

[0144] Optionally, the method further includes:

[0145] The server encrypts a first secret according to coefficients of a polynomial generated based on random numbers, and sends the first secret to the first terminal.

[0146] Optionally, the method further includes:

[0147] The server generates a second session key based on the first public key and the second private key;

[0148] The server decrypts and stores the encrypted fingerprint information according to the second session key.

[0149] Optionally, the method further includes:

[0150] The server sends a verification request to the first terminal;

[0151] The server receives the encrypted fingerprint information or the first random number sent by the terminal based on the verification request, and performs identity authentication on the first terminal based on the encrypted fingerprint information or the first random number.

[0152] The method in the embodiment of the present application has similar implementation principles and technical effects to the method in any of the aforementioned first terminal side method embodiments, and will not be described in detail here.

[0153] The security authentication device provided in the present application is described below. The security authentication device described below and the security authentication method described above can be referenced to each other.

[0154] FIG10 is one of the structural diagrams of the security authentication device provided in an embodiment of the present application.

[0155] As shown in FIG10 , the security authentication device provided in this embodiment includes:

[0156] The processing module 1010 is configured to generate fingerprint information, a first public key, and a first private key corresponding to the first public key;

[0157] A sending module 1020 is configured to send the first public key to a server;

[0158] A receiving module 1030 is configured to receive a second public key encrypted based on the first public key and a first random number corresponding to the first terminal, sent by the server; the first random number is used to authenticate the first terminal and / or the server;

[0159] The processing module 1010 is further configured to generate a first session key based on the second public key and the first private key, and encrypt the fingerprint information using the first session key;

[0160] The sending module 1020 is further configured to send the encrypted fingerprint information to the server; the fingerprint information is used to perform identity authentication on the first terminal.

[0161] Optionally, the fingerprint information is generated based on information of at least one layer, and the at least one layer includes at least one of the following: electronic device layer, network and protocol layer, plug-in layer, and behavior authentication layer; the information of the electronic device layer is information inherent in the electronic device of the first terminal, the information of the network protocol layer is configuration information of the network protocol class, the information of the plug-in layer is information of the plug-in and / or driver installed in the first terminal, and the information of the behavior authentication layer is information generated based on the interaction behavior between the user and the first terminal or the interaction behavior between the terminal and the server.

[0162] Optionally, the processing module 1010 is specifically configured to:

[0163] generating the first private key by using a first encryption algorithm according to the fingerprint information or the information of the at least one level;

[0164] The first public key is generated using a second encryption algorithm according to the first private key.

[0165] Optionally, the first encryption algorithm is a message authentication code algorithm based on a hash function, and the processing module 1010 is specifically configured to:

[0166] Using the fingerprint information or at least one level of information as a key and a preset second random number as a message, and using the hash function-based message authentication code algorithm to generate the first private key;

[0167] The second encryption algorithm is an elliptic curve encryption algorithm, and the processing module 1010 is specifically configured to:

[0168] The first public key is obtained using the elliptic curve encryption algorithm according to a preset base point on the elliptic curve and the first private key.

[0169] Optionally, the processing module 1010 is further configured to:

[0170] Identity information is generated using a third encryption algorithm according to the fingerprint information or at least one level of information.

[0171] Optionally, the sending module 1020 is specifically configured to:

[0172] Converting the fingerprint information into elements of a finite field, and encrypting the elements of the finite field to obtain a first intermediate number;

[0173] Obtaining a second intermediate number using a fourth encryption algorithm according to the first public key and the first intermediate number;

[0174] Obtaining certification information according to the elements of the finite field, the second intermediate number, and the first private key;

[0175] The first public key, the first intermediate number, and the certification information are sent to the server.

[0176] Optionally, the receiving module 1030 is further configured to:

[0177] Receive a business key sent by the server, where the business key is encrypted based on the second session key and has a timestamp; the timestamp includes valid time information of the business key; the business key is used for the target business of the first terminal; and the second session key is generated based on the first public key and the second private key corresponding to the second public key.

[0178] Optionally, the sending module 1020 is further configured to:

[0179] After receiving the verification request from the server, the encrypted fingerprint information and / or the encrypted first random value are sent to the server.

[0180] Optionally, the sending module 1020 is further configured to:

[0181] Sending a verification request to the server;

[0182] Optionally, the receiving module 1030 is further configured to:

[0183] receiving an encrypted first random number sent by the server based on the verification request;

[0184] The processing module 1010 is further configured to:

[0185] Authentication of the server is performed based on the encrypted first random number.

[0186] Optionally, the receiving module 1030 is further configured to:

[0187] receiving a first secret sent by the server;

[0188] The processing module 1010 is further configured to:

[0189] Obtaining a second secret using Lagrange interpolation based on identity information of multiple second terminals and the second public key as a secret share; the multiple second terminals include the first terminal;

[0190] If the second secret is consistent with the first secret, it is determined that the identity authentication of the server is successful.

[0191] Optionally, the processing module 1010 is further configured to:

[0192] Generate an updated first private key, and obtain difference information based on the updated first private key and the first private key before the update;

[0193] The sending module 1020 is further configured to:

[0194] Send the encrypted difference information to the server.

[0195] Optionally, the sending module 1020 is further configured to:

[0196] A third random number corresponding to the first terminal is sent to the server, where the third random number is used to generate a commitment value, where the commitment value is generated based on the first public keys and corresponding third random numbers of multiple second terminals within a preset range; the multiple second terminals include the first terminal.

[0197] The device of the embodiment of the present application is used to execute the method in any of the aforementioned first terminal side method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0198] FIG11 is a second structural diagram of the security authentication device provided in an embodiment of the present application.

[0199] As shown in FIG11 , the security authentication device provided in this embodiment includes:

[0200] Receiving module 1110, configured to receive a first public key sent by a first terminal;

[0201] The processing module 1120 is configured to generate a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal;

[0202] A sending module 1130 is configured to send, to the first terminal, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0203] The receiving module 1110 is further configured to receive fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0204] Optionally, the processing module 1120 is specifically configured to:

[0205] generating the second private key using a third encryption algorithm according to the identity information of the terminal;

[0206] Generate the second public key according to the second private key.

[0207] Optionally, the processing module 1120 is further configured to:

[0208] Encrypting a first secret according to coefficients of a polynomial generated based on a random number;

[0209] The sending module 1130 is further configured to send the first secret to the first terminal.

[0210] Optionally, the processing module 1120 is further configured to:

[0211] generating a second session key based on the first public key and the second private key;

[0212] The encrypted fingerprint information is decrypted and stored according to the second session key.

[0213] Optionally, the sending module 1130 is further configured to:

[0214] Sending a verification request to the first terminal;

[0215] The receiving module 1110 is further configured to receive the encrypted fingerprint information or the first random number sent by the terminal based on the verification request;

[0216] The processing module 1120 is further configured to: perform identity authentication on the first terminal based on the encrypted fingerprint information or the first random number.

[0217] The device of the embodiment of the present application is used to execute the method in any of the aforementioned server-side method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0218] FIG12 illustrates a schematic diagram of the physical structure of a first terminal. As shown in FIG12 , the first terminal may include: a processor 1210, a communications interface 1220, a memory 1230, and a communication bus 1240. The processor 1210, the communications interface 1220, and the memory 1230 communicate with each other via the communication bus 1240. The processor 1210 may invoke logic instructions in the memory 1230 to execute a security authentication method, which includes: the first terminal generating fingerprint information, a first public key, and a first private key corresponding to the first public key, and sending the first public key to a server;

[0219] The first terminal receives, from the server, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0220] The first terminal generates a first session key based on the second public key and the first private key, and encrypts the fingerprint information using the first session key;

[0221] The first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to perform identity authentication on the first terminal.

[0222] In addition, the logic instructions in the above-mentioned memory 1230 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0223] FIG13 illustrates a schematic diagram of a physical structure of a server. As shown in FIG13 , the first terminal may include: a processor 1310, a communications interface 1320, a memory 1330, and a communication bus 1340. The processor 1310, the communications interface 1320, and the memory 1330 communicate with each other via the communication bus 1340. The processor 1310 may call logic instructions in the memory 1330 to execute a security authentication method, which includes:

[0224] The server receives the first public key sent by the first terminal;

[0225] The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal, and sends the second public key encrypted based on the first public key and the first random number corresponding to the first terminal to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0226] The server receives fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0227] In addition, the logic instructions in the above-mentioned memory 1330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0228] On the other hand, the present application further provides a computer program product, the computer program product including a computer program, the computer program being storable on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is capable of executing the security authentication method provided by the above methods, the method including: a first terminal generating fingerprint information, a first public key, and a first private key corresponding to the first public key, and sending the first public key to a server;

[0229] The first terminal receives, from the server, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0230] The first terminal generates a first session key based on the second public key and the first private key, and encrypts the fingerprint information using the first session key;

[0231] The first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to authenticate the identity of the first terminal; or,

[0232] The server receives the first public key sent by the first terminal;

[0233] The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal, and sends the second public key encrypted based on the first public key and the first random number corresponding to the first terminal to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0234] The server receives fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0235] In another aspect, the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the security authentication method provided by the above methods, the method comprising: a first terminal generating fingerprint information, a first public key, and a first private key corresponding to the first public key, and sending the first public key to a server;

[0236] The first terminal receives, from the server, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0237] The first terminal generates a first session key based on the second public key and the first private key, and encrypts the fingerprint information using the first session key;

[0238] The first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to authenticate the identity of the first terminal; or,

[0239] The server receives the first public key sent by the first terminal;

[0240] The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal, and sends the second public key encrypted based on the first public key and the first random number corresponding to the first terminal to the first terminal; the first random number is used to authenticate the first terminal and / or the server;

[0241] The server receives fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

[0242] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0243] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0244] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A security authentication method, comprising: The first terminal generates fingerprint information, a first public key, and a first private key corresponding to the first public key, and sends the first public key to the server; The first terminal receives, from the server, a second public key encrypted based on the first public key and a first random number corresponding to the first terminal; The first random number is used to authenticate the first terminal and / or the server; The first terminal generates a first session key based on the second public key and the first private key, and encrypts the fingerprint information using the first session key; The first terminal sends the encrypted fingerprint information to the server; the fingerprint information is used to perform identity authentication on the first terminal.

2. The security authentication method according to claim 1, wherein: The fingerprint information is generated based on information of at least one layer, and the at least one layer includes at least one of the following: electronic device layer, network and protocol layer, plug-in layer, and behavior authentication layer; the information of the electronic device layer is information inherent to the electronic device of the first terminal, the information of the network protocol layer is configuration information of the network protocol class, the information of the plug-in layer is information of the plug-in and / or driver installed in the first terminal, and the information of the behavior authentication layer is information generated based on the interaction behavior between the user and the first terminal or the interaction behavior between the terminal and the server.

3. The security authentication method according to claim 2, wherein: The first terminal generates a first public key and a first private key corresponding to the first public key, including: The first terminal generates the first private key using a first encryption algorithm according to the fingerprint information or the information of the at least one level; The first terminal generates the first public key using a second encryption algorithm according to the first private key.

4. The security authentication method according to claim 3, wherein: The first encryption algorithm is a message authentication code algorithm based on a hash function, and the first terminal generates the first private key using the first encryption algorithm according to the fingerprint information or the information of the at least one level, including: The first terminal uses the fingerprint information or the information of at least one level as a key and a preset second random number as a message, and generates the first private key by using the message authentication code algorithm based on the hash function; The second encryption algorithm is an elliptic curve encryption algorithm, and the first terminal generates the first public key using the second encryption algorithm according to the first private key, including: The first terminal obtains the first public key using the elliptic curve encryption algorithm according to a preset base point on the elliptic curve and the first private key.

5. The security authentication method according to any one of claims 2 to 4, further comprising: The first terminal generates identity information using a third encryption algorithm according to the fingerprint information or at least one level of information.

6. The security authentication method according to any one of claims 1 to 4, wherein: The sending the first public key to the server includes: Converting the fingerprint information into elements of a finite field, and encrypting the elements of the finite field to obtain a first intermediate number; Obtaining a second intermediate number using a fourth encryption algorithm according to the first public key and the first intermediate number; Obtaining certification information according to the elements of the finite field, the second intermediate number, and the first private key; The first public key, the first intermediate number, and the certification information are sent to the server.

7. The security authentication method according to any one of claims 1 to 4, further comprising: The first terminal receives a service key sent by the server, where the service key is a service key encrypted based on the second session key and carries a timestamp; The timestamp includes valid time information of the service key; the service key is used for the target service of the first terminal; the second session key is generated based on the first public key and a second private key corresponding to the second public key.

8. The security authentication method according to any one of claims 1 to 4, further comprising: After receiving the verification request from the server, the first terminal sends the encrypted fingerprint information and / or the encrypted first random value to the server; The encrypted fingerprint information and / or the encrypted first random value are used to authenticate the first terminal.

9. The security authentication method according to any one of claims 1 to 4, further comprising: The first terminal sends a verification request to the server; The first terminal receives an encrypted first random number sent by the server based on the verification request; The first terminal performs identity authentication on the server based on the encrypted first random number.

10. The security authentication method according to any one of claims 1 to 4, further comprising: The first terminal receives a first secret sent by the server; The first terminal obtains a second secret using Lagrange interpolation based on identity information of multiple second terminals and the second public key as a secret share; the multiple second terminals include the first terminal; If the second secret is consistent with the first secret, it is determined that the identity authentication of the server is successful.

11. The security authentication method according to any one of claims 1 to 4, further comprising: The first terminal generates an updated first private key, obtains difference information based on the updated first private key and the first private key before the update, and sends the encrypted difference information to the server.

12. The security authentication method according to any one of claims 1 to 4, further comprising: The first terminal sends a third random number corresponding to the first terminal to the server, where the third random number is used to generate a commitment value, where the commitment value is generated based on the first public keys and corresponding third random numbers of multiple second terminals within a preset range; the multiple second terminals include the first terminal.

13. A security authentication method, comprising: The server receives the first public key sent by the first terminal; The server generates a second public key, a second private key corresponding to the second public key, and a first random number corresponding to the first terminal, and sends the second public key encrypted based on the first public key and the first random number corresponding to the first terminal to the first terminal; The first random number is used to authenticate the first terminal and / or the server; The server receives fingerprint information of the first terminal encrypted based on a first session key, where the first session key is generated based on the second public key and a first private key corresponding to the first public key; the fingerprint information is used to authenticate the first terminal.

14. The security authentication method according to claim 13, wherein: The server generates a second public key and a second private key corresponding to the second public key, including: The server generates the second private key using a third encryption algorithm according to the identity information of the terminal; The server generates the second public key according to the second private key.

15. The security authentication method according to claim 13 or 14, further comprising: The server encrypts a first secret according to coefficients of a polynomial generated based on random numbers, and sends the first secret to the first terminal.

16. The security authentication method according to claim 13 or 14, further comprising: The server generates a second session key based on the first public key and the second private key; The server decrypts and stores the encrypted fingerprint information according to the second session key.

17. The security authentication method according to claim 13 or 14, further comprising: The server sends a verification request to the first terminal; The server receives the encrypted fingerprint information or the first random number sent by the terminal based on the verification request, and performs identity authentication on the first terminal based on the encrypted fingerprint information or the first random number.

18. A first terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security authentication method according to any one of claims 1 to 12 when executing the program.

19. A server comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security authentication method according to any one of claims 13 to 17 when executing the program.

20. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the security authentication method according to any one of claims 1 to 12 or the security authentication method according to any one of claims 13 to 17 is implemented.

Images