WO2011124051A1

WO2011124051A1 - Method and system for terminal authentication

Info

Publication number: WO2011124051A1
Application number: PCT/CN2010/075640
Authority: WO
Inventors: 王斌
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-04-06
Filing date: 2010-08-02
Publication date: 2011-10-13
Also published as: CN101841814B; CN101841814A

Abstract

The present invention discloses a method and system for terminal authentication, in the method, an authentication server implements first authentication for a terminal according to first authentication data sent by the terminal, wherein the first authentication data is generated according to user feature information of the terminal; the authentication server implements second authentication according to second authentication data sent by the terminal, wherein the second authentication data is generated according to an authentication key, terminal parameters and network parameters; under the condition of the success of the first authentication and the second authentication, the authentication server determines the terminal authentication is successful. The technical solution of the present invention not only enhances the security of a network used by a user, and enhances the protection to the user personal privacy, but also protects legal rights and interests of operators.

Description

The present invention relates to the field of mobile communications, and in particular to a terminal authentication method and system. BACKGROUND With the rapid development and popularization of mobile communication technologies, the security of communication technologies has become a hot topic of concern. The security of communication is crucial to protect the privacy and interests of end users. At present, the following methods are mainly used to enhance the security of end users: 1. Signaling and data (voice, interaction) between the terminal and the mobile communication system. SMS, etc.) Encryption is performed by a specific security algorithm to prevent plaintext transmission from being monitored. 2. Use the International Mobile Station Identity (IMSI) or the Electronic Serial Number (ESN) as the identifier of the mobile station. Third, the terminal authentication mechanism was introduced. The normal process of authentication is that the base station sends a random number to the mobile station on the forward channel, and the mobile station according to the received random number and the stored confidential data related to the authentication and the identification code (such as ESN, IMSI, etc.), and The specific prefabricated network parameters (such as Key in Code Division Multiple Access CDMA System or Ki in Global Mobile Communication GSM System) are used to calculate an authentication result through the authentication algorithm, and the authentication result is reverse channel. Send to the base station. The authentication center AC (Authentication Centre) calculates the authentication result in the same way according to the stored mobile station confidential data, and compares the two authentication results to determine whether the terminal authentication is successful. Authentication is actually an algorithm based on confidential data. As long as the confidential data is not leaked, even if the thief acquires the identity of the mobile station, the correct authentication result cannot be calculated and the network cannot be accessed. In order to facilitate the user, the operator usually uses the card separation scheme to solidify some specific network parameters into the user identification card (such as the customer identification module SIM card) or in the non-volatile storage unit of the terminal before the terminal is sold. Therefore, when the user uses the network, as long as the parameters in the user identification card are legal, the terminal can use the system monthly service normally. The security of the user ID card is also protected by a specific encryption algorithm, and the security algorithm of the card itself is constantly being updated. However, there are many tools for copying stolen cards on the market. In a very simple implementation, the SIM card is cracked and the data in the card is completely copied to another card. All parameters are copied, including the authentication algorithm and all the important parameters required for voice encryption. Thus, if the user's SIM card is accidentally lost or stolen, the privacy and interests of the individual (illegally stealing the user's credit) may be violated. If the user has acquired such a tool, he or she can copy the card at will, such as a "" multi-number function (currently moving a card with this function, but for an additional fee), or copying a card into multiple cards, It also brings harm to the management and interests of operators. In summary, the existing terminal authentication mechanism is insufficient to ensure the security of the end user to use the network and the legitimate rights and interests of the operator. SUMMARY OF THE INVENTION A primary object of the present invention is to provide a terminal authentication method and system, so as to at least solve the problem that the existing terminal authentication mechanism is insufficient to ensure the security of the end user to use the network and the legitimate rights and interests of the operator. According to an aspect of the present invention, a terminal authentication method is provided, including: the authentication server performs first authentication on the terminal according to the first authentication data sent by the terminal, where the first authentication data is based on the terminal The user authentication information is generated; the authentication server performs the second authentication according to the second authentication data sent by the terminal, where the second authentication data is generated according to the authentication key, the terminal parameter, and the network parameter; If both authentication rights are successful, the authentication server determines that the terminal authentication is successful. According to another aspect of the present invention, a terminal authentication system is provided, including a terminal and an authentication server, where the terminal includes: a first authentication data module, configured to generate first authentication data, and authenticate The server sends the first authentication data, where the first authentication data is generated according to the user characteristic information of the terminal; the second authentication data module is configured to generate the second authentication data, and send the second authentication data to the authentication server. The second authentication data is generated according to the authentication key, the terminal parameter, and the network parameter; the authentication server includes a first authentication module, configured to perform first authentication on the terminal according to the first authentication data, and output the first An authentication result; a second authentication module, configured to perform second authentication on the terminal according to the second authentication data, and output a second authentication result; an authentication success judging module, respectively, and the first authentication module and the first The second authentication module is connected to determine the input first authentication result and the second authentication result. When both the first authentication result and the second authentication result are successful, determining the terminal Authentication is successful. Through the technical solution provided by the present invention, when the mobile terminal normally uses the network service, for example, performs operations such as registration, calling, short message, and data service, adding one to the existing authentication mechanism. If the user feature information is authenticated and the terminal is authenticated twice, and the two authentications are successful, the authentication server can determine the authentication success of the terminal, thereby enhancing the security of the user using the network, and enhancing the security. It protects the privacy of users and protects the legitimate rights and interests of operators. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic structural diagram of a mobile communication network system for terminal authentication according to an embodiment of the present invention; FIG. 2 is a flowchart of a terminal authentication method according to an embodiment of the present invention; FIG. 4 is a flowchart of performing first authentication on the terminal by using the encrypted first authentication data according to an embodiment of the present invention; FIG. 5 is a flowchart according to the present invention. FIG. 6 is a flowchart of terminal authentication according to Embodiment 2 of the present invention; FIG. 7 is a schematic structural diagram of a terminal authentication system according to an embodiment of the present invention; FIG. 8 is a schematic diagram of a terminal authentication system according to an embodiment of the present invention; FIG. 9A is a schematic structural diagram of a first authentication module according to an embodiment of the present invention; and FIG. 9B is a schematic structural diagram of a preferred first authentication module according to an embodiment of the present invention; . BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. 1 is a schematic structural diagram of a mobile communication network system for terminal authentication according to an embodiment of the present invention. As shown in FIG. 1, the network system includes a terminal 10, a base station 20, and an authentication server 30. In the authentication process, the terminal 10 sends the first authentication to the authentication server through the base station 20. The data and the second authentication data, after the authentication server receives the two authentication data, perform two authentications respectively, and if the two authentications are successful, the user is allowed to use the current service, and it should be noted that The above mobile communication network may be any current mobile communication network, such as GSM, CDMA, Wideband Code Division Multiple Access (WCDMA) or Time Division Synchronous Code Division Multiple Access (Time Division- Synchronous Code Division Multiple Access (referred to as TD-SCDMA). According to the embodiment of the present invention, a terminal authentication method is provided. FIG. 2 is a flowchart of a terminal authentication method according to an embodiment of the present invention. The method includes: Step S202: The authentication server performs first authentication on the terminal according to the first authentication data sent by the terminal, where the first authentication data is generated according to user characteristic information of the terminal; Step S204, the authentication server is based on the terminal Sending the second authentication data to perform second authentication, where the second authentication data is based on the authentication key, the terminal parameter, and the network Step S206: In the case that both the first authentication and the second authentication are successful, the authentication server determines that the terminal is successfully authenticated. As described above, the existing terminal authentication mechanism authenticates the terminal. The important parameters are fixed by the operator in the user identification card, or sold in the terminal before the terminal is sold. Once the user accidentally loses the user identification card or terminal, the illegal user can crack the authentication data in the user identification card or the terminal. The user's card or terminal is stolen. The present invention focuses on the security problem that may be caused by the user identification card or the authentication data of the terminal being cracked, and the terminal authentication mechanism is improved. The authentication of the information, that is, the authentication server authenticates the user characteristic information by using the first authentication data, and the authentication server uses the second authentication data to perform key authentication on the terminal by using the existing authentication mechanism. Using the above two authentications, even if an illegal user obtains a cracked user identification card or terminal, the copied user identification card or The spoofed terminal performs normal network aging. In the specific implementation process, there is no sequence of execution between the foregoing step S202 and step S204, as long as the first authentication and the second authentication are implemented, If the authentication succeeds, the authentication of the terminal fails if any of the two authentications fails. The operator can choose to perform the first authentication according to the characteristics or requirements of the service. The first authentication succeeds in triggering the second authentication again; the second authentication may be performed first, and the second authentication succeeds in triggering the first authentication; the first authentication and the second authentication may also be selected concurrently. . Similarly, the terminal does not have a sequence of sending the first authentication data and the second authentication data. According to the service characteristics or the agreement of the operator, the terminal may first send the first authentication data, or may first send the second authentication data. The first authentication data and the second authentication data may also be simultaneously transmitted in the same data packet. In the specific implementation process, when the network is registered, the call, the short message, and the data service, the terminal authentication may be involved. The first authentication may be performed in the following cases: 1. Each time the network is authenticated. Need to perform; Second, according to the setting of the communication network, optimize control, randomly or according to the specified requirements when the need-risk is carried out, which can reduce the number of risks and the system overhead. The foregoing terminal authentication method provided by the embodiment of the present invention adds an existing authentication mechanism, and adds user identification information preset by the user, so that the terminal user also becomes the terminal authentication. A decisive factor that protects the legitimate rights and interests of users and enhances the security of user terminals. Preferably, the user characteristic information includes: personal information preset by the user to which the terminal belongs and identification information of the user. In the specific implementation process, the user can preset personal information according to personal preference, for example, setting the personal information into a document number, name, birthday or other character sequence. The identification information of the user may select the identification information of the identification card on the terminal (for example, the integrated circuit card identification code ICCID, UMID or the user's telephone number), or may select the identification information of the terminal (for example, IMSI or ESN) or, in order to be more secure, The identification information of the user includes the identification information of the identification card and the identification information of the terminal. The identification information of the identification card or the identification information of the terminal can conveniently use the existing resources to set the identification information of the user. The setting of the personal information and the identification information of the user in the user characteristic information is equivalent to setting the binding relationship between the identification information of the user and the personal information, so that the authentication server can obtain the first authentication data after receiving the first authentication data according to the user identification. The information is stored in the database to obtain pre-stored authentication data corresponding to the user identification information, and the validity of the user characteristic information is determined by comparing the two authentication data. FIG. 3 is a first authentication flowchart according to an embodiment of the present invention. Preferably, as shown in FIG. 3, the first authentication of the terminal by the authentication server according to the first authentication data sent by the terminal includes: Step S302 Receiving first authentication data from the terminal; Step S304: Obtain identification information of the user by using the first authentication data. Step S305: Obtain personal information by using the first authentication data, and use the personal information as the first personal information of the user. Step S306, in the authentication server The second personal information corresponding to the identification information is obtained in the database. Step S308: Comparing the first personal information with the second personal information. If the same, the first authentication succeeds, otherwise, the first authentication fails. The first authentication is performed by using the foregoing process, and it is determined whether the first personal information sent by the terminal and the second personal information corresponding to the same user identifier saved by the authentication server are the same, so that the user of the current terminal is legal. If the illegal user has copied the user identification card, but the lack of correct personal information, the first authentication is not passed, thereby ensuring the legitimate rights and interests of the legitimate user. Preferably, the first authentication data may be generated by: encrypting the personal information preset by the user and the identification information of the user by using a predetermined encryption rule to generate the first authentication data. Since the first authentication data may also be obtained by an illegal user during the transmission process, if the first authentication data is transmitted in a clear text manner, there is a great security risk. Therefore, in a specific implementation process, the user may be pre- The set personal information and the user's identification information are encrypted to generate first authentication data. Operators and terminal manufacturers can agree on specific encryption rules, or a more secure method. In a specific business process, the terminal negotiates specific encryption rules with the authentication server. Therefore, by obtaining the first authentication data in the encryption mode, the security of the user using the terminal is further ensured. If the first authentication data is generated by using an encryption method, the process of the first authentication by the authentication server may be different. FIG. 4 is a first authentication data pair that is encrypted according to an embodiment of the present invention. The flowchart of the first authentication is performed by the terminal. Preferably, as shown in FIG. 4, the process includes: Step S402: Receive first authentication data from the terminal; Step S403, parse the first authentication by using a predetermined decryption rule. Step S404: Obtain identification information of the user by using the parsed first authentication data; Step S405: Obtain personal information by using the parsed first authentication data, and use the personal information as the first personal information. Step S406: Obtain a second person corresponding to the identification information of the user in the database of the authentication server. Information: Step S408: Comparing the first personal information with the second personal information. If they are the same, the first authentication succeeds, otherwise, the first authentication fails. In a specific implementation process, the decryption rule corresponds to the above-mentioned encryption rule, and is agreed by the operator and the terminal manufacturer together, or the terminal negotiates with the authentication server. The user characteristics information is transmitted by encrypting and decrypting, thereby further ensuring the security of the user using the terminal. Preferably, before the authentication server performs the first authentication, the authentication server obtains the personal information and the identification information corresponding to the personal information; the authentication server stores the personal information and the identification information corresponding to the personal information in the database. . In order to implement the above first authentication, the authentication server must pre-establish a user characteristic information database before performing terminal authentication, store the personal information of the registered user in the database, and store the user personal information and the user identifier - tied set. In a specific implementation process, the user needs to report the user characteristic information to the operator, and the manner of reporting is various. For example, but not limited to, when the terminal accesses the network, the user characteristic information is submitted. Or log in to the operator's website and enter user feature information. Once the information is entered into the network side system, the user's personal information is associated with the user identification card or terminal used by the user—as long as the user identification information and user information are not tied. The relationship is considered illegal. In a specific implementation process, the user may also update the user characteristic information in a specific manner, for example, by SMS, logging in to the operator's website, or directly changing through the operator's business outlet. The authentication server obtains and maintains the user feature information provided by the user before the terminal authenticates, which is the premise of performing the first authentication. Only the authentication server saves the binding relationship between the correct personal information and the user identification information, and the first authentication. Only then can it be implemented smoothly. Preferably, the identifier information includes at least one of the following: identifier information of the smart card of the terminal, and identifier information of the terminal. The identification information of the user, and the identification information of the identification card on the terminal (for example, ICCID, UMID or the user's phone number;), may also select the terminal's identification information (such as IMSI or ESN) or, for more security, the user's identification information includes both the identity card identification information and the terminal identification information, the identification card The identification information or the identification information of the terminal can conveniently set the identification information of the user by using existing resources. Preferably, the personal information preset by the user may be stored in a memory of the terminal or other storage medium connected to the terminal. Since the user's personal information is not stored on the terminal's identification card (such as a SIM card), the user's personal information will not be leaked even if the identification card is lost. Preferably, the terminal may send the first authentication data to the authentication server by using a short message or communication signaling. In a specific implementation process, the authentication server can receive and perform the first authentication operation and the multiple transmission modes, which makes the terminal authentication more flexible and convenient for the operator to implement. . The above terminal authentication method will be described in detail below in combination with other embodiments. Embodiment 1 In this embodiment, the authentication server is selected to perform the first authentication first, and in the case that the first authentication is successful, the second authentication is triggered. FIG. 5 is a flowchart of terminal authentication according to Embodiment 1 of the present invention. As shown in FIG. 5, the process includes: Step S501: The terminal is powered on. Step S502: The terminal uses a communication network service (network registration, voice, short message, data, etc.). Step S503: According to the returned system message, the terminal determines whether to confirm the first authentication. Step S504: If the network requires the terminal to perform the first authentication, the personal information preset by the terminal includes the information of the terminal, and the information of the card is combined with a specific encryption algorithm to generate the first authentication data, and step S 505 is performed; otherwise, , step S510 is performed. Step S505: The terminal sends the first authentication data to the authentication server. Step S506: The authentication server receives the first authentication data fed back by the terminal, parses the user personal information and the user identification information, and compares the personal information reported by the terminal with the personal information stored in the database to generate a first authentication result. . Step S507: The authentication server sends the first authentication result to the terminal. Step S508: The terminal determines the first authentication result. If it fails, step 4 is performed, S509. Otherwise, step 4 is performed. Step S509: The terminal prompts the user to prohibit using the network service, and ends the operation process. Step S510: The terminal sends the second authentication data, and the authentication server performs the second authentication operation. If the second authentication succeeds, the user normally uses the network service. Otherwise, the user is prompted to prohibit the use of the network service. Embodiment 2 In this embodiment, the selection authentication server first performs the second authentication, and in the case that the second authentication succeeds, the first authentication is triggered. FIG. 6 is a flowchart of terminal authentication according to Embodiment 2 of the present invention. As shown in FIG. 6, the process includes: Step S601: The terminal is powered on. Step S602: The terminal uses a communication network service (network registration, voice, short message, data, etc.). Step S603: The terminal sends the second authentication data, and the authentication server performs the second authentication operation. If the second authentication succeeds, step S604 is performed. Otherwise, the user is prompted to prohibit the use of the network service. Step S604: According to the returned system message, the terminal determines whether to confirm whether the first authentication is to be performed. Step S605: If the network requires the terminal to perform the first authentication, the personal information preset by the terminal includes the information of the terminal, and the information of the card is combined with a specific encryption algorithm to generate the first authentication data; Right, the terminal authentication succeeds, and the user normally uses the network service. Step S606: The terminal sends the first authentication data to the authentication server. Step S607: The authentication server receives the first authentication data fed back by the terminal, parses the user personal information and the user identification information, and compares the personal information reported by the terminal with the personal information stored in the database to generate a first authentication result. . Step S608: The authentication server sends the first authentication result to the terminal. Step 4: S609, the terminal determines the first authentication result. If the terminal fails, the terminal prompts the user to prohibit the use of the network monthly service, and ends the operation process. Otherwise, the terminal authentication passes, and the user normally uses the network monthly subscription. Business. According to an embodiment of the present invention, a terminal authentication system is further provided. FIG. 7 is a schematic structural diagram of a terminal authentication system according to an embodiment of the present invention. As shown in FIG. 7, the system includes: a terminal 71, an authentication server 72. . The terminal 71 includes: a first authentication data module 711 and a second authentication data module 712. The first authentication data module 711 is configured to generate first authentication data, and send the first authentication data to the authentication server 72, where the first authentication data is generated according to user characteristic information of the terminal. The second authentication data module 711 is configured to generate the second authentication data, and send the second authentication data to the authentication server 72, where the second authentication data is generated according to the authentication key, the terminal parameter, and the network parameter. The authentication server 72 includes: a first authentication module 721, a second authentication module 722, and an authentication success judging module 723. The first authentication module 721 is configured to perform first authentication on the terminal according to the first authentication data, and output a first authentication result. The second authentication module 722 is configured to perform second authentication according to the second authentication data. And the second authentication result is output; the authentication success judging module 723 is respectively connected to the first authentication module 721 and the second authentication module 722, and is configured to determine the input first authentication result and the second authentication result. If the first authentication result and the second authentication result are both successful, the authentication of the terminal 71 is determined to be successful. FIG. 8 is a schematic structural diagram of a first authentication data module according to an embodiment of the present invention. Preferably, as shown in FIG. 8, the first authentication data module 711 includes: a storage submodule 801, a generation submodule 802, and a transmission submodule. 803. The storage submodule 801 is configured to store personal information preset by a user to which the terminal belongs and identification information of the user. The generating submodule 802 is connected to the storage submodule 801, and is configured to acquire personal information and generate identification information of the user. The first authentication data is sent to the authentication server 72. The sending submodule 803 is connected to the generating submodule 802, and configured to send the first authentication data to the authentication server 72. FIG. 9A is a schematic structural diagram of a first authentication module according to an embodiment of the present invention. Preferably, as shown in FIG. 9A, the first authentication module 721 includes: a data storage submodule 901, a receiving submodule 902, and a first obtaining subroutine. The module 903, the second acquisition submodule 904, and the comparison submodule 905. The data storage module 901 is configured to store the personal information provided by the user; the receiving submodule 902 is configured to receive the first authentication data from the terminal; the first obtaining submodule 903 is connected to the receiving submodule 902, and is configured to use the first The authentication data is obtained by acquiring the identification information of the user of the first authentication data, and outputting to the second obtaining submodule 904, and acquiring the personal information of the first authentication data by using the first authentication data, and using the personal information as the user The first personal information is output to the comparison sub-module 905; the second acquisition sub-module 904 is respectively associated with the data storage module 901, the first acquisition sub-module 903, and the comparison sub-module 905. The connection is used to obtain personal information corresponding to the input identification information of the user in the data storage module 901 as the second personal information, and output to the comparison sub-module 905; the comparison sub-module 905 is respectively associated with the first acquisition sub-module 903 and The second obtaining submodule 904 is connected to compare the input first personal information and the second personal information, and generate a first authentication result. Preferably, as shown in FIG. 9A, if the first authentication data is generated by using a predetermined encryption rule, the first authentication module 721 further includes: a parsing submodule 906, and a receiving submodule 902 and a first obtaining submodule. The 903 connection is configured to parse the first authentication data received by the receiving submodule 902, and output the parsed first authentication data to the first obtaining submodule 903. Preferably, the foregoing identification information includes at least one of the following: identification information of the smart card of the terminal, and identification information of the terminal. The identification information of the user may select identification information of the identification card on the terminal (for example, ICCID, UMID or user's telephone number;), or may select identification information of the terminal (for example, IMSI or ESN) or, for more security, the identification information of the user. The identification information of the identification card and the identification information of the terminal, the identification information of the identification card or the identification information of the terminal can conveniently use the existing resources to set the identification information of the user. In summary, the technical solution provided by the present invention uses a dual authentication mechanism, and on the basis of inheriting the existing authentication method, the authentication operation of the user characteristic information set by the user is added, which not only enhances The security of the user's use of the network also enhances the protection of the user's personal privacy and protects the legitimate rights and interests of the operator. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modification, equivalent substitution, improvement, etc. made within the "God and Principles" of the present invention shall be included in the protection of the present invention. Within the scope.

Claims

Claim

A terminal authentication method, comprising:

The authentication server performs the first authentication on the terminal according to the first authentication data sent by the terminal, where the first authentication data is generated by the user feature information of the terminal; and the authentication server is configured according to the terminal. The second authentication data is sent to perform second authentication, where the second authentication data is generated according to the authentication key, the terminal parameter, and the network parameter; and the first authentication and the second authentication are both In case of success, the authentication server determines that the terminal authentication is successful.

The method according to claim 1, wherein the user characteristic information comprises: personal information preset by a user to which the terminal belongs, and identification information of the user.

The method according to claim 2, wherein the performing, by the authentication server, the first authentication to the terminal according to the first authentication data sent by the terminal comprises:

Receiving the first authentication data from the terminal;

Acquiring the identification information by using the first authentication data;

Using the first authentication data, acquiring the personal information, and using the personal information as the first personal information of the user;

Obtaining second personal information corresponding to the identification information in a database of the authentication server;

Comparing the first personal information with the second personal information, if the same, the first authentication succeeds, otherwise, the first authentication fails.

4. The method of claim 2, wherein the first authentication data is generated by: encrypting the personal information and the identification information by using a predetermined encryption rule to generate the first An authentication data.

The method according to claim 4, wherein the performing, by the authentication server, the first authentication to the terminal according to the first authentication data sent by the terminal comprises:

Receiving the first authentication data from the terminal;

Parsing the first authentication data according to a predetermined decryption rule; Acquiring the identification information by using the parsed first authentication data;

Acquiring the personal information by using the parsed first authentication data, and using the personal information as the first personal information of the user;

The method according to claim 3 or 5, wherein before the authenticating server performs the first authentication, the method further includes:

The authentication server obtains the personal information and the identification information corresponding to the personal information;

The authentication server stores the personal information and the identification information corresponding to the personal information in the database.

The method according to any one of claims 2 to 5, wherein the identification information comprises at least one of the following: identification information of the identification card of the terminal, and identification information of the terminal.

The method according to any one of claims 2 to 5, wherein the personal information is stored in a memory of the terminal or other storage medium connected to the terminal.

The method according to any one of claims 1 to 5, characterized in that the terminal transmits the first authentication data to the authentication server by short message or communication signaling.

A terminal authentication system, comprising a terminal and an authentication server, comprising: the terminal comprising: a first authentication data module, configured to generate first authentication data, and to the authentication server Sending the first authentication data, where the first authentication data is generated according to user characteristic information of the terminal;

a second authentication data module, configured to generate second authentication data, and send the second authentication data to the authentication server, where the second authentication data is based on an authentication key, a terminal parameter, and Network parameter generation; The authentication server includes

a first authentication module, configured to perform first authentication on the terminal according to the first authentication data, and output a first authentication result;

a second authentication module, configured to perform second authentication on the terminal according to the second authentication data, and output a second authentication result;

The authentication success judging module is respectively connected to the first authentication module and the second authentication module, and is configured to determine the input of the first authentication result and the second authentication result, where If both the authentication result and the second authentication result are successful, the authentication of the terminal is determined to be successful.

The system according to claim 10, wherein the first authentication data module comprises: a storage submodule, configured to store personal information preset by a user to which the terminal belongs, and identification information of the user;

Generating a submodule, connected to the storage submodule, for acquiring the personal information and the identifier information to generate first authentication data;

And a sending submodule, connected to the generating submodule, configured to send the first authentication data to the authentication server.

The system according to claim 10, wherein the first authentication module comprises: a data storage sub-module, configured to store personal information provided by a user;

a receiving submodule, configured to receive the first authentication data from the terminal, where the first obtaining submodule is connected to the receiving submodule, configured to acquire the identifier information by using the first authentication data And acquiring the personal information using the first authentication data, and using the personal information as the first personal information of the user;

The second obtaining sub-module is connected to the data storage sub-module and the first acquiring sub-module, respectively, for acquiring personal information corresponding to the identification information in the data storage sub-module as the second personal information;

Comparing the submodule, the first obtaining submodule and the second obtaining submodule, respectively, for comparing the first personal information and the second personal information, and generating the first authentication result .

The system according to claim 12, wherein, if the first authentication data is encrypted and generated by using a predetermined encryption rule, the first authentication module further includes: a parsing submodule, and the The receiving submodule is connected to the first obtaining submodule, configured to parse the first authentication data received by the receiving submodule, and output the parsed first authentication data to the first acquiring submodule . The system according to any one of claims 10 to 13, wherein the identification information comprises at least one of the following: identification information of the smart card of the terminal, and identification information of the terminal.