WO2012130035A1

WO2012130035A1 - User authentication and authorization method and implementation system thereof

Info

Publication number: WO2012130035A1
Application number: PCT/CN2012/072224
Authority: WO
Inventors: 王冬梅
Original assignee: Wang Dongmei
Priority date: 2011-04-01
Filing date: 2012-03-13
Publication date: 2012-10-04
Also published as: CN102111275A; CN102111275B

Abstract

Provided are a user authentication and authorization method and an implementation system thereof. When the user end initiates a service access request, a service server checks whether or not the user is a subscriber according to the identity information about the user, if he is, the communication mode of at least one social relation user from the subscription information about the user is selected as an authentication end; the service server judges whether or not the user identity is legal according to the information provided by the authentication end; if it is legal, the service server authorizes the user end and performs a corresponding service access response. According to the method and the implementation system thereof in the present invention, by way of selecting the communication mode of at least one social relation user from the subscription information left by the user when subscribing to a service as the authentication end, and having the service server judge whether or not the user end identity is legal according to the information provided by the authentication end and authorize the same end, the stated defects in the background art are overcome, and the security of user information and network service is guaranteed effectively.

Description

Method for user authentication and authorization and implementation system thereof

技术领域 Technical field

The present invention relates to the field of communications technologies, and in particular, to a method for user authentication and authorization and an implementation system thereof.

背景技术 Background technique

The popularity of network technology brings great convenience to users. At the same time, it also has the problem of how to authenticate the identity of users in the network and how to ensure that users' services and information are not illegally stolen and used.

Figure 1 and Figure 2 As shown, the general service provider has its own authentication and authorization center responsible for managing the subscription user information in its network. After the user signs the contract, the authentication and authorization center saves the user's subscription information. When the user initiates a service access request, the service server passes the authentication and authorization center, performs user authentication, and authorizes the user according to the subscription information. For example, when providing the online business hall service, the telecom operator generally uses the mobile phone number + mobile phone random password, or the mobile phone number + service password, or the mobile phone number + mobile phone random password + service password to authenticate the user as a legitimate user. The common method is: login mode of mobile phone number + mobile phone random password.

Step 1: After the user enters the URL link URL of the service provider at the client terminal 10, the user server 20 Get the login interface and ask for the user's mobile phone number and random SMS password. At the same time, there is a random SMS acquisition button on the interface.

Step 2: The user enters his mobile phone number on the login interface of the user terminal 10, and clicks the random message acquisition button.

Step 3, then, the client 10 sends a random password request message to the service server of the service provider in the network. The message contains the user's own mobile number.

Step 4, the service provider's business server 20 A random password is randomly generated for the user's mobile phone number and saved, and then the random password is sent to the user's mobile phone through a short message.

Step 5 The user reads his own mobile phone short message, enters the obtained random password into the login interface, and then clicks the login button to send a login request to the business server. The login request contains the phone number and its random password.

Step 6: The service server 20 passes its contract database and certification authority 30 Checking the received random password and the saved random password. If they are the same, the user identity is considered legal. Otherwise, the user identity is considered illegal. If the user identity is considered legal, the service server 20 Send a service access response to the user's client 10 .

The above network user authentication method can use the service provided by the network service provider as long as the user's mobile phone is available. If the user's mobile phone is lost, stolen or not carried, the person using the mobile phone may not be the user himself. The problem is that the user's services and information cannot be effectively protected.

发明内容 Summary of the invention

To this end, the technical problem to be solved by the present invention is to provide a The method for user authentication and authorization and the implementation system thereof overcome the defects described in the background art, and can effectively protect the security of user information and network services.

Accordingly, the present invention provides a method of user authentication and authorization, the method comprising:

The client initiates a service access request including user identity information, for example, the request includes a username, an account name, and a user ID. Information

The service server determines whether it is a subscription user according to the identity information of the user, and if so, selects a communication mode of at least one social relationship user from the user subscription information, such as a mobile phone number of the social relationship user, an email address, a landline phone, and an instant message. The communication mode is used as the authentication end;

The service server determines the legality of the user identity according to the information provided by the authentication end;

If the user identity is legal, the service server authorizes the user and performs a corresponding service access response.

The service server determines the legality of the identity of the user end according to the information provided by the authentication end, including:

The service server sends a user identity authentication and authorization query to the authentication end;

The authentication end responds to the service server with the result of the inquiry;

The service server processes the query result replied by the authentication end, and determines whether the identity of the client is legal.

Or, wherein the service server determines the legality of the identity of the user end according to the information provided by the authentication end, including:

Business server received The service access request is judged. If the request includes the password or the feature string of the user end, the service server waits for the authentication end to send the authentication message.

The authentication end submits the authentication port command word or feature string negotiated with the client to the service server.

The service server judges the password or the feature string of the user end sent by the user end and the authentication port command word or the feature string submitted by the authentication end. If the match is matched, the user end is considered to be legal, otherwise it is illegal.

The service server selects the feature string or generates a random password, sends it to the client, and sends the user identity authentication and authorization query to the authentication end. ;

The UE sends the received feature string or the randomly generated password to the authentication end.

The service server judges the query result of the reply by the authentication end, and if the query result includes the service server sends the result to the client. If the feature string or the password is randomly generated, the identity of the client is considered legal, otherwise it is illegal.

The service server selects a feature string or generates a random password and sends it to the client of the authentication client;

The authentication end sends the feature string or the randomly generated password to the user end;

The user end sends the feature string or the randomly generated password to the service server. If the feature string or the randomly generated password sent by the service server received by the service server matches the information sent by the service server to the authentication end, the user is considered as the user. The identity is legal, otherwise it is not legal.

The present invention also provides a system for implementing user authentication and authorization, the system comprising: The client, the service server, and the client left when signing up for the service The communication mode of the at least one social relationship user, such as the mobile phone number of the social relationship user, the e-mail address, the fixed telephone, the instant message, etc., when the user initiates the service access request, the service server judges according to the information of the user. Whether the user is a contracted user, and if so, the communication mode of the at least one social relationship user is selected from the user subscription information as the authentication end, and the legality of the user identity is determined according to the information provided by the authentication end. The client performs authorization and performs corresponding service access response.

The authentication end responds to the service server with the result of the inquiry, for example, using the IVR. The mode is prompted by the service server to prompt the user of the authentication terminal to perform key operation and confirmation (for example, pressing '1' means confirming authorization, and pressing '2' means rejecting authorization);

The server judges the query result of the reply by the authentication end, and if the query result includes the service server sends the result to the client If the feature string or the password is randomly generated, the identity of the client is considered legal, otherwise it is illegal.

One type of the invention The user authentication and authorization method and the implementation system thereof, the communication address of the at least one social relationship user is selected as the authentication end by the user information left by the user when signing the service service, and the service server judges the user end according to the information provided by the authentication end. The way of identity legitimacy overcomes the shortcomings described in the background art and effectively protects the security of user information and network services.

附图说明 DRAWINGS

FIG. 1 is a schematic flowchart of a user authentication and authorization method in the prior art;

2 is a schematic structural diagram of a user authentication and authorization system in the prior art;

3 is a schematic flowchart of a method for user authentication and authorization according to the present invention;

4 is a schematic diagram of a system structure for implementing user authentication and authorization according to the present invention;

FIG. 5 is a schematic structural diagram of a process according to an embodiment of the present invention; FIG.

6 is a schematic structural diagram of a process according to Embodiment 2 of the present invention;

7 is a schematic structural diagram of a third embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a fourth embodiment of the present invention.

具体实施方式 detailed description

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

As shown in FIG. 3 and FIG. 4, this embodiment provides a method for user authentication and authorization, and an implementation system thereof. The system includes: a client terminal 40. , business server 50 and The communication address of at least one social relationship user selected in the social relationship information such as friends and relatives left by the user when signing the business service, such as the mobile phone number, email address, fixed telephone, instant message, etc. of the social relationship user as the authentication end 60. Among them, the authentication end 60 It may be a communication method of a social relationship user left by the user when signing the service service, or may be multiple communication methods of multiple social relationship users left by the user when signing the service service, for example, the mobile phone number and the mailbox at the same time. Address, for example 4 is expressed as the first authentication end of social relations, ... the social relationship nth authentication end.

The number and scope of social relationships involved in certification reflect the strength of certification. Non-strength certification can be used to respond to different levels of user authorization.

Step 1: The user sends a service access request to the service server 50 at the user terminal 40, indicating that the user wants to use the service server. The service and application provided, the request information includes the user identity information;

Step 2: The service server 50 checks whether the user is a contracted user according to the identity information of the user;

Step 3: If the user is a subscription user, select a communication mode of at least one social relationship user from the subscription user information as the authentication end. Authenticate;

Step 4: The service server 50 determines the legality of the identity of the client 40 according to the information provided by each authentication terminal 60.

Step 5: If the identity of the client is legal, the service service 50 is to the client 40 Authorize and perform the corresponding service access response, that is, if the user identity is legal, the client 40 is allowed to access the service server, and the services and applications provided by the server are used. Otherwise, the client is not allowed. Access the service server.

Optionally, each authentication terminal 50 may also provide authorization information to the service server 60; the service server 50 integrates the authentication terminals. After the authentication authentication and authorization information is provided, the authorization level to the client 40 is determined.

Wherein, in the case of a user signing license, the service server 50 It is also possible to update social relationship information such as friends and relatives of the user according to third party business application information, such as a network address book.

Of course, the business server 50 Different authentication terminals can be given different weight information weights. For example, some authentication terminals can reject one vote, one ticket, and the like.

The client can also specify which social relationships are used for this authentication in the service access request.

The user identity information of the service access request may be information such as a username, an account name, and a user ID.

Further, the business server 50 After the final certification conclusion is obtained, a notification may be sent to the authentication end to notify the end result of the authentication end authentication authorization.

In the above step 4, the service server 50 is based on the authentication end. The information provided to determine the validity of the identity of the client can be described in the following four embodiments.

Embodiment 1

As shown in FIG. 5, after the user initiates a service access request to the server, the service server sends at least one social relationship to the selected user. The authentication end of the mobile phone user is directly A user identity authentication and authorization query is sent, and the authentication terminal directly returns the result of the inquiry to the service server. After the service server processes the query results, the user authentication conclusion is obtained. For example, if more than half of the authentication end reply results are authenticated, the service server authenticates the user authentication and authorization, otherwise the authentication authorization fails. In addition, the service server may consider that the feedback result of the authentication end is that the authentication authorization is passed. For this reason, the service server only sends a notification to the authentication end, and the user is notified that the service request is to be initiated. After the service server obtains the authentication and authorization conclusions, it makes a service access response to the client.

For example, when a bank card account needs to reset the bank card account password for the user reason, the existing bank card user generally operates on the teller machine by using a password, or uses a Token card + username / The password method performs user authentication on the network. However, when the user forgets his or her own password, the user must go to the bank counter in person, check the original ID card, and submit the ID card and other information to modify the password, and the bank needs to verify the identity of the user after one week. You can confirm whether the password change is successful.

If the method and system are used in this embodiment, when the user opens an account, fill in a list of his key social relationships, such as the contact number of the relatives and friends. When the user forgets his bank account password, the user only needs to call or email. , online, SMS, etc. to apply to the bank, the banking server to at least one social relationship of the selected user The authentication end of the mobile phone user is directly Sending user identity authentication and authorization Ask the bank to automatically notify the user's relatives and friends, verify and confirm the legality of the identity of the user who submitted the operation request. After confirmation, the bank allows the user to reset their password, thus eliminating the need for the user to personally go to the business hall. The process of being able to handle the business and submitting personal data and waiting for a week to be confirmed makes the resetting of the bank password service fast and secure.

For example, if a user opens an account with a bank, obtains a bank account number, and leaves his or her own contact number, but also leaves the contact mobile number or EMAIL of at least one of his or her friends and relatives. Address. When the user forgets the password of his account and needs to reset the password, the user sends a mobile phone message to the bank's business server, including: user name, user's bank account number, operation instructions (request for resetting the password), new password, and notes. Description (eg: I am Wang Er, the password is forgotten, need to be reset). After the bank's business server receives the application to reset the password, the user's application 2 friends and relatives send SMS and / or EMAIL Check with your friends and relatives whether it is the application for resetting the password proposed by Wang Er. The text message includes: user name, bank account number, application operation and remarks. Such as: user 'Wang Er' applied to reset bank account 'XXXX 'The password, please check. Please reply 1 Confirmed as a legitimate user, reply 2 Confirmed as an illegal operation. Remarks: 'I am Wang Er, the password is forgotten and needs to be reset. 'The two friends and relatives of the user verified the business operation request of Wang Er separately, by SMS and / or EMAIL Respond to the bank's inquiry to confirm whether the user who initiated the business request is the user. The bank's business server confirms whether the user is a legitimate user based on the responses of two friends and relatives. If it is a legitimate user, the reset password operation is performed; otherwise, the user's business operation request is rejected.

Embodiment 2

As shown in Figure 6, after the user initiates a service access request to the server, The service server checks whether the user is a subscription user according to the identity information of the user, and if so, selects a communication mode of the at least one social relationship user from the subscription user information as the authentication end, and then the service server receives the received information. The service access request is judged. If the request includes the user's own password or feature string, the service server waits for the authentication end to send an authentication message; the authentication end will negotiate the authentication port command word with the user end in advance or The feature string is submitted to the service server; the service server judges the password or the feature string of the client itself sent by the client and the authentication port command word or the feature string submitted by the authentication end. If the match is made, the client is considered to be the client. The identity is legal, otherwise it is not legal.

The password or feature string submitted by the authentication end and the user may be the same or different. The time when the authentication end submits the password or the feature string may be earlier than the time when the user sends the service access request, so that the server can quickly authenticate the user.

Embodiment 3

As shown in Figure 7, after the user initiates a service access request to the server, The service server checks whether the user is a subscription user according to the identity information of the user. If yes, the communication mode of the at least one social relationship user is selected from the subscription user information as the authentication end, and then the service server selects the feature string or generates a random password. Sent to the client and send to the authentication end User identity authentication and authorization query; the client sends the received feature string or randomly generated password to the authentication end; The server judges the query result of the reply by the authentication end. If the query result includes the feature string sent by the service server to the client or randomly generates the password, the user identity is considered to be legal, otherwise it is illegal.

When the number of the authentication ends is multiple, the feature strings or random passwords used for different authentication ends may be the same or different.

Embodiment 4

As shown in Figure 8, after the user initiates a service access request to the server, The service server checks whether the user is a subscription user according to the identity information of the user. If yes, the communication mode of the at least one social relationship user is selected from the subscription user information as the authentication end, and then the service server selects the feature string or generates a random password. Sending to the authentication end; the authentication end sends the feature string or the randomly generated password to the user end; the user end sends the feature string or the randomly generated password to the service server, if the user end received by the service server sends the password If the feature string or the randomly generated password matches the information sent by the service server to the authentication end, the user identity is considered to be legal, otherwise it is illegal.

In the above embodiments, the message sent by the service server to the authentication end may also carry supplementary information, such as the time and location of the service access request. IP Address, terminal type, description text, etc., to facilitate each authentication terminal to verify the identity of the user. The supplementary information may be directly obtained from the service access request message sent by the client to the service server, or may be obtained by the service server sorting the service access request message and the network information. When there is one at the authentication end, the supplementary information sent to different people may be the same or different.

The authentication method based on the authentication end can also be combined with passwords, multi-factor authentication, and the like. For example, when the user submits a username / After the password information is passed and the authentication is passed, the service server can further select the communication mode of the other social relationship users of the user as the authentication end for authentication.

After the service server end draws the final certification authorization conclusion, it can also send a notification to the authentication end to inform the final result of the authentication authorization.

For example, when a telecom operator provides an online operation hall service and signs a contract with a user, the user not only has to leave his or her mobile phone number and/or Or the e-mail, but also to leave the mobile phone number, e-mail, instant message, and fixed telephone of at least one relative friend. This embodiment is described by taking the mobile phone number as an example. When the user logs in to the online business hall, the user needs to input his mobile phone number and random password, and also needs to input the mobile phone number of his relatives and friends to obtain the random SMS password and the relative friend authentication password. Specifically, when the user signs a contract with the service provider, the mobile phone number of at least one relative friend is registered in the contract. After the client enters the service provider's web address, the user obtains the login interface from the server, and requests the user's mobile phone number, random SMS password, and relative friend authentication password. At the same time, there is a random SMS acquisition button on the interface. The user enters his mobile phone number on the client login interface and clicks the random SMS acquisition button. Then, the client sends a random password request message to the server of the service provider in the network, and the message contains the user's own mobile phone number. The service provider's service server randomly generates a random password for the user's mobile phone number and saves it, and then sends the random password to the user's mobile phone through a short message. At the same time, the service server retrieves the mobile phone number of the relatives and friends registered by the user, and randomly generates a random password for the mobile phone number of the relative friend and saves the password, and then sends the random password as a friend and friend authentication password to the mobile phone of the relative friend through the short message. The user reads the mobile phone short message to obtain a random password, communicates with the relatives and friends to obtain the relative friend authentication password, and inputs the obtained random password and the relative friend authentication password into the login interface, and then clicks the login button to send the login request to the service server. The login request contains the phone number, random password, and friend and friend authentication password. The service server checks the received login request with the random password and the friend authentication password stored in the service server. If the user is a legitimate user, the login is successful; otherwise, the user authentication fails, and the user's login request is rejected.

The above embodiments can also be applied to key information for protecting e-commerce accounts. For example, e-commerce operations generally use a mobile phone short message password to verify the legitimacy of the user. When a user applies to access his or her own e-commerce account or conduct a transaction, the e-commerce service provider will send a random message to the user's mobile phone through a text message, and then the user submits through the network to confirm that the user is a legitimate user. When the phone is unavailable, the account cannot be accessed and traded. When the user’s mobile phone is stolen, or SIM When the card is cloned, the user's account information can be changed all including the contact mobile number used for authentication. In this way, even if the user retrieves his mobile phone, the user will completely lose his online account. In addition, when the user's ID card is lost, stolen or fraudulent, the illegal user can also apply for a new one in the telecom business hall. SIM The card thus leads to the leakage of critical information. When the method and system provided by the embodiment are used, it is only necessary to fill in a list of key social relationships such as contact numbers of friends and relatives in the account information table of the e-commerce when the user opens the account. When the user makes daily transactions, the user's legality is verified by providing a random password through the existing mobile phone short message. When the user needs to query and modify key sensitive information such as account information, transaction limit control, mobile phone number for user transaction confirmation, the e-commerce service provider automatically informs the user's relatives and friends through SMS, MMS, etc., and the relatives and friends verify and confirm the proposed The user who operates the application is a legitimate user. After confirmation, the e-commerce service provider allows the user to query and modify the key sensitive information of the account. The specific implementation process is as follows: When the user opens the e-commerce service, in addition to his mobile phone number, the user registers the information of two relatives and friends and leaves their mobile phone number. When the user operates on his own client, log in to the account and obtain daily transaction rights by means of a random password. This permission cannot query and modify the user's account profile information. After the user clicks the button of 'acquire relatives and friends authentication passwords' on the client, the client sends a request message for obtaining the relative friend authentication password to the service server of the e-commerce service provider. The service server queries the user's account information, obtains the user's relatives and friends information, generates a random password for the user account data query and a random password modified by the account data for each relative and friend, and sends the message to the mobile phone of the user's relatives and friends through the short message. The user obtains a random password that can query the user account information or a random password that can modify the account information from the two relatives and friends as the friend and friend authentication password, input to the login interface of the client, and click the login button, and the client then sends the account login request to the server. The request message contains the password for the relatives and friends. The service server confirms that the received friend and friend authentication password is correct, thereby upgrading the access authority of the user, allowing the user to query the account profile information, or allowing the user to query the account profile information and modify it.

The above embodiment can also be applied in the process of authenticating a mobile phone card. For example, when a user's mobile phone is stolen or lost, the user generally needs to carry his/her ID card and personally add a SIM to the telecom operator's business hall. Card. The telecom operator must devote sufficient resources to review the identity of the user and serve the user's replenishment application. The user has spent a lot of time and effort because he has to go to the telecom business hall in person. At the same time, because users need to carry their own identity documents and copy copies at the telecom operators, the risk of personal identity data leakage is objectively increased. When the method and system provided by the embodiment are used, it is only necessary to fill in a list of key social relationships such as contact numbers of friends and relatives in the account opening application of the telecommunication service when the user opens an account. At the same time, telecom operators can issue temporary payments like prepaid recharge cards. SIM card to the retail store. The temporary SIM card is only allowed to dial the special service number of the telecommunications carrier. After the user’s mobile phone is stolen or lost, he only needs to purchase a temporary SIM card at any retail store. SIM calls the special service number, requests the temporary SIM card as the replacement card of the original phone number, and leaves a message 'I am XXX If the mobile phone is lost, you need to reissue the card. 'The telecom operator notifies the user's relatives and friends through SMS, MMS, voicemail, etc., and verifies that the user confirms the legitimate user number of the original phone number, and confirms that the user has successfully completed the card. The temporary SIM The card thus becomes the replacement card for the original telephone number.

The above embodiments can also be applied in the process of key information access control. For example, a company's key information assets are generally strictly protected to limit access by unrelated people. The usual practice is for a company to establish a dedicated approval electronic stream and user group, to approve who has access to key information assets through electronic flow auditing, and to add people who have access and no access to different user groups. Only employees belonging to a specific user group can pass the enterprise IT The system accesses these key information assets. The workload of managing these key information assets is very high because of the loss or replenishment of corporate personnel, the changing role of the participants, the mistakes of the staff responsible for deleting the members of the user group, and the fact that the enterprise does not allow access anytime, anywhere. Large, the approval pace is slow, the time is long, and there may be information leakage due to the inability to timely match the role adjustment of the company's employees. When the method and system provided by the embodiment are adopted, the enterprise employee can pass the enterprise at any time. IT The network applies to read key information assets without the electronic flow approval process. The management personnel are used as the authentication end, and the request for accessing the key information assets is sent to the management personnel of the information assets through SMS, mail, instant message, etc., because the management personnel knows whether the user is a legitimate user, and therefore, the authentication end of the management personnel is confirmed. If the authentication of the user is passed, the key information asset will allow the employee's reading request. It can be seen that the solution does not require electronic flow approval, and does not need to manage various user groups, so that the management of key information assets of the enterprise can timely match the changes of the enterprise.

In addition, the UE can also specify the scope of the authentication client in the service access request. For example, in the service access request initiated by the user to the service server, the user specifies the authenticator as 'father' and 'wife'. When the service server selects the authentication client for authentication, only the 'father' and 'wife' are selected, and both of them are required to be authenticated at the same time, indicating that the user authentication is passed.

In the case of a user signing license, The service server can update the social relationship information of the user's relatives and friends according to the third party's business application information such as a network address book.

In summary, the embodiment of the present invention The method for user authentication and authorization and the implementation system thereof, select at least one social relationship mobile phone user and/or user information left by the user when signing the business service Or the e-mail user is used as the authentication end, and the service server judges the legality of the identity of the user end according to the information provided by the authentication end, overcomes the defects described in the background art, and effectively protects the security of the user information and the network service.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are included in the spirit and scope of the present invention, should be included in the present invention. Within the scope of protection.

Claims

A method for user authentication and authorization, characterized in that it comprises:

The client initiates a service access request including user identity information;

The service server checks whether the user is a subscription user according to the user identity information, and if so, selects a communication mode of the at least one social relationship user from the user subscription information as the authentication end;

2. The method of claim 1 wherein said said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

3. The method of claim 1 wherein said said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

4. The method of claim 1 wherein said said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

5. The method of claim 1 wherein said said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

The service server selects a feature string or generates a random password and sends it to the authentication end.

A system for implementing user authentication and authorization, comprising: a user terminal, a service server, and a service left when the user service is contracted by the user end. The communication mode of the at least one social relationship user is the authentication end. When the user initiates the service access request, the service server determines whether the user is a subscription user according to the user identity information in the service access request, and if yes, the subscription is signed. The communication mode of the at least one social relationship user is selected as the authentication end, and the validity of the user identity is determined according to the information provided by the authentication end, and then the corresponding service access response is performed on the user end.

7. The system of claim 6 wherein said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

8. The system of claim 6 wherein said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

9. The system of claim 6 wherein said said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including:

10. The system of claim 6 wherein said The service server determines the legality of the identity of the client according to the information provided by the authentication terminal, including: