WO2017177435A1

WO2017177435A1 - Identity authentication method, terminal and server

Info

Publication number: WO2017177435A1
Application number: PCT/CN2016/079397
Authority: WO
Inventors: 张站朝
Original assignee: 深圳前海达闼云端智能科技有限公司
Priority date: 2016-04-15
Filing date: 2016-04-15
Publication date: 2017-10-19
Also published as: CN107113315B; CN107113315A

Abstract

Provided are an identity authentication method, a terminal and a server. The method comprises: a terminal sending an identity authentication request to a server; the server sending a random code to the terminal; the terminal comparing biological feature information input by a user with pre-stored biological feature information corresponding to a user identifier, and if a comparison result is that the two are consistent, using a pre-stored user private key corresponding to the user identifier to encrypt a second random code and sending same to the server; and the server using a pre-stored user public key corresponding to the user identifier to decrypt the second random code after being encrypted by means of the user private key, verifying whether the decrypted second random code is consistent with the sent second random code, and if so, passing identity authentication. The present invention does not require a terminal to upload biological feature information about a user, and the verification of the biological feature information about the user is completed by the terminal itself, thereby ensuring that the biological feature information about the user is not revealed.

Description

Identity authentication method, terminal and server

Technical field

The present invention relates to the field of identity recognition technologies, and in particular, to an identity authentication method, a terminal, and a server.

Background technique

The cloud robot is an intelligent robot that puts the cognitive system in the cloud, the body, the drive and the sensor are placed on the robot body, and connects the two through mobile communication; the cloud robot is the development direction of the intelligent humanoid robot.

Identity authentication, also known as authentication or identity authentication, refers to the process of confirming the identity of an operator in a computer and computer network system to determine whether the user has access to and use of certain resources to ensure system and data security. .

At present, the more common authentication methods mainly include password-based authentication methods and biometric-based authentication methods. Among them, the biometric-based authentication method is based on the unique, reliable and stable biological characteristics (such as iris, fingerprint, face, palm print, etc.), and has good security.

However, the existing biometric-based authentication method is usually that the terminal is connected to the server. After collecting the biometric information of the user, the terminal uploads the biometric information to the server, and compares and matches the biometric information prestored by the server. If the matching is successful, the matching is successful. Certification passed.

The disadvantages of the prior art are:

The existing biometric-based authentication method needs to upload the biometric information of the user to the server during implementation, and the biometric information of the user is easily leaked.

Summary of the invention

The embodiment of the invention provides an identity authentication method, a terminal and a server, to solve the existing In the technology, the biometric-based authentication method needs to upload the biometric information of the user to the server during implementation, and the biometric information of the user is easily leaked, resulting in technical problems of unsafe user information.

In a first aspect, an embodiment of the present invention provides an identity authentication method, including the following steps:

Sending an identity authentication request to the server; the identity authentication request includes a user identifier;

Receiving a second random code sent by the server;

Comparing the received biometric information input by the user with the pre-stored biometric information corresponding to the user identifier;

If they are consistent, encrypting the second random code by using a pre-stored user private key corresponding to the user identifier;

Sending a second random code encrypted by the user private key to the server.

Optionally, before the sending the identity authentication request to the server, the method further includes:

Receiving a first random code sent by the server;

Sending the terminal identifier, the user identifier, and the first random code to the server;

Receiving biometric information entered by the user after receiving the verification pass message sent by the server;

Generating a public-private key pair for the user, establishing a correspondence between the biometric information, the terminal identifier, the user private key, and the user identifier, and sending the user public key and the user identifier to the server.

Optionally, the second random code that is encrypted by the user private key is sent to the server, where the second random code encrypted by the user private key, the user identifier, and the terminal identifier are sent to the server. The server.

Optionally, before the sending the identity authentication request to the server, the method further includes: establishing, by using a pre-stored certificate generated by the server, a secure transport layer protocol TLS two-way authentication connection with the server; and the communication with the server is specifically Said TLS two-way authentication connection.

Optionally, the second random code is encrypted by using a pre-stored user private key corresponding to the user identifier, where the password is verified by using a pre-stored private key password and a password of the security device, and the verification succeeds. The user private key stored in the security area is obtained, and the second random code is encrypted according to the user private key.

Optionally, after the encrypting the second random code according to the user private key, the method further includes: receiving a random private key password sent by the server, and modifying a password of the security device according to the random private key password.

In a second aspect, an embodiment of the present invention provides an identity authentication method, including the following steps:

Receiving an identity authentication request sent by the terminal; the identity authentication request includes a user identifier;

Sending a second random code to the terminal;

Receiving, by the terminal, a second random code encrypted by a user private key;

Decrypting the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier;

Verify that the decrypted second random code is consistent with the transmitted second random code. If they are consistent, the identity authentication is passed.

Optionally, before the receiving the identity authentication request sent by the terminal, the method further includes:

Determining a correspondence between the terminal identifier and the user identifier;

Sending a first random code to the terminal;

After receiving the terminal identifier, the user identifier, and the first random code sent by the terminal, performing verification, and sending a verification pass message to the terminal after the verification is passed;

And receiving a user identifier and a user public key sent by the terminal, and establishing a correspondence between the user identifier, the user public key, and the terminal identifier.

Optionally, the receiving the second random code that is sent by the terminal and encrypted by the user private key is specifically: receiving a second random code that is sent by the terminal and encrypted by the user private key, and the user identifier, And a terminal identifier; the user that uses the pre-stored corresponding to the user identifier The public key decrypts the second random code encrypted by the user private key, specifically: the second random code and the user identifier encrypted by the user private key by using the user public key corresponding to the terminal identifier Performing decryption; whether the second random code obtained by the verification and decryption is consistent with the transmitted second random code, and if the identity is consistent, the identity authentication is passed, specifically: whether the second random code obtained by verifying the decryption is consistent with the transmitted second random code And verifying the correspondence between the user identifier and the terminal identifier; if the decrypted second random code is consistent with the transmitted second random code and the terminal identifier corresponds to the user identifier, the identity authentication by.

Optionally, before the receiving the identity authentication request sent by the terminal, the method further includes: establishing a secure transport layer protocol TLS two-way authentication connection with the terminal by using a pre-stored certificate; and communicating with the terminal specifically by using the TLS Two-way authentication connection is made.

Optionally, after the second random code that is sent by the receiving terminal and encrypted by the user private key, the method further includes: sending the random private key password to the terminal.

In a third aspect, an embodiment of the present invention provides a terminal, including:

a first sending module, configured to send an identity authentication request to the server; the identity authentication request includes a user identifier;

a first receiving module, configured to receive a second random code sent by the server;

And a comparison module, configured to compare the received biometric information of the user input with the pre-stored biometric information corresponding to the user identifier;

And an encryption module, configured to encrypt the second random code by using a pre-stored user private key corresponding to the user identifier;

The second sending module is configured to send the second random code encrypted by the user private key to the server.

Optionally, further comprising:

a second receiving module, configured to receive a first random code sent by the server before sending the identity authentication request to the server;

a third sending module, configured to send the terminal identifier, the user identifier, and the first random code to the server;

a third receiving module, configured to receive biometric information recorded by the user after receiving the verification pass message sent by the server;

a key processing module, configured to generate a public-private key pair for the user, establish a correspondence between the biometric information, a terminal identifier, a user private key, and a user identifier, and send the user public key and the user identifier to The server.

Optionally, the second sending module is specifically configured to send the second random code encrypted by the user private key, the user identifier, and the terminal identifier to the server.

Optionally, further comprising:

a connection establishing module, configured to establish a secure transport layer protocol TLS two-way authentication connection with the server by using a pre-stored certificate generated by the server before sending the identity authentication request to the server, where the communication with the server is specifically TLS two-way authentication connection.

Optionally, the cryptographic module is specifically configured to perform verification by using a pre-stored private key cryptogram and a password of the security device, and obtain the user private key stored in the security zone after the verification succeeds, according to the user private key pair. The second random code is described for encryption.

Optionally, further comprising:

And a fourth receiving module, configured to: after the encrypting the second random code according to the user private key, receive a random private key password sent by the server, and modify a password of the security device according to the random private key password.

In a fourth aspect, an embodiment of the present invention provides a server, including:

a first receiving unit, configured to receive an identity authentication request sent by the terminal; the identity authentication request includes a user identifier;

a first sending unit, configured to send a second random code to the terminal;

a second receiving unit, configured to receive, by the terminal, a second encrypted by a user private key random code;

a decrypting unit, configured to decrypt the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier;

The first authentication unit is configured to verify whether the decrypted second random code is consistent with the sent second random code, and if they are consistent, the identity authentication is passed.

Optionally, further comprising:

a determining unit, configured to determine, according to the identity authentication request sent by the receiving terminal, a correspondence between the terminal identifier and the user identifier;

a second sending unit, configured to send a first random code to the terminal;

a second authentication unit, configured to perform verification after receiving the terminal identifier, the user identifier, and the first random code sent by the terminal, and send a verification pass message to the terminal after the verification is passed;

The relationship establishing unit is configured to receive the user identifier and the user public key sent by the terminal, and establish a correspondence between the user identifier, the user public key, and the terminal identifier.

Optionally, the second receiving unit is specifically configured to receive a second random code that is sent by the terminal and that is encrypted by a user private key, and the user identifier, and a terminal identifier, where the decrypting unit is specifically used to utilize The user's public key corresponding to the terminal identifier decrypts the second random code and the user identifier encrypted by the user private key; the first authentication unit is specifically configured to verify the second random code obtained by decryption and the second sent Whether the random code is consistent, and verifying the correspondence between the user identifier and the terminal identifier; if the decrypted second random code is consistent with the transmitted second random code, and the terminal identifier corresponds to the user identifier , the identity passed.

Optionally, further comprising:

a connection establishing unit, configured to establish a secure transport layer protocol TLS two-way authentication connection with the terminal by using a pre-stored certificate before the identity authentication request sent by the receiving terminal, and the communication with the terminal is specifically using the TLS bidirectional The authentication connection is made.

Optionally, further comprising:

And a third sending unit, configured to send a random private key password to the terminal after the second random code that is sent by the receiving terminal and encrypted by the user private key.

The benefits are as follows:

The current identity authentication technology needs to upload the biometric information of the user to the server, and there is a problem that the personal information is leaked and unsafe. The identity authentication scheme provided by the embodiment of the present invention saves the biometric information of the user on the terminal side, and does not need to be uploaded. The server completes the verification of the user biometric by the terminal, and after the terminal passes the verification, the random code and the user identifier encrypted by the pre-stored user private key are used to upload the server, and the server decrypts the user identifier and randomizes by using the pre-stored user public key. The code and other information can be verified without storing the biometric information of the user, thereby ensuring that the personal information of the user is safe and not leaked.

DRAWINGS

Specific embodiments of the present invention will be described below with reference to the accompanying drawings, in which:

FIG. 1 is a schematic flowchart of implementing an identity authentication method according to Embodiment 1 of the present invention;

2 is a schematic flowchart of implementing an identity authentication method in Embodiment 2 of the present invention;

3 is a schematic structural diagram 1 of a terminal in Embodiment 3 of the present invention;

4 is a second schematic structural diagram of a terminal in Embodiment 3 of the present invention;

FIG. 5 is a schematic structural diagram 3 of a terminal in Embodiment 3 of the present invention;

6 is a schematic structural view 4 of a terminal in Embodiment 3 of the present invention;

FIG. 7 is a schematic structural diagram 1 of a server in Embodiment 4 of the present invention; FIG.

FIG. 8 is a second schematic structural diagram of a server in Embodiment 4 of the present invention;

FIG. 9 is a schematic structural diagram 3 of a server in Embodiment 4 of the present invention; FIG.

FIG. 10 is a schematic structural diagram 4 of a server in Embodiment 4 of the present invention; FIG.

FIG. 11 is a schematic diagram showing a process of registering biometric information of a user in Embodiment 5 of the present invention;

FIG. 12 is a schematic diagram showing a process of user identity authentication in Embodiment 5 of the present invention; FIG.

13 is a schematic diagram showing an identity authentication process of a mobile payment scenario in Embodiment 6 of the present invention;

14 is a schematic diagram showing an identity authentication process of a cloud robot scenario in Embodiment 7 of the present invention;

FIG. 15 is a schematic diagram showing the identity authentication process of the access control system in the eighth embodiment of the present invention.

detailed description

The embodiments of the present invention are further described in detail with reference to the accompanying drawings, in which FIG. An exhaustive example. And in the case of no conflict, the features in the embodiments and the embodiments in the description can be combined with each other.

The inventor noticed during the invention:

The implementation process of existing biometric-based authentication methods (for example, face recognition, fingerprint recognition, etc.) usually includes the following steps:

1. The terminal collects biometric information of the user;

2. The terminal uploads the biometric information to the server;

3. The server compares and matches the biometric information uploaded by the terminal with the pre-stored biometric information. If the matching is successful, the authentication passes.

The above authentication method is adopted. Since the biometric information of the user needs to be uploaded to the server during implementation, the biometric information of the user is easily leaked, which has a certain security risk.

For the above-mentioned deficiencies, the embodiment of the present invention provides an identity authentication method, a terminal, and a server. The biometric information of the user (for example, personal privacy information such as a face, a fingerprint, and an iris) exists only in the terminal. Side, thus ensuring that biometric information will not be leaked, and the security of user privacy is guaranteed.

In order to facilitate the implementation of the present invention, the identity authentication method, terminal, and server provided by the present invention are described below in conjunction with specific embodiments.

Embodiment 1

FIG. 1 is a schematic flowchart of the implementation of the identity authentication method in the first embodiment of the present invention. As shown in the figure, the identity authentication method may include the following steps:

Step 101: Send an identity authentication request to a server, where the identity authentication request includes a user identifier.

Step 102: Receive a second random code sent by the server.

Step 103: Compare the received biometric information input by the user with the biometric information corresponding to the user identifier stored in advance;

Step 104: If they are consistent, encrypt the second random code by using a pre-stored user private key corresponding to the user identifier.

Step 105: Send a second random code encrypted by the user private key to the server.

The identity authentication method provided by the embodiment of the present invention may be implemented on the terminal side, and may be implemented on a mobile terminal such as a mobile phone, a pad, a tablet computer, or an intelligent robot.

The sending the identity authentication request to the server may be triggered by the user (for example, the user clicks/starts the identity authentication service), or may be triggered according to the user's operation (for example, when the user wants to access the application on the terminal or the terminal, the terminal itself Initiating an authentication request, the identity authentication request may include information such as a user identifier, a terminal identifier, and the like, and the user identifier may be a user account, a user ID, a user QR code, etc., and the terminal identifier may be an international mobile device. Identification code (IMEI, International Mobile Equipment Identity), etc.

It should be noted that the embodiment of the present invention does not limit the order between the above steps. For example, there are several situations:

In the first case, the identity authentication request may be sent to the server, the second random code sent by the server is received, and then the biometric information input by the user is received, and the biometric information input by the user is pre-stored with the Comparing the biometric information corresponding to the user identifier; if consistent, encrypting the second random code by using a pre-stored user private key corresponding to the user identifier; and second randomizing the user private key The code is sent to the server.

In the second case, the user can input the authentication request while receiving the identity authentication request. Biometric information, receiving a second random code sent by the server, and comparing biometric information input by the user with biometric information corresponding to the user identifier stored in advance; if they are consistent, using pre-storage And encrypting, by the user private key corresponding to the user identifier, the second random code; and sending the second random code encrypted by the user private key to the server.

In the third case, the biometric information input by the user may be received first, and then the biometric information input by the user is compared with the pre-stored biometric information corresponding to the user identifier, and if they are consistent, the server sends the biometric information to the server. An identity authentication request, receiving a second random code sent by the server, encrypting the second random code by using a pre-stored user private key corresponding to the user identifier; and second randomizing the user private key The code is sent to the server.

In the fourth case, the biometric information input by the user may be received first, and then the biometric information input by the user is compared with the pre-stored biometric information corresponding to the user identifier, and an identity authentication request is sent to the server. Receiving a second random code sent by the server, if the biometric comparison is consistent, encrypting the second random code by using a pre-stored user private key corresponding to the user identifier; and encrypting the user private key The second random code is sent to the server.

The received second random code sent by the server may be a string of characters, a letter or a combination of the two.

In the embodiment of the present invention, the binding relationship between the user identifier, the user biometric information, and the user private key may be pre-stored. After receiving the biometric information input by the user, the biometric information input by the user may be stored in advance with the pre-stored Comparing the biometric information corresponding to the user identifier, if the user identifier is matched, the user identifier is matched with the biometric information, and then the second random code is performed by using a pre-stored user private key corresponding to the user identifier. Encryption, sending the encrypted second random code to the server.

The user private key may be a private key in a public-private key pair generated by using an existing key generation algorithm, and the existing key generation algorithm may include a RAS algorithm, a 3DES algorithm, and the like.

The identity authentication method provided by the embodiment of the present invention compares the biometric information input by the user with the pre-stored biometric information of the user after the identity authentication request is sent to the server, and completes verification of the biometric information. After the verification is passed, the second random code is encrypted and sent to the server by using the user's private key. Since the embodiment of the present invention completes the verification of the user biometric information locally, the biometric information of the user does not need to be sent to the server by the server. Verification ensures the security of user information and reduces the amount of data transferred.

In an implementation, before the sending the identity authentication request to the server, the method may further include:

Receiving a first random code sent by the server;

Transmitting the terminal identifier, the user identifier input by the user, and the first random code to the server;

Generating a public-private key pair for the user, storing the user private key and transmitting the user public key and the user identification to the server.

In the embodiment of the present invention, before the sending of the identity verification request to the server, the user registration process may be performed. The method may be: receiving a first random code sent by the server, and sending the terminal identifier, the user identifier, and the first random code to the The server is configured to perform verification by the server; after receiving the verification pass message sent by the server, receiving the biometric information entered by the user, generating a public-private key pair for the user, storing the user private key, and storing the user public key and the user identifier Sent to the server.

In a specific implementation, the registration request may be filed by the user. The embodiment of the present invention first sends a user registration request to the server, and the server establishes the user for the user after receiving the registration request. Corresponding relationship between the user identifier and the terminal identifier, the first random code sent by the server is received by the server in the embodiment of the present invention; the user identifier is created by the server and the corresponding relationship between the user identifier and the terminal identifier is established, and then received by the embodiment of the present invention. The first random code sent by the server.

The terminal identifier and the user identifier may be in a one-to-one relationship, or may be a one-to-many relationship, and the user identifier may have a one-to-one relationship with the user private key and the biometric information.

After the foregoing process, the local device can successfully store the correspondence between the user identifier, the user private key, the terminal identifier, and the user biometric information, and the server side can successfully store the user identifier, the user public key, and the terminal identifier. The correspondence provides data support for subsequent identity authentication.

In the implementation, the second random code that is encrypted by the user's private key is sent to the server, and the second random code that is encrypted by the user's private key, the user identifier, and the terminal identifier are sent to the server. The server.

In a specific implementation, after the second random code is encrypted by using a pre-stored user private key corresponding to the user identifier, the terminal identifier may be sent to the second random code encrypted by the user private key. Server so that the server authenticates the terminal ID.

In an implementation, the receiving the biometric information input by the user may specifically: receiving a fingerprint, a palm print, an iris, a face, and/or a sound input by the user.

In a specific implementation, the biometric information may include a fingerprint, a palm print, an iris, a face, a sound, and the like. The biometric information input by the user may be: receiving a fingerprint, a palm print, an iris, and a face input by the user. , sound, etc. The fingerprint, the palm print, the iris, the face, the sound, and the like input by the user may be implemented by using an existing sensor or a collector, and the present invention is not described herein.

Since the fingerprint, the palm print, the iris, the face, the sound and the like are all the user's private information, in order to ensure the privacy information of the user, the embodiment of the present invention proposes to complete the biometric test locally. The way to license, you do not need to upload biometric information to the server.

In order to further enhance the data security of the embodiment of the present application, the present application may also be implemented in the following manner.

Establishing a secure transport layer protocol (TLS) two-way authentication connection with the server by using a certificate generated by a pre-stored server; the communication with the server is specifically performed by using the TLS two-way authentication connection.

In a specific implementation, a certificate generated by the server may be preset on the terminal side, and the certificate may be used for establishing a TLS mutual authentication connection between the terminal and the server, and all subsequent communications may be performed based on the TLS connection.

By implementing in this manner, the embodiment of the present application can prevent the terminal from being illegally intercepted when transmitting the public key of the public-private key pair generated by the terminal to the server, thereby further improving security.

In the implementation, the second random code is encrypted by using a pre-stored user private key corresponding to the user identifier, which may be:

The password is verified by using the pre-stored private key cipher and the password of the security device. After the verification succeeds, the user private key stored in the security area is obtained, and the second random code is encrypted according to the user private key.

In a specific implementation, the public-private key pair generated by the terminal may use a security device and be stored in a secure area of the terminal. When the private key is used, the private key can be used to authenticate the security device. If the password is successfully verified, the user private key stored in the security zone can be obtained, which further improves the security of the user's private key.

In an implementation, after the encrypting the second random code according to the user private key, the method may further include:

Receiving a random private key password sent by the server, and modifying the security according to the random private key password The password for the full device.

In a specific implementation, after each time the private key password is used, a random private key password is obtained from the server to modify the password of the security device, that is, the password of the security device is one-time, and is updated once used. Once, thereby ensuring the security of the user's private key stored in the secure area in the secure device.

Embodiment 2

FIG. 2 is a schematic flowchart of the implementation of the identity authentication method in the second embodiment of the present invention. As shown in the figure, the identity authentication method may include the following steps:

Step 201: Receive an identity authentication request sent by the terminal, where the identity authentication request includes a user identifier.

Step 202: Send a second random code to the terminal.

Step 203: Receive a second random code that is sent by the terminal and encrypted by a user private key.

Step 204: Decrypt the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier.

Step 205: Verify whether the decrypted second random code is consistent with the transmitted second random code. If they are consistent, the identity authentication is passed.

The identity authentication method provided by the embodiment of the present invention can be implemented on the network side or the server side.

The identity authentication request sent by the terminal may include information such as a user identifier and a terminal identifier, where the user identifier may be information such as an account number and an ID of the user, and the terminal identifier may be information such as an IMEI of the terminal.

In the embodiment of the present invention, the correspondence between the user identifier, the user public key, and the terminal identifier may be pre-stored, and after receiving the second random code that is sent by the terminal and encrypted by the user private key, the user may be utilized. The public key decrypts the second random code, and if the second random code obtained by the decryption is consistent with the previously transmitted second random code, the identity authentication is passed.

The identity authentication method provided by the embodiment of the present invention is only required to be utilized by the server side. The public key corresponding to the user identifier decrypts and verifies the second random code sent by the terminal, so as to achieve the purpose of identity authentication, and the terminal does not need to upload the biometric information of the user, thereby ensuring the security of the user's personal information. .

In an implementation, before the receiving the identity authentication request sent by the terminal, the method may further include:

Sending a first random code to the terminal;

In a specific implementation, the determining the correspondence between the terminal identifier and the user identifier may be: receiving a user registration request sent by the terminal, where the registration request may include a user identifier and a terminal identifier, and establishing the user identifier and the terminal Corresponding relationship between the identifiers may be: generating a user identifier for the user, and establishing a correspondence between the user identifier and the terminal identifier.

After receiving the terminal identifier, the user identifier, and the first random code sent by the terminal, verifying the correspondence between the terminal identifier and the user identifier, and verifying whether the first random code is consistent with the previously sent first random code. After the verification is passed, the authentication pass message may be sent to the terminal, and the user identifier and the user public key sent by the terminal are received, and the correspondence between the user identifier, the user public key, and the terminal identifier is established.

The correspondence between the terminal identifier and the user identifier may be a one-to-one relationship or a one-to-many relationship; the correspondence between the user identifier and the user public key may be a pair. A relationship.

The user public key and the user private key are a pair of public and private key pairs. In the specific implementation, the existing encryption algorithm may be used to generate the public key pair. The specific process of generating the public and private key pairs is not described herein.

After the foregoing process, the server side may store the correspondence between the user identifier, the terminal identifier, and the user public key, and provide support for subsequent identity authentication.

In an implementation, the receiving the second random code that is sent by the terminal and encrypted by the user's private key may be: receiving a second random code that is sent by the terminal and encrypted by the user's private key, and the user identifier, And terminal identification;

Decrypting the second random code that is encrypted by the user private key by using a user public key corresponding to the user identifier, which may be: using a public key pair corresponding to the terminal identifier Decoding the second random code encrypted by the user private key and the user identifier;

Whether the second random code obtained by the verification and the decryption is consistent with the second random code that is sent, and if the identity authentication is passed, the authentication may be: whether the second random code obtained by the decryption is consistent with the second random code sent, and And verifying the correspondence between the user identifier and the terminal identifier; if the second random code obtained by the decryption is consistent with the sent second random code and the terminal identifier is corresponding to the user identifier, the identity authentication is passed.

In a specific implementation, the terminal identifier sent by the terminal and the second random code encrypted by the user private key may be received, and when the identity authentication is performed, whether the second random code obtained by the decryption is consistent with the second random code sent may be verified. And verifying a correspondence between the terminal identifier and the user identifier. If the decrypted second random code is consistent with the transmitted second random code and the terminal identifier corresponds to the user identifier, the identity authentication is passed. The correspondence between the terminal identifier and the user identifier may be a one-to-one relationship.

If the corresponding relationship between the terminal identifier and the user identifier is a one-to-one relationship, the embodiment of the present invention may also be implemented in the following manner.

After performing the verification of the biometric information, the terminal encrypts and signs the second random code and the user identifier by using the user private key of the user, and encrypts the second random code after the signature and the user identifier, and the terminal. The identifier is sent to the server, and the server is determined according to the terminal identifier. Determining, by the terminal identifier, the user public key, using the user public key to decrypt the second random code and the user identifier, and verifying whether the second random code obtained by the decryption and the previously sent random code are Consistently, the correspondence between the decrypted user identifier and the terminal identifier is verified.

The embodiment of the present invention does not require the terminal to upload the biometric information of the user, and only needs to verify the user identifier, the user public key, and the terminal identifier, and the verification of the biometric information of the user is completed by the terminal itself, thereby ensuring the user's biological Feature information is not leaked, which improves the security of personal information and reduces the amount of data in the transmission process.

Establishing a secure transport layer protocol TLS two-way authentication connection with the terminal by using a pre-stored certificate; the communication with the terminal is specifically performed by using the TLS two-way authentication connection.

In a specific implementation, in order to ensure the communication security between the terminal and the server, the embodiment of the present application may establish a secure connection before the communication with the terminal, and the server pre-stores the certificate, and the terminal also pre-stores the certificate generated by the server, and both parties pass the The certificate establishes a TLS two-way authentication connection to ensure the security of subsequent communications and prevent data from being intercepted illegally during communication.

In an implementation, after the second random code that is sent by the receiving terminal and encrypted by the user's private key, the method may further include:

Sending a random private key password to the terminal.

In a specific implementation, after each time the private key password is used, the server may generate a random private key password for the terminal, and send the random private key password to the terminal, so that the terminal updates the password of the security device, so that the terminal The use of the security device's password is one-time, ensuring the security of the user's private key.

Embodiment 3

Based on the same inventive concept, an embodiment of the present invention further provides a terminal, because of these settings. The principle of the problem-solving is similar to the above-mentioned identity authentication method (terminal side). Therefore, the implementation of these devices can be referred to the implementation of the method, and the repeated description will not be repeated.

FIG. 3 is a schematic structural diagram 1 of a terminal in Embodiment 3 of the present invention. As shown in the figure, the terminal may include:

The first sending module 301 is configured to send an identity authentication request to the server, where the identity authentication request includes a user identifier.

The first receiving module 302 is configured to receive a second random code sent by the server;

The comparison module 303 is configured to compare the received biometric information input by the user with the pre-stored biometric information corresponding to the user identifier;

The encryption module 304 is configured to encrypt the second random code by using a pre-stored user private key corresponding to the user identifier if the one is consistent;

The second sending module 305 is configured to send the second random code encrypted by the user private key to the server.

FIG. 4 is a schematic structural diagram 2 of the terminal in the third embodiment of the present invention. As shown in the figure, the terminal may further include:

The second receiving module 306 is configured to receive the first random code sent by the server before sending the identity authentication request to the server.

The third sending module 307 is configured to send the terminal identifier, the user identifier input by the user, and the first random code to the server;

The third receiving module 308 is configured to receive the biometric information recorded by the user after receiving the verification pass message sent by the server;

The key processing module 309 is configured to generate a public-private key pair for the user, establish a correspondence between the biometric information, the terminal identifier, the user private key, and the user identifier, and send the user public key and the user identifier. To the server.

The terminal in the embodiment of the present invention may specifically be a mobile terminal such as a mobile phone, a pad, or a tablet computer. The mobile terminal may be in the form of a touch screen or a button. The present invention does not limit this.

According to the terminal provided by the embodiment of the present invention, the first sending module sends an identity authentication request, and the first receiving module receives the second random code sent by the server, after the second receiving module receives the biometric information input by the user, The comparison module compares the biometric information input by the user with the pre-stored biometric information corresponding to the user identifier, and completes the verification of the biometric information on the terminal side, without sending the biometric information to the The server is authenticated by the server to avoid leakage of biometric information caused during the uploading process, thereby ensuring the security of the biometric information and reducing the amount of data in the transmission process.

In an implementation, the second sending module may be configured to send the second random code encrypted by the user private key, the user identifier, and the terminal identifier to the server.

In an implementation, the biometric information may specifically be: a fingerprint, a palm print, an iris, a face, and/or a sound.

In a specific implementation, the biometric information may be: biometric information such as a fingerprint, a palm print, an iris, a face, and a sound. In the embodiment of the present invention, the device can be collected by a device such as a palmprint collecting device, an iris collecting device, a face collecting device, a sound input device, etc., and the devices can be used in the prior art, or can be used by those skilled in the art. The development and design are carried out according to actual needs, and the present invention does not limit this.

FIG. 5 is a schematic structural diagram 3 of the terminal in the third embodiment of the present invention. As shown in the figure, the terminal may further include:

The connection establishing module 310 is configured to establish a secure transport layer protocol TLS two-way authentication connection with the server by using a pre-stored certificate generated by the server before sending the identity authentication request to the server, where the communication with the server is specifically Said TLS two-way authentication connection.

In an implementation, the cryptographic module is specifically configured to perform verification by using a pre-stored private key cryptogram and a password of the security device, and obtain a user private key stored in the security area after the verification succeeds, according to the user private key pair. The second random code is encrypted.

FIG. 6 is a schematic structural diagram of a terminal in a third embodiment of the present invention. As shown in the figure, the terminal may further include:

The fourth receiving module 311 is configured to: after the second random code is encrypted according to the user private key, receive a random private key password sent by the server, and modify the password of the security device according to the random private key password.

Embodiment 4

Based on the same inventive concept, a server is also provided in the embodiment of the present invention. Since the principle of solving the problem of these devices is similar to an identity authentication method (network side), the implementation of these devices can be referred to the implementation of the method, and the repetition is performed. No longer.

FIG. 7 is a schematic structural diagram 1 of a server in Embodiment 4 of the present invention. As shown in the figure, the server may include:

The first receiving unit 701 is configured to receive an identity authentication request sent by the terminal, where the identity authentication request includes a user identifier.

The first sending unit 702 is configured to send a second random code to the terminal.

The second receiving unit 703 is configured to receive a second random code that is sent by the terminal and encrypted by a user private key.

The decrypting unit 704 is configured to decrypt the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier;

The first authentication unit 705 is configured to verify whether the decrypted second random code is consistent with the sent second random code, and if they are consistent, the identity authentication is passed.

In a specific implementation, the server receives an identity authentication request sent by the terminal, where the identity authentication request may include a user identifier, a terminal identifier, other information, and the like. The server provided by the embodiment of the present invention may pre-store the correspondence between the user identifier, the user public key, and the terminal identifier, and use the pre-stored after receiving the second random code that is sent by the terminal and encrypted by the user private key. The user public key corresponding to the user identifier is the second encrypted by the user private key The random code is decrypted to verify whether the decrypted second random code is consistent with the transmitted second random code, and the identity authentication can be completed.

The server provided by the embodiment of the present invention verifies the user identifier, decrypts the second random code by using the user public key corresponding to the user identifier, and can verify the correspondence between the user public key and the user identifier, and does not need to upload the living entity. The feature information is verified to ensure that the biometric information is not leaked, and the security is reduced while reducing the amount of data transmitted.

FIG. 8 is a schematic structural diagram 2 of a server in Embodiment 4 of the present invention. As shown in the figure, the server may further include:

The determining unit 706 is configured to determine, according to the identity authentication request sent by the receiving terminal, a correspondence between the terminal identifier and the user identifier.

a second sending unit 707, configured to send a first random code to the terminal;

The second authentication unit 708 is configured to perform verification after receiving the terminal identifier, the user identifier, and the first random code sent by the terminal, and send a verification pass message to the terminal after the verification is passed;

The relationship establishing unit 709 is configured to receive the user identifier and the user public key sent by the terminal, and establish a correspondence between the user identifier, the user public key, and the terminal identifier.

In an implementation, the second receiving unit may be configured to receive a second random code, the user identifier, and a terminal identifier that are sent by the terminal and encrypted by a user private key;

The decrypting unit may be configured to decrypt the second random code and the user identifier encrypted by the user private key by using a public key corresponding to the terminal identifier;

The first authentication unit may be configured to verify whether the decrypted second random code is consistent with the sent second random code, and verify the correspondence between the user identifier and the terminal identifier; if the decrypted The second random code is consistent with the transmitted second random code, and the terminal identifier corresponds to the user identifier, and the identity authentication is passed.

FIG. 9 is a schematic structural diagram 3 of the server in the fourth embodiment of the present invention. As shown in the figure, the server may further include:

The connection establishing unit 710 is configured to establish a secure transport layer protocol TLS two-way authentication connection with the terminal by using a pre-stored certificate before the identity authentication request sent by the receiving terminal, and the communication with the terminal is specifically using the TLS Two-way authentication connection is made.

FIG. 10 is a schematic structural diagram 4 of a server in Embodiment 4 of the present invention. As shown in the figure, the server may further include:

The third sending unit 711 is configured to send a random private key password to the terminal after the second random code that is sent by the receiving terminal and encrypted by the user private key.

After understanding the environment to be used, the terminal side and the network side can be implemented as follows. In the description process, the implementation of the terminal and the network side server will be respectively explained, but this does not mean that the two must cooperate with the implementation. In fact, when the terminal and the server are separately implemented, they also solve the terminal side and the network side respectively. The problem is that when the two are combined, they will get better technical results.

Embodiment 5

The embodiment of the present invention takes the interaction process of the mobile terminal and the identity authentication server as an example for description.

The identity authentication process may include two steps: the first step is to register the mobile terminal user identity information; the second step is to perform fingerprint, iris or face biometric identification by the mobile terminal and secondary authentication at the identity authentication server.

11 is a schematic diagram of a user biometric information registration process in Embodiment 5 of the present invention. As shown in the figure, the user biometric information registration process may include the following steps:

Step 1101: The user applies for registering an account.

The user uses the mobile terminal to perform terminal device registration, input user account information, and the terminal sends a registration request to the server.

Step 1102: Create a user account for the mobile terminal user in the identity authentication server.

Step 1103: Establish a relationship between the user account and the mobile terminal identifier in the identity authentication server. Binding relationship to one;

Step 1104: The identity authentication server sends a random code to the mobile terminal.

Step 1105: The user inputs the random code sent by the identity authentication server by using the mobile terminal, and sends the identifier to the identity authentication server for verification.

Step 1106, the identity authentication server verifies the user account, the mobile terminal identifier, and the random code, if the verification is successful, step 1107 is performed;

Step 1107: The identity authentication server sends prompt information to the mobile terminal, prompting the user to input biometric information.

Step 1108: The user inputs biometric information such as a fingerprint, an iris, or a face on the mobile terminal.

Step 1109: The mobile terminal generates a public-private key pair:

The generated private key is stored in the security area of the mobile terminal to ensure that other devices cannot access the access;

Transmitting the generated public key and user identification information (for example, a user account, etc.) to the identity authentication server through a secure network;

Step 1110: The identity authentication server stores the user public key and the user identity information.

After the user registration is completed, when the user operates the mobile terminal next time, identity authentication is required.

FIG. 12 is a schematic diagram of a user identity authentication process in Embodiment 5 of the present invention. As shown in the figure, the user identity authentication process may include the following steps:

Step 1201: The user starts an identity authentication service, and the mobile terminal sends an identity authentication request to the identity authentication server.

Step 1202: The identity authentication server generates a random code according to current user information, and sends the random code to the user.

Step 1203: The user enters a biometric such as a fingerprint, an iris, or a face to be verified according to the prompt of the mobile terminal, and a random code sent by the identity authentication server;

Step 1204, the mobile terminal verifies the biometrics such as fingerprints, irises, or faces, and after the verification is successful, step 1205 is performed;

Step 1205: Perform cryptographic signature on the user information and the random code by using a private key stored in the mobile terminal, and send the encrypted and signed information to the identity authentication server.

Step 1206: The identity authentication server performs the decryption check by using the user public key stored in the identity authentication server, and verifies whether the random code is correct, and completes the secondary verification of the user identity. If the verification succeeds, step 1207 is performed. ;

Step 1207: Notify other control systems to allow the user to access and operate.

Due to the identity authentication mode provided by the embodiment of the present invention, personal privacy information such as a user's face, fingerprint, or iris exists only in the mobile terminal, and is not sent to the identity authentication server, thereby ensuring the user's Biometric information is not leaked, improving data security.

Embodiment 6

The identity authentication scheme provided by the embodiment of the present invention can be applied to a mobile payment scenario.

After user A downloads the mobile payment software on the mobile phone A-mobile, user A can click on the registration in the interface of the mobile payment software to input the user name, password and other information, and the mobile phone A-mobile can use the information and the mobile phone itself. The IMEI number is sent to the server.

Assume that the IMEI number of the mobile phone A-mobile is 123456, the server creates an account A for the user A, establishes a binding relationship between the account A and the 123456, and then sends a random code to the mobile phone A-mobile.

The user inputs the random code on the mobile payment software interface of the mobile phone A-mobile, and the mobile phone A-mobile sends the account A and the random code to the server.

After the server is successfully authenticated, the user A is prompted to enter a fingerprint on the mobile phone; the user records on the mobile phone. After the fingerprint is entered, the mobile phone can generate a public-private key pair for the user A through the internal device, store the generated private key in the secure area of the mobile phone, and send the generated public key and account A to the server.

After receiving the public keys of the accounts A and A, the server stores the one-to-one information in a designated area of the server.

The user registration process is completed. The mobile phone side stores the correspondence between the account A, the mobile phone IMEI, the private key of the user A, and the fingerprint of the user A. The server side stores the account A, the mobile phone IMEI, and the user A. The correspondence of the keys.

FIG. 13 is a schematic diagram of an identity authentication process of a mobile payment scenario in Embodiment 6 of the present invention. As shown in the figure, the identity verification process may include:

When user A makes a purchase and needs to make a payment, user A can click the identity authentication button to trigger the mobile phone A-mobile to send an authentication request to the server, or the mobile phone A-mobile can initiate an authentication request to the server when user A clicks the payment button. The authentication request may include information such as a mobile phone IMEI, a user account A, and the like.

After receiving the authentication request sent by the mobile phone A-mobile, the server may generate a random code and send it to the mobile phone A-mobile.

After receiving the random code, the mobile phone A-mobile may prompt the user A to enter the fingerprint and the random code, and after the user A enters the fingerprint and the random code, verify the fingerprint of the user A, and determine the fingerprint and the entered fingerprint. Whether the fingerprints stored in the mobile phone A-mobile match, if they match (the threshold can be set when the implementation is implemented, and the matching is less than a certain error can be considered as matching), the biometric verification is considered successful.

The mobile phone A-mobile encrypts and signs the account A and the random code by using the pre-stored user A's private key, and sends it to the server.

When the server receives the encrypted and signed information, the identity of the user may be verified twice, that is, the information is decrypted and verified by the public key of the user A stored in advance, and the randomized decryption is verified. Whether the code is consistent with the random code sent by the server before, verifying the end Whether the end identifier corresponds to the account A or the like.

If the verification passes, the server can notify the payment system to perform the payment operation.

At this point, the mobile payment process has been completed.

Before the mobile payment, the fingerprint verification of the mobile terminal and the terminal-user authentication of the server end are performed, and the fingerprint of the user A is not required to be uploaded by the mobile phone, thereby ensuring the security of the privacy information of the user A.

Example VII.

The identity authentication scheme provided by the embodiment of the present invention can be applied to a cloud robot scenario. The cloud robot is taken as an example for description.

The cloud robot may include a robot body and a cloud robot, and the cloud robot may specifically be a cloud server.

User B purchases the robot Joan. If the robot Joan is numbered JQR1, the user B can make a registration request, and the cloud robot establishes the account b for the user B and establishes a one-to-one binding relationship between the account b and the JQR1, and Sending a random code to the robot Joan, after the user B inputs the random code on the robot Joan, the robot Joan sends the account b together with the code JQR1 and the random code to the cloud robot.

The cloud robot verifies the correspondence between the account b and the code JQR1, and verifies whether the random code is consistent with the previously sent random code. If the verification passes, the robot Joan is notified to pass the verification.

User B can record sound on the robot Joan, for example: "I am user B, I am your master." Robot Joan can store this sound, and can also recognize this sound, extract sound features, etc., such as tone, Voice, etc.

The robot Joan generates a public-private key pair for the user B, stores the private key in the robot body, and transmits the account b, the number JQR1, and the public key to the cloud robot.

The cloud robot stores the received account b, the number JQR1, and the public key one-to-one.

In the above, the robot registration process is completed, the robot body stores the correspondence relationship between the account b, the private key of the number JQR1, B, and the voice feature of B; the cloud robot stores the public key of the account b, the numbers JQR1 and B Correspondence relationship.

14 is a schematic diagram of an identity authentication process of a cloud robot scenario in the seventh embodiment of the present invention. As shown in the figure, the identity authentication process of the cloud robot scenario may include:

When user B needs the robot Joan to provide services for him, for example, user B sends out a voice "Please sweep the floor."

The robot Joan can send the account b to the cloud robot. After receiving the random code sent by the cloud robot, the user B can input the random code according to the prompt, and the specific implementation can be manual keyboard input, touch screen input or voice input.

The robot Joan performs voice recognition on the voice information of the user B ("sweeping the ground"), extracts the voice features, and compares the voice features with the pre-stored voice features, if the features such as pitch, timbre, etc. are consistent or within a certain error range. , the user is considered to be user B.

At this time, the robot Joan can encrypt and sign the random code with the private key, and send the encrypted code and the user information to the cloud robot.

The cloud robot performs the decryption check by using the public key of the user B stored in advance, and verifies the correspondence between the account b, the number JQR1, and the public key, and verifies whether the random code is consistent with the previously issued random code.

If the verification is successful, the robot's sweep control module can be notified that the sweep operation can be performed, and the robot Joan can clean the room floor.

The above solution is adopted to avoid the leakage of the voice information of the user B, and the security of the personal information of the user B is ensured.

Suppose user C comes to user B's home. User C gives a voice command to the robot Joan, such as "What is the name of your home owner?"

The robot Joan recognizes the voice information of the user C and pre-stores the user B. The voice features are compared, and it is found that the information such as the tone and the timbre of the two are greatly different (greater than the error range), and it can be determined that the user is not the user B and refuses to provide services for the user.

With the above scheme, the biometrics can be verified locally in the robot. If the verification fails, the verification result can be directly and quickly given, and the biometric information of the user does not need to be sent to the cloud robot, and the personal information of the user is ensured. It is transmitted and leaked, and on the other hand, the efficiency of verification is improved.

Example VIII.

The identity authentication scheme provided by the embodiment of the present invention can be applied to an access control scenario.

Suppose company D purchases an access control system (which can include access control devices and network side servers) and installs access control devices at the company's door. Each employee can enter his or her face information through a registered account, which is generated for each employee. The public-private key pair stores the employee number, the relative face information, the corresponding private key, and the access control device number, and the network side of the access control system stores the employee number, the corresponding public key, and the access control device number. .

FIG. 15 is a schematic diagram of the identity authentication process of the access control system in the eighth embodiment of the present invention. As shown in the figure, the identity authentication process of the access control system may include:

When an employee enters and exits the company, an identity authentication service is initiated.

The network side sends a random code to the access control device.

The employee inputs a random code according to the prompt and faces his/her face to the collection device of the access control device. After the access device obtains the face information of the employee, it compares it with the pre-stored face information, and if the comparison is consistent, The number of the employee is determined according to the face information.

The random code is cryptographically signed by using the employee's private key, and the random code and the employee number and the access control device number are sent to the network side.

The network side determines the public key of the employee by using the employee number, and performs decryption check on the random code.

If the decrypted random code is consistent with the previously issued random code, the identity verification is considered successful, and the switch control module is notified, and the switch control module performs unlocking on the company door after receiving the verification notification.

The identity authentication scheme provided by the embodiment of the present invention can also be applied to other scenarios such as a smart home, and the present invention will not be described herein.

In the identity authentication scheme provided by the embodiment of the present invention, the mobile terminal may pre-store the binding relationship between the user identifier, the biometric information, the user private key, and the terminal identifier, and the server side may pre-store the binding of the user identifier, the user public key, and the terminal identifier. The authentication process may include one-time authentication of the local biometric information of the mobile terminal and secondary authentication of the server-side device information, thereby implementing identity authentication under the premise of ensuring that the user's personal privacy information is not leaked.

For convenience of description, the various parts of the above described devices are described in terms of functions divided into various modules or units. Of course, the functions of the various modules or units may be implemented in one or more software or hardware in the practice of the invention.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing device Means for implementing the functions specified in one or more flows of the flowchart or in a block or blocks of the flowchart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

Claims

An identity authentication method includes the following steps:

Sending an identity authentication request to the server; the identity authentication request includes a user identifier;

Receiving a second random code sent by the server;

Comparing the received biometric information input by the user with the pre-stored biometric information corresponding to the user identifier;

If they are consistent, encrypting the second random code by using a pre-stored user private key corresponding to the user identifier;

Sending a second random code encrypted by the user private key to the server.
The method of claim 1, wherein before the sending the identity authentication request to the server, the method further comprises:

Receiving a first random code sent by the server;

Sending the terminal identifier, the user identifier, and the first random code to the server;

Receiving biometric information entered by the user after receiving the verification pass message sent by the server;

Generating a public-private key pair for the user, establishing a correspondence between the biometric information, the terminal identifier, the user private key, and the user identifier, and sending the user public key and the user identifier to the server.
The method according to claim 1, wherein the second random code encrypted by the user private key is sent to the server, specifically: a second random code and a content encrypted by the user private key. The user identifier and the terminal identifier are sent to the server.
The method according to claim 1, wherein before the sending the identity authentication request to the server, the method further comprises: establishing a secure transport layer protocol TLS two-way authentication connection with the server by using a pre-stored certificate generated by the server; The communication of the server is specifically performed by using the TLS two-way authentication connection.
The method according to claim 1, wherein the encrypting the second random code by using a pre-stored user private key corresponding to the user identifier, specifically: using a pre-stored private key password and The password of the security device is verified. After the verification succeeds, the user private key stored in the security area is obtained, and the second random code is encrypted according to the user private key.
The method according to claim 6, wherein after the encrypting the second random code according to the user private key, the method further comprises: receiving a random private key password sent by the server, according to the random private key password Modify the password of the security device.
An identity authentication method includes the following steps:

Receiving an identity authentication request sent by the terminal; the identity authentication request includes a user identifier;

Sending a second random code to the terminal;

Receiving, by the terminal, a second random code encrypted by a user private key;

Decrypting the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier;

Verify that the decrypted second random code is consistent with the transmitted second random code. If they are consistent, the identity authentication is passed.
The method according to claim 7, wherein before the receiving the identity authentication request sent by the terminal, the method further comprises:

Determining a correspondence between the terminal identifier and the user identifier;

Sending a first random code to the terminal;

After receiving the terminal identifier, the user identifier, and the first random code sent by the terminal, performing verification, and sending a verification pass message to the terminal after the verification is passed;

And receiving a user identifier and a user public key sent by the terminal, and establishing a correspondence between the user identifier, the user public key, and the terminal identifier.
The method according to claim 7, wherein the receiving the second random code that is sent by the terminal and encrypted by the user private key is specifically: receiving the used transmission by the terminal a second random code encrypted by the user private key, the user identifier, and the terminal identifier; the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier Decrypting, specifically: decrypting the second random code and the user identifier encrypted by the user private key by using a public key corresponding to the terminal identifier; and the second random code obtained by the verification and decryption Whether the second random code is consistent, if the identity is consistent, the identity authentication is passed, specifically: verifying whether the second random code obtained by the decryption is consistent with the sent second random code, and verifying the relationship between the user identifier and the terminal identifier. Corresponding relationship; if the decrypted second random code is consistent with the transmitted second random code and the terminal identifier corresponds to the user identifier, the identity authentication is passed.
The method according to claim 7, wherein before the receiving the identity authentication request sent by the terminal, the method further comprises: establishing a secure transport layer protocol TLS two-way authentication connection with the terminal by using a pre-stored certificate; The communication of the terminal is specifically performed by using the TLS two-way authentication connection.
The method according to claim 7, wherein after the second random code encrypted by the user private key sent by the receiving terminal, the method further comprises: sending a random private key password to the terminal.
A terminal, comprising:

a first sending module, configured to send an identity authentication request to the server; the identity authentication request includes a user identifier;

a first receiving module, configured to receive a second random code sent by the server;

And a comparison module, configured to compare the received biometric information of the user input with the pre-stored biometric information corresponding to the user identifier;

And an encryption module, configured to encrypt the second random code by using a pre-stored user private key corresponding to the user identifier;

a second sending module, configured to send the second random code encrypted by the user private key to the server.
The terminal of claim 12, further comprising:

a second receiving module, configured to receive a first random code sent by the server before sending the identity authentication request to the server;

a third sending module, configured to send the terminal identifier, the user identifier, and the first random code to the server;

a third receiving module, configured to receive biometric information recorded by the user after receiving the verification pass message sent by the server;

a key processing module, configured to generate a public-private key pair for the user, establish a correspondence between the biometric information, a terminal identifier, a user private key, and a user identifier, and send the user public key and the user identifier to The server.
The terminal according to claim 12, wherein the second sending module is configured to send the second random code encrypted by the user private key, the user identifier, and the terminal identifier to the server.
The terminal of claim 12, further comprising:

a connection establishing module, configured to establish a secure transport layer protocol TLS two-way authentication connection with the server by using a pre-stored certificate generated by the server before sending the identity authentication request to the server, where the communication with the server is specifically TLS two-way authentication connection.
The terminal according to claim 12, wherein the encryption module is specifically configured to perform verification by using a pre-stored private key password and a password of the security device if the password is consistent, and obtain the user private key stored in the security area after the verification succeeds. And encrypting the second random code according to the user private key.
The terminal of claim 16, further comprising:

a fourth receiving module, configured to: after the encrypting the second random code according to the user private key, receive a random private key password sent by the server, and modify the password according to the random private key password The password for the security device.
A server, comprising:

a first receiving unit, configured to receive an identity authentication request sent by the terminal; the identity authentication request includes a user identifier;

a first sending unit, configured to send a second random code to the terminal;

a second receiving unit, configured to receive a second random code that is sent by the terminal and encrypted by a user private key;

a decrypting unit, configured to decrypt the second random code encrypted by the user private key by using a pre-stored user public key corresponding to the user identifier;

The first authentication unit is configured to verify whether the decrypted second random code is consistent with the sent second random code, and if they are consistent, the identity authentication is passed.
The server of claim 18, further comprising:

a determining unit, configured to determine, according to the identity authentication request sent by the receiving terminal, a correspondence between the terminal identifier and the user identifier;

a second sending unit, configured to send a first random code to the terminal;

a second authentication unit, configured to perform verification after receiving the terminal identifier, the user identifier, and the first random code sent by the terminal, and send a verification pass message to the terminal after the verification is passed;

The relationship establishing unit is configured to receive the user identifier and the user public key sent by the terminal, and establish a correspondence between the user identifier, the user public key, and the terminal identifier.
The server according to claim 18, wherein the second receiving unit is specifically configured to receive a second random code, the user identifier, and a terminal identifier that are encrypted by the user and transmitted by the terminal; The decryption unit is configured to decrypt the second random code and the user identifier encrypted by the user private key by using a public key corresponding to the terminal identifier; the first authentication unit is specifically configured to verify the decrypted Whether the second random code is consistent with the transmitted second random code, and verifying the correspondence between the user identifier and the terminal identifier; If the second random code obtained by the decryption is consistent with the transmitted second random code and the terminal identifier corresponds to the user identifier, the identity authentication is passed.
The server of claim 18, further comprising:

a connection establishing unit, configured to establish a secure transport layer protocol TLS two-way authentication connection with the terminal by using a pre-stored certificate before the identity authentication request sent by the receiving terminal, and the communication with the terminal is specifically using the TLS bidirectional The authentication connection is made.
The server of claim 18, further comprising:

And a third sending unit, configured to send a random private key password to the terminal after the second random code that is sent by the receiving terminal and encrypted by the user private key.