WO2019170026A1 - 基于可穿戴设备的身份认证方法及系统 - Google Patents

基于可穿戴设备的身份认证方法及系统 Download PDF

Info

Publication number
WO2019170026A1
WO2019170026A1 PCT/CN2019/076403 CN2019076403W WO2019170026A1 WO 2019170026 A1 WO2019170026 A1 WO 2019170026A1 CN 2019076403 W CN2019076403 W CN 2019076403W WO 2019170026 A1 WO2019170026 A1 WO 2019170026A1
Authority
WO
WIPO (PCT)
Prior art keywords
user terminal
wearable device
information
distribution network
key distribution
Prior art date
Application number
PCT/CN2019/076403
Other languages
English (en)
French (fr)
Inventor
赵勇
刘春华
Original Assignee
山东量子科学技术研究院有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 山东量子科学技术研究院有限公司 filed Critical 山东量子科学技术研究院有限公司
Priority to US16/978,119 priority Critical patent/US11356442B2/en
Publication of WO2019170026A1 publication Critical patent/WO2019170026A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F1/00—Details not covered by groups G06F3/00 - G06F13/00 and G06F21/00
    • G06F1/16—Constructional details or arrangements
    • G06F1/1613—Constructional details or arrangements for portable computers
    • G06F1/163—Wearable computers, e.g. on a belt
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N10/00—Quantum computing, i.e. information processing based on quantum-mechanical phenomena
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/33—Security of mobile devices; Security of mobile applications using wearable devices, e.g. using a smartwatch or smart-glasses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]

Definitions

  • the present application relates to the field of information security authentication, and in particular, to a method and system for identity authentication based on a wearable device.
  • the existing authentication methods for mobile terminals mainly include: login and authentication through account number and password, dynamic password authentication, authentication by comparing device identification information with user equipment information pre-stored in the authentication server, but account password and dynamic password. Both the device ID and the device ID are likely to be intercepted or leaked.
  • the existing wearable device-based authentication method is generally applied to identity authentication in the process of interacting with the user terminal; and the existing wearable device authentication method often uses an encryption method based on the complexity of the mathematical algorithm in the information transmission process.
  • the security mechanism based on mathematical algorithms is easily cracked by more and more rapid development of computing technology. New algorithm vulnerabilities are constantly discovered, which is very fragile in the face of future quantum computers, making existing wearable device-based authentication methods. There are serious security risks, and it is difficult to adapt to the authentication requirements of higher security requirements.
  • the present application provides an authentication method based on a quantum key and a wearable device, which is used for account management and access authentication, and constructs a reliable authentication chain from a user to a user terminal to a target server.
  • a high security authentication mechanism is proposed.
  • the technical solution of the present application is a method for authenticating a device based on a wearable device, including the following steps:
  • S1 the user terminal initiates an authentication request to the target server and provides device information of the user terminal, the target server receives the authentication request to generate a temporary session, and sends the temporary session ID and the device information to the quantum key distribution network. ;
  • the quantum key distribution network receives the temporary session ID and device information, generates identification information, searches for a wearable device bound to the user terminal, and sends the identifier information to the wearable device.
  • the wearable device receives and provides the identifier information to the user terminal, the user terminal acquires the identifier information, sends the verification information to the wearable device, and then sends the identifier to the wearable device.
  • a quantum key distribution network
  • the quantum key distribution network receives the verification information, and generates a verification result according to the verification information, and sends the verification result to the target server;
  • the target server receives the verification result, generates an identity authentication result, and sends the result to the user terminal.
  • the device information is a device ID or a quantum identity number of the user terminal
  • the quantum identity number is a unique identifier of the entire network allocated by the quantum key distribution network for the wearable device registered in the network. After the wearable device establishes a binding relationship with the user terminal, the quantum identity number is shared by the wearable device and the user terminal bound thereto.
  • the searching for the wearable device bound to the user terminal in the step S2 includes: first, according to the device ID of the user terminal, in the quantum The key distribution network finds a corresponding quantum identity number, and then searches for a wearable device having the quantum identity number, that is, a wearable device that is bound to the user terminal; if not, the identity authentication fails;
  • the pre-stored device information in the quantum key distribution network should include at least a quantum identity number of the wearable device previously registered on the quantum key distribution network, and the user terminal bound to the wearable device Device ID.
  • the searching for the wearable device bound to the user terminal in step S2 includes: assigning the quantum key according to a quantum identity number of the user terminal
  • the device that is pre-stored in the network searches for a wearable device having the quantum identity number, that is, a wearable device that is bound to the user terminal; if not, the identity authentication fails; wherein the quantum key is
  • the device information pre-stored in the key distribution network shall contain at least the quantum identity number of the wearable device registered to the quantum key distribution network.
  • the user terminal acquiring the identifier information in the step S3, and sending the verification information to the wearable device includes: the user terminal identifying the identifier information, and acquiring the temporary session ID and device included therein And determining whether the device information included in the device is the same as the local device, and determining whether the temporary session ID included in the device corresponds to the authentication request initiated by the local device to the target server, and determining the result as the verification Information is sent to the wearable device.
  • the generating, by the quantum key distribution network, the verification result according to the verification information in the step S4 includes: if the device information and the temporary session ID are consistent in the verification information, the verification result is authentication Success, on the contrary, the verification result is an authentication failure.
  • the wearable device further collects biometric information of the user and sends the biometric identification information to the quantum key distribution network; after the quantum key distribution network receives the biometric identification information, Matching with the pre-stored biometric information; when the biometric information is successfully matched, and the device information and the temporary session ID are consistent in the verification information, the verification result is that the authentication is successful, and vice versa. The verification result is that the authentication failed.
  • the target server shares the temporary session ID with the user terminal after generating the temporary session
  • the user terminal acquiring the identification information in the step S3, and sending the verification information to the wearable device includes: the user terminal acquiring the identification information, and all temporary session IDs and local devices currently initiated by the local device Device information is sent to the wearable device as the verification information.
  • the generating the verification result according to the verification information in the step S4 includes: the quantum key distribution network, in the received temporary session ID and device information initiated by the user terminal, searching and performing the step The temporary session ID and the device information received by S2 are consistently combined. If found, the verification result is that the authentication is successful, and the verification result is that the authentication fails.
  • step S5 generates an identity authentication result
  • the sending to the user terminal includes: generating a message that the user terminal logs in to the target server for successful or failed authentication, and sends the message to the user terminal.
  • the form of the identification information is a two-dimensional code.
  • the two-dimensional code is dynamic, and after the two-dimensional code is displayed on the wearable device, if the user does not scan for a period of time, the quantum key distribution network is regenerated at intervals. A new QR code is sent to the wearable device for continuous dynamic update.
  • the first shared key is pre-stored in the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the second shared key is pre-stored in the wearable device and the quantum key distribution network for encryption and decryption of communication data between the two.
  • connection manner of the wearable device with the user terminal is a wireless or wired connection.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network, and obtain a paired third shared key between each other for the user terminal and the wearable device. Encryption and decryption of communication data between.
  • the present application further provides an identity authentication system based on a wearable device, including:
  • a user terminal configured to initiate an authentication request to the target server, provide device information of the user terminal, obtain identification information provided by the wearable device to the user terminal, send verification information to the wearable device, and receive the target The authentication result sent by the server;
  • a target server configured to receive the authentication request and generate a temporary session, send the temporary session ID and the device information to a quantum key distribution network, and receive a verification result sent by the quantum key distribution network to generate the identity
  • the authentication result is sent to the user terminal;
  • a quantum key distribution network configured to receive the temporary session ID and device information, generate the identification information, search for the wearable device bound to the user terminal, and send the identifier information to the wearable device And receiving the verification information sent by the wearable device, generating the verification result according to the verification information, and sending the verification result to the target server;
  • a wearable device configured to receive and provide the identification information to the user terminal, and receive the verification information sent by the user terminal, and send the verification information to the quantum key distribution network.
  • the device information is a device ID or a quantum identity number of the user terminal
  • the quantum identity number is a unique identifier of the entire network allocated by the quantum key distribution network for the wearable device registered in the network. After the wearable device establishes a binding relationship with the user terminal, the quantum identity number is shared by the wearable device and the user terminal bound thereto.
  • the searching for the wearable device that is bound to the user terminal includes: first, according to the device ID of the user terminal, the quantum density The key distribution network finds a corresponding quantum identity number, and then searches for a wearable device having the quantum identity number, that is, a wearable device that is bound to the user terminal; if not, the identity authentication fails;
  • the pre-stored device information in the quantum key distribution network shall include at least a quantum identity number of the wearable device previously registered on the quantum key distribution network, and a device of the user terminal bound to the wearable device ID.
  • the searching for the wearable device bound to the user terminal comprises: according to the quantum identity number of the user terminal, in the quantum key distribution network Searching for the wearable device having the quantum identity number in the pre-stored device information, that is, the wearable device bound to the user terminal; if not found, the identity authentication fails; wherein the quantum key
  • the device information pre-stored in the distribution network should contain at least the quantum identity number of the wearable device registered to the quantum key distribution network.
  • the user terminal acquiring the identifier information, and sending the verification information to the wearable device includes: identifying the identifier information, acquiring the temporary session ID and device information included therein; and determining the device included therein Whether the information is the same as the local device, and whether the temporary session ID included in the message corresponds to the authentication request initiated by the local device to the target server, and the determination result is sent to the wearable device as the verification information.
  • the manner in which the quantum key distribution network generates the verification result according to the verification information is: if the device information and the temporary session ID are consistent in the verification information, the verification result is successful authentication. On the contrary, the verification result is that the authentication fails.
  • the wearable device further collects biometric information of the user and sends the biometric identification information to the quantum key distribution network; after receiving the biometric identification information, the quantum key distribution network compares the biometric identification information with the pre-stored The biometric information is matched; when the biometric information is successfully matched, and the device information and the temporary session ID are consistent in the verification information, the verification result is that the authentication is successful, and vice versa, the verification result is the authentication. failure.
  • the target server shares the temporary session ID with the user terminal after generating the temporary session
  • the user terminal acquiring the identification information, and sending the verification information to the wearable device includes: the user terminal acquiring the identification information, and using all the temporary session IDs and local device information currently initiated by the local device as the The verification information is sent to the wearable device.
  • the generating, by the quantum key distribution network, the verification result according to the verification information comprises: searching, by the quantum key distribution network, all temporary session IDs and device information initiated by the user terminal The combination of the temporary session ID and the device information received from the target server is consistent, and if found, the verification result is that the authentication is successful, and the verification result is that the authentication fails.
  • the target server generates the identity authentication result
  • the sending to the user terminal includes: generating a message that the user terminal logs in to the target server for successful or failed authentication, and sends the message to the user terminal.
  • the form of the identification information is a two-dimensional code.
  • the two-dimensional code is dynamic, and after the two-dimensional code is displayed on the wearable device, if the user does not scan for a period of time, the quantum key distribution network is regenerated at intervals. A new QR code is sent to the wearable device for continuous dynamic update.
  • the first shared key is pre-stored in the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the second shared key is pre-stored in the wearable device and the quantum key distribution network for encryption and decryption of communication data between the two.
  • connection manner of the wearable device with the user terminal is a wireless or wired connection.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network, and obtain a paired third shared key between each other for the user terminal and the wearable device. Encryption and decryption of communication data between.
  • the present application also provides a quantum key distribution network for identity authentication:
  • the device information is provided when the user terminal initiates an authentication request to the target server.
  • the identifier information further includes a temporary session ID, where the temporary session ID is generated by the target server receiving the authentication request.
  • the verification information is sent by the user terminal to the wearable device after acquiring the identification information from the wearable device.
  • the device information is a device ID or a quantum identity number of the user terminal
  • the quantum identity number is a unique identifier of the entire network allocated by the quantum key distribution network for the wearable device registered in the network. After the wearable device establishes a binding relationship with the user terminal, the quantum identity number is shared by the wearable device and the user terminal bound thereto.
  • the searching for the wearable device bound to the user terminal includes: first, assigning the quantum key according to a device ID of the user terminal.
  • the network finds a corresponding quantum identity number, and then searches for a wearable device having the quantum identity number, that is, a wearable device that is bound to the user terminal; if not, the identity authentication fails; wherein the quantum key is
  • the device information pre-stored in the key distribution network shall contain at least the quantum identity numbers of the wearable devices previously registered to the quantum key distribution network, and the device IDs of the user terminals bound to the wearable devices.
  • the searching for the wearable device bound to the user terminal includes: pre-storing in the quantum key distribution network according to the quantum identity number of the user terminal
  • the device information is found to be a wearable device having the quantum identity number, that is, a wearable device bound to the user terminal; if not found, the identity authentication fails; wherein the quantum key distribution network
  • the pre-stored device information should contain at least the quantum identity number of the wearable device registered to the quantum key distribution network.
  • the target server shares the temporary session ID with the user terminal after generating the temporary session;
  • the verification information includes all temporary session IDs currently initiated by the user terminal and device information of the user terminal;
  • the quantum key distribution network And generating, by the quantum key distribution network, the verification result according to the verification information, that the quantum key distribution network searches for and obtains from the temporary session ID and device information initiated by the user terminal
  • the temporary session ID and the device information received by the server are consistently combined. If found, the verification result is that the authentication is successful, and the verification result is that the authentication fails.
  • the first shared key is pre-stored in the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the second shared key is pre-stored in the wearable device and the quantum key distribution network for encryption and decryption of communication data between the two.
  • the present application further provides a wearable device for identity authentication, which is bound to a user terminal:
  • the device information is provided, and the identifier information is generated according to the device information.
  • the quantum key distribution network receives device information provided when the user terminal initiates an authentication request to the target server, and the target server receives the temporary session ID generated by the authentication request, and the identifier information is according to the Generated by device information and temporary session ID.
  • the wearable device registers and stores a unique quantum identity number of the entire network in the quantum key distribution network, and has key storage, data encryption and decryption, and data transceiving functions.
  • the wearable device also collects biometric information of the user and sends it to the quantum key distribution network.
  • the form of the identification information is a two-dimensional code.
  • the second shared key is pre-stored in the wearable device and the quantum key distribution network for encryption and decryption of communication data between the two.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network, and obtain a paired third shared key between each other for the user terminal and the wearable device. Encryption and decryption of communication data between.
  • the application further provides a user terminal, which is bound to the wearable device:
  • the identification information is that the quantum key distribution network receives the user terminal
  • the identifier information further includes a temporary session ID, where the temporary session ID is generated by the target server receiving the authentication request.
  • the user terminal further receives an identity authentication result; the identity authentication result is generated by the target server based on the verification result sent by the quantum key distribution network.
  • the temporary session ID is shared with the user terminal, and the verification information includes all temporary session IDs currently initiated by the user terminal and device information of the user terminal.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network, and obtain a paired third shared key between each other for the user terminal and the wearable device. Encryption and decryption of communication data between.
  • the application also provides a target server:
  • the target server when the target server receives the authentication request sent by the user terminal, the target server further generates a temporary session ID and sends the temporary session ID to the quantum key distribution network.
  • the target server has both an identity authentication function and a function of providing service access to the user terminal; or only has an identity authentication function, and if the target server identity authentication passes, the other server provides services for the user terminal. Access function.
  • the first shared key is pre-stored in the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the present application provides an identity authentication method for a user terminal to access a third-party target server.
  • the method is based on a quantum key distribution network, which provides an authentication service interface to a third-party target server, instead of the traditional mathematical algorithm-based authentication method.
  • Quantum key encryption enhances security during the identity authentication process.
  • the application adds a wearable device in the identity authentication process. Compared with the user terminal, the wearable device is more closely bound to the specific user and has higher security. In addition, the wearable device is convenient to use and can effectively improve the user. Experience.
  • the key authentication link in this application is protected by the quantum code, so it has a strong anti-impersonation and anti-deciphering function.
  • FIG. 1 is a flowchart of a method for authenticating a device based on a wearable device according to Embodiment 1 of the present application;
  • FIG. 2 is a schematic diagram of connection and communication modes of devices in Embodiment 1 of the present application.
  • FIG. 3 is a schematic diagram of an identity authentication process in Embodiment 1 of the present application.
  • the mobile terminal referred to in the present application includes, but is not limited to, a mobile phone and a tablet.
  • the electronic device capable of network connection is applicable to the mobile terminal of the present application.
  • the wearable device described in the present application includes but is not limited to a smart ring and a smart hand. Rings, smart watches, smart necklaces and other small devices that come into contact with the human body and carry them with you.
  • FIG. 1 is a flowchart of a method for authenticating a device based on a wearable device according to Embodiment 1 of the present application. As shown in FIG. 1 , the method includes the following steps:
  • S1 the user terminal initiates an authentication request to the target server and provides device information of the user terminal, and the target server receives the authentication request to generate a temporary session, and sends the temporary session ID and device information to the quantum key distribution network;
  • the quantum key distribution network receives the temporary session ID and device information, generates identification information, searches for a wearable device bound to the user terminal, and sends the identifier information to the wearable device.
  • the wearable device receives and provides the identifier information to the user terminal, the user terminal acquires the identifier information, sends the verification information to the wearable device, and then is sent by the wearable device to the quantum key distribution network. ;
  • the quantum key distribution network receives the verification information, and generates a verification result according to the verification information, and sends the verification result to the target server;
  • the target server receives the verification result, generates an identity authentication result, and sends the result to the user terminal.
  • the target server may have the identity authentication function and provide a service access function for the user terminal; or may only have the identity authentication function, and if the target server identity authentication passes, the other server provides the service access function for the user terminal.
  • the quantum key distribution network provides an interface for the target server to establish communication with itself, and distributes a unified first shared key to itself and the target server, the first shared key being used between the quantum key distribution network and the target server Encryption and decryption of communication data; optionally, key sharing can also be achieved by other forms, such as quantum key distribution network, which is a quantum key, and then used with other relatively reliable media (such as VPN private network, mobile The storage medium is passed to the target server for sharing.
  • the wearable device registers with a quantum key distribution network that assigns a second shared key to itself and the wearable device, the second shared key being used for communication between the quantum key distribution network and the wearable device Encryption and decryption of data.
  • the registration method is: the wearable device holder (can be an individual, or the wearable device manufacturer, the seller) first go to the operation of the quantum key distribution network to register the network related procedures, quantum key distribution
  • the operating agency of the network is responsible for reviewing the user's application for network access. If the application is approved, a unique quantum identity number is assigned to each wearable device that is applied for access to the network. The quantum identity number is assigned by the quantum key distribution network. Stored in the permanent storage medium of the wearable device that is applied to the network. Since the information transmitted during each authentication process is small, the shared key with the quantum key distribution network pre-stored on the wearable device can be used for a long time even if the one-time secret is used once. If for security reasons, the shared key stored on the wearable device can be replaced periodically.
  • One method is to generate a new key by the quantum key distribution network, and encrypt the new shared key with the old shared key and deliver it to the wearable device.
  • connection between the wearable device and the user terminal is a wireless or wired connection.
  • the two can be bound and transmitted by Bluetooth, and the information can be transmitted by wire in a more stringent security environment.
  • both the user terminal and the wearable device can be registered on the quantum key distribution network in advance, and the quantum key distribution network is uniformly distributed to the two.
  • the third shared key is then used to encrypt the communication data between the user terminal and the wearable device using the third shared key.
  • the wearable device may be registered in the quantum key distribution network to obtain the quantum identity number of the wearable device, and when the wearable device is bound to a user terminal, the quantum identity number is also Shared by the user terminal, and the binding relationship is stored in a quantum key distribution network.
  • the wearable device may apply for releasing the binding relationship with the user terminal by using the vector subkey distribution network, or may apply for establishing a new binding relationship with another user terminal.
  • the device information may be a device ID of the user terminal, or may be a quantum identity number.
  • the temporary session ID is also fed back to the user terminal, that is, the temporary session ID is shared with the user terminal.
  • the method further includes: the target server encrypts the temporary session ID and the device information by using the first shared key; the first shared key is A shared key between the target server and the quantum key distribution network.
  • the receiving, by the quantum key distribution network in the step S2, the temporary session ID and the device information further includes: decrypting the first shared key by using the first shared key.
  • the step S2 searches for the wearable device that is bound to the user terminal, and specifically includes: first finding a corresponding quantum in the quantum key distribution network according to the device ID of the user terminal. The identity number is then found to be a wearable device having the quantum identity number, that is, a wearable device bound to the user terminal; if not found, the identity authentication fails.
  • the device information pre-stored in the quantum key distribution network should include at least a quantum identity number of the wearable device registered in advance on the quantum key distribution network, and a device ID of the user terminal bound to the wearable devices.
  • the device for searching for the wearable device bound to the user terminal in step S2 is a device pre-stored in the quantum key distribution network according to the quantum identity number of the user terminal.
  • the wearable device having the quantum identity number is found in the information, that is, the wearable device bound to the user terminal; if not found, the identity authentication fails.
  • the device information pre-stored in the quantum key distribution network shall include at least the quantum identity number of the wearable device registered to the quantum key distribution network.
  • the sending the identification information to the wearable device in the step S2 further includes: encrypting the identification information by using a second shared key; and the second shared key is sharing between the wearable device and the quantum key distribution network. Key.
  • the receiving, by the wearable device, the identifier information in the step S3 further includes: decrypting the second shared key by using the second shared key;
  • the user terminal acquires the identification information in the step S3, and the sending the verification information to the wearable device includes: the user terminal identifying the identification information, acquiring the temporary session ID and device information contained therein; determining the device information contained therein Whether it is the same as the local device, and whether the temporary session ID included in the device corresponds to the authentication request initiated by the local device to the target server, and the result of the determination is sent to the wearable device as the verification information.
  • the method further includes: the wearable device encrypts the verification information by using the second shared key.
  • the receiving, by the quantum key distribution network in the step S4, the verification information further includes: the quantum key distribution network decrypting the encrypted verification information by using the second shared key.
  • the step of generating the verification result according to the verification information in the step S4 includes: if the device information and the temporary session ID in the verification information are consistent, the verification result is that the authentication is successful, and vice versa, the verification result is the authentication failure.
  • the method further comprises: the quantum key distribution network encrypting the verification result by using the first shared key.
  • the receiving, by the target server, the verification result in the step S5 further includes: decrypting the encrypted verification result by using a first shared key.
  • the step S5 generates an identity authentication result, and the sending to the user terminal includes: generating a message that the user terminal logs in to the target server for successful or failed authentication, and sends the message to the user terminal.
  • the message of successful authentication may also include, but is not limited to, any one or more of a token token, an expiration time, and a redirect address.
  • the temporary session ID is used only once, and once the identity authentication process ends, it is not reused whether it is successful or not.
  • the temporary session IDs created each time are different.
  • the identification information is in the form of a two-dimensional code
  • the user terminal optically acquires information contained therein; when the identification information is information in other digital forms, the user terminal may also use other methods, such as wireless. , Bluetooth, infrared, sound waves, etc. to obtain the information contained in it.
  • the identification information may be dynamic. Taking the two-dimensional code form as an example, after the two-dimensional code is generated on the wearable device, the user is scanned, and if the user does not scan for a period of time, the quantum key distribution network will be every other segment. Time regenerates a new QR code and sends it to the wearable device for continuous dynamic update using the quantum key shared with the wearable device.
  • the wearable device in step S3 also collects biometric information of the user and sends it to the quantum key distribution network.
  • the quantum key distribution network in step S4 matches the pre-stored biometric information; when the biometric identification information is successfully matched, and the device information in the verification information corresponds to the temporary session ID. When they are consistent, the verification result of the successful authentication is generated.
  • a simplified solution of the step S3 is that the user terminal directly sends the verification information to the quantum key distribution network. This simplification requires the user terminal to pre-set a shared key with the quantum key distribution network.
  • the user terminal acquiring the identifier information in the step S3, and sending the verification information to the wearable device includes: acquiring, by the user terminal, the identifier information, and all temporary session IDs currently initiated by the local device.
  • the device information of the device and the device are sent to the wearable device as verification information.
  • the generating the verification result according to the verification information in the step S4 comprises: the quantum key distribution network, in the received temporary session ID and device information initiated by the user terminal, searching and receiving in the step S2 The temporary session ID and device information are consistently combined. If found, the verification result is successful authentication, and the verification result is authentication failure.
  • the user terminal accesses the target server and informs the server of his identity.
  • the target server generates a temporary session for this login.
  • the target server vector subkey distribution network applies for authorization authentication, and encrypts the information about the temporary session and the identity of the user terminal with the shared quantum key between the quantum key distribution network, and then transmits the information to the quantum key distribution network.
  • the quantum key distribution network decrypts and restores the information after receiving it.
  • the quantum key distribution network internally searches for the identity of the registrant, and sends a verification two-dimensional code as identification information to the wearable device having the identity, the two-dimensional code containing relevant information identifying the temporary session and identifying the user terminal.
  • Device information The identification information is encrypted and transmitted using a shared quantum key preset between the wearable devices. The wearable device decrypts the restored information after receiving it.
  • the user terminal scans the two-dimensional code to optically acquire the information therein.
  • the user terminal determines, according to the obtained information, whether the identity authentication request included in the two-dimensional code is submitted by the local device, and generates verification information according to the generated information, and sends the verification information to the wearable device.
  • the wearable device encrypts the verification information with a quantum key shared with the quantum key distribution network and transmits it to the quantum key distribution network. After the quantum key distribution network decrypts, the verification information is obtained, and the verification result is generated accordingly.
  • the quantum key distribution network encrypts the verification result using the shared quantum key with the target server and sends it to the target server.
  • the target server decrypts and gets the verification result.
  • the target server generates a final identity authentication result according to the verification result, and sends the result to the user terminal. After the certification is completed, all the intermediate process information generated in the identity verification process will be invalid immediately.
  • the identity authentication of this application is particularly suitable for complex applications.
  • the same user terminal sends two or more authentication requests in a short period of time (for example, applying for authorization to the target server A, and then immediately applying for authorization to the target server B), for the quantum key distribution network.
  • the temporary session ID is used to distinguish the accuracy of the identity authentication guaranteed by two different authentication processes.
  • the user terminal initiates an authentication request, and before the authentication request is received (ie, before the authentication passes or fails), another authentication request cannot be initiated, that is, within one time period, one user equipment only There will be an authentication request and no temporary session ID is required for identification. At this time, it is only necessary to use the device information of the user terminal to identify the identity of the temporary session. Specifically, the following steps are included:
  • S1 the user terminal initiates an authentication request to the target server and provides device information of the user terminal, and the target server receives the authentication request to generate a temporary session, and sends the device information to the quantum key distribution network.
  • the quantum key distribution network receives the device information, generates identification information, searches for a wearable device bound to the user terminal, and sends the identifier information to the wearable device.
  • the wearable device receives and provides the identifier information to the user terminal, and the user terminal acquires the device information according to the identifier information; determines whether the device information is the same as the local device, and sends the determination result as the verification information to the wearable device.
  • the device is then sent by the wearable device to a quantum key distribution network;
  • the quantum key distribution network receives the verification information, and generates a verification result according to the verification information and sends the verification result to the target server. If the device information in the verification information is consistent, the verification result is that the authentication is successful, and vice versa, the verification result is the authentication failure.
  • the target server receives the verification result, generates an identity authentication result, and sends the result to the user terminal.
  • the present application further provides an identity authentication system based on a wearable device, including:
  • a user terminal configured to initiate an authentication request to the target server, provide device information of the user terminal, obtain identification information provided by the wearable device to the user terminal, send verification information to the wearable device, and receive an identity sent by the target server. Certification result;
  • a target server configured to receive the authentication request and generate a temporary session, send the temporary session ID and device information to the quantum key distribution network, and receive the verification result sent by the quantum key distribution network, generate an identity authentication result, and send the result to the user. terminal;
  • a quantum key distribution network configured to receive the temporary session ID and device information, generate identification information, find a wearable device bound to the user terminal, send the identification information to the wearable device, and receive the The verification information sent by the wearable device is sent to the target server according to the verification information generated verification result;
  • the wearable device is configured to receive and provide the identification information to the user terminal, and receive the verification information sent by the user terminal, and send the information to the quantum key distribution network.
  • the target server may have the identity authentication function and provide a service access function for the user terminal; or may only have the identity authentication function, and if the target server identity authentication passes, the other server provides the service access function for the user terminal.
  • the device information is a device ID or a quantum identity number of the user terminal, where the quantum identity number is a unique identifier of the entire network allocated by the quantum key distribution network for the wearable device registered in the network, and the wearable device is After the user terminal establishes the binding relationship, the quantum identity number is shared by the wearable device and the user terminal bound thereto.
  • the temporary session ID is also fed back to the user terminal, that is, the temporary session ID is shared with the user terminal.
  • a manner of searching for a wearable device bound to the user terminal includes: first finding a corresponding quantum identity number in the quantum key distribution network according to the device ID of the user terminal, and then searching for the quantum identity number;
  • the wearable device is a wearable device that is bound to the user terminal; if not found, the identity authentication fails.
  • the device information pre-stored in the quantum key distribution network should include at least a quantum identity number of the wearable device registered in advance on the quantum key distribution network, and a device ID of the user terminal bound to the wearable devices.
  • another manner of searching for the wearable device bound to the user terminal includes: searching for the wearable device having the quantum identity number in the device information pre-stored in the quantum key distribution network according to the quantum identity number of the user terminal.
  • the device is a wearable device that is bound to the user terminal; if the device cannot be found, the identity authentication fails.
  • the pre-stored device information in the quantum key distribution network should include at least a quantum identity number of the wearable device registered to the quantum key distribution network.
  • the user terminal acquires the identifier information
  • the sending the verification information to the wearable device includes: identifying the identifier information, acquiring the temporary session ID and device information included therein; determining the device information and the local device included therein Whether it is the same, and whether the temporary session ID included therein corresponds to the authentication request initiated by the local machine to the target server, and the judgment result is sent to the wearable device as the verification information.
  • the manner in which the quantum key distribution network generates the verification result according to the verification information is: if the device information and the temporary session ID in the verification information are consistent, the verification result is that the authentication is successful, and vice versa, the verification result is the authentication failure.
  • the wearable device further collects biometric information of the user and sends the biometric information to the quantum key distribution network; after receiving the biometric information, the quantum key distribution network and the pre-stored biometric information The matching is performed.
  • the biometric information is successfully matched, and the device information and the temporary session ID in the verification information are consistent, the verification result of the successful authentication is generated.
  • the user terminal acquiring the identifier information, and sending the verification information to the wearable device includes: acquiring, by the user terminal, the identifier information, and all temporary session IDs and local devices currently initiated by the local device.
  • the device information is sent to the wearable device as verification information.
  • generating, by the quantum key distribution network, the verification result according to the verification information comprising: the quantum key distribution network searching, in the received temporary session ID and device information initiated by the user terminal, the information received from the target server The temporary session ID and device information are consistently combined. If found, the verification result is that the authentication is successful, and the verification result is that the authentication fails.
  • the target server generates an identity authentication result
  • the sending to the user terminal includes: generating a message that the user terminal login target server authentication succeeds or fails, and sends the message to the user terminal.
  • the form of the identification information may be a two-dimensional code.
  • the two-dimensional code is dynamic. After the two-dimensional code is displayed on the wearable device, if the user does not scan for a period of time, the quantum key distribution network regenerates a new two-dimensional code and sends it to the wearable device.
  • the communication connection mode between the devices is:
  • the user terminal accesses the target server.
  • the first shared key is pre-stored in both the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the second shared key is pre-stored in both the wearable device and the quantum key distribution network for encryption and decryption of communication data between the two.
  • connection between the wearable device and the user terminal is a wireless or wired connection.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network to obtain a paired third shared key between each other for communication data between the user terminal and the wearable device. Encryption and decryption.
  • the user terminal initiates an authentication request, and before the authentication request is received (ie, before the authentication passes or fails), another authentication request cannot be initiated, that is, within one time period, one user equipment only There will be an authentication request and no temporary session ID is required for identification. At this time, it is only necessary to use the device information of the user terminal to identify the identity of the temporary session.
  • the system includes:
  • a user terminal configured to initiate an authentication request to the target server, and provide device information of the user terminal, and obtain identification information that is provided by the wearable device to the user terminal, where the user terminal acquires device information according to the identifier information; and determines the device information and Whether the locality is the same, sending the judgment result as verification information to the wearable device, and receiving the identity authentication result sent by the target server;
  • a target server configured to receive the authentication request and generate a temporary session, send the device information to the quantum key distribution network, and receive the verification result sent by the quantum key distribution network, generate an identity authentication result, and send the result to the user terminal;
  • a quantum key distribution network configured to receive the device information, generate identification information, find a wearable device bound to the user terminal, send the identification information to the wearable device, and receive the sent by the wearable device
  • the verification information is sent to the target server according to the verification information. Specifically, if the device information in the verification information is consistent, the verification result is that the authentication is successful, and vice versa, the verification result is that the authentication fails.
  • the wearable device is configured to receive and provide the identification information to the user terminal, and receive the verification information sent by the user terminal, and send the information to the quantum key distribution network.
  • the embodiment further provides a quantum key distribution network for identity authentication, including:
  • the device information is a device ID or a quantum identity number of the user terminal, where the quantum identity number is a unique identifier of the entire network allocated by the quantum key distribution network for the wearable device registered in the network, and the wearable device is After the user terminal establishes the binding relationship, the quantum identity number is shared by the wearable device and the user terminal bound thereto.
  • the method for searching for a wearable device bound to a user terminal includes: first finding a corresponding quantum identity number in a quantum key distribution network according to a device ID of the user terminal, and then searching for a quantum identity number;
  • the wearable device is a wearable device that is bound to the user terminal; if not found, the identity authentication fails.
  • the device information pre-stored in the quantum key distribution network should include at least a quantum identity number of the wearable device registered in advance on the quantum key distribution network, and a device ID of the user terminal bound to the wearable devices.
  • the method for searching for the wearable device bound to the user terminal includes: searching for the wearable device having the quantum identity number in the device information pre-stored in the quantum key distribution network according to the quantum identity number of the user terminal, That is, the wearable device is bound to the user terminal; if it cannot be found, the identity authentication fails.
  • the pre-stored device information in the quantum key distribution network should include at least a quantum identity number of the wearable device registered to the quantum key distribution network.
  • the target server shares a temporary session ID with the user terminal after generating the temporary session; the verification information includes all temporary session IDs currently initiated by the user terminal and device information of the user terminal; and the quantum key distribution network is verified according to the verification
  • the information generation verification result includes: the quantum key distribution network searches for a combination of the temporary session ID and the device information received by the user terminal, and the combination of the temporary session ID and the device information received from the target server. If found, the verification result is that the authentication is successful, and the verification result is that the authentication fails.
  • the first shared key is pre-stored in both the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the second shared key is pre-stored in both the wearable device and the quantum key distribution network for encrypting and decrypting the communication data between the two.
  • the user terminal initiates an authentication request, and before the authentication request is received (ie, before the authentication passes or fails), another authentication request cannot be initiated, that is, within one time period, one user equipment only There will be an authentication request and no temporary session ID is required for identification. At this time, it is only necessary to use the device information of the user terminal to identify the identity of the temporary session.
  • the quantum key distribution network :
  • the wearable device And receiving the verification information sent by the wearable device, and generating the verification result according to the verification information, and sending the verification result to the target server, where the verification information is sent by the user terminal to the wearable device after acquiring the identification information from the wearable device. If the device information in the verification information is consistent, the verification result is that the authentication succeeds. Otherwise, the verification result is that the authentication fails.
  • the embodiment further provides a wearable device for identity authentication, which is bound to the user terminal, and includes:
  • the identifier information is device information provided when the quantum key distribution network receives the authentication request from the user terminal to the target server, and the temporary information generated by the target server to receive the authentication request a session ID, generated according to the device information and the temporary session ID;
  • the wearable device registers and stores a unique quantum identity number of the entire network in the quantum key distribution network, and has key storage, data encryption and decryption, and data transceiving functions.
  • the identifier information is in the form of a two-dimensional code.
  • the wearable device also collects biometric information of the user and sends it to the quantum key distribution network.
  • the second shared key is pre-stored in both the wearable device and the quantum key distribution network for encrypting and decrypting the communication data between the two.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network to obtain a paired third shared key between each other for encryption and decryption of communication data between the user terminal and the wearable device.
  • the user terminal initiates an authentication request, and before the authentication request is received (ie, before the authentication passes or fails), another authentication request cannot be initiated, that is, within one time period, one user equipment only There will be an authentication request and no temporary session ID is required for identification. At this time, it is only necessary to use the device information of the user terminal to identify the identity of the temporary session.
  • the wearable device is bound to the user terminal, and includes:
  • the identifier information sent by the quantum key distribution network where the identifier information is generated according to the device information provided when the quantum key distribution network receives the user terminal to initiate an authentication request to the target server;
  • the embodiment further provides a user terminal, which is bound to the wearable device, and includes:
  • identification information from the wearable device, transmitting verification information to the wearable device, and transmitting to the quantum key distribution network for authentication to obtain a verification result; wherein the identification information is a quantum key distribution network receiving the user terminal to the target
  • the device information provided when the server initiates the authentication request, and the temporary session ID generated by the target server receiving the authentication request, generated according to the device information and the temporary session ID;
  • the identity authentication result is generated by the target server based on the verification result sent by the quantum key distribution network.
  • the target server shares a temporary session ID with the user terminal after the temporary session is generated.
  • the verification information includes all temporary session IDs currently initiated by the user terminal and device information of the user terminal.
  • both the user terminal and the wearable device are pre-registered with the quantum key distribution network to obtain a paired third shared key between each other for encryption and decryption of communication data between the user terminal and the wearable device.
  • the user terminal initiates an authentication request, and before the authentication request is received (ie, before the authentication passes or fails), another authentication request cannot be initiated, that is, within one time period, one user equipment only There will be an authentication request and no temporary session ID is required for identification. At this time, it is only necessary to use the device information of the user terminal to identify the identity of the temporary session.
  • the user terminal is bound to the wearable device, and includes:
  • the device information is provided when the user terminal initiates an authentication request to the target server.
  • the identity authentication result is generated by the target server based on the verification result sent by the quantum key distribution network.
  • the embodiment further provides a target server, including:
  • the authentication result sent by the quantum key distribution network is sent to the user terminal.
  • the target server has the functions of the identity authentication function and the service access for the user terminal; or only the identity authentication function. If the target server identity authentication is passed, the other server provides the service access function for the user terminal.
  • the first shared key is pre-stored in both the quantum key distribution network and the target server for encryption and decryption of communication data between the two.
  • the user terminal initiates an authentication request, and before the authentication request is received (ie, before the authentication passes or fails), another authentication request cannot be initiated, that is, within one time period, one user equipment only There will be an authentication request and no temporary session ID is required for identification. At this time, it is only necessary to use the device information of the user terminal to identify the identity of the temporary session.
  • the target server includes:
  • the authentication result sent by the quantum key distribution network is sent to the user terminal.
  • the authentication of the user identity replaces the encryption method based on the complexity of the mathematical algorithm with the one-time symmetric quantum key, which improves the security; the wearable device is involved in the login authentication of the target server, and the user experience is enhanced; The combination of quantum cryptography and wearable devices greatly improves the reliability of identity authentication between devices and devices, between people and devices. As a result, a complete and reliable authentication link from the person (user) to the remote service server was established, paving the way for the “last mile”.
  • Quantum keys are used in a single secret. However, if the security requirement is lowered, the key usage mode is no longer strictly followed by one secret, or on the basis of this embodiment, the quantum key is replaced by another key, and such a modification should also be regarded as a proposal of the present application. protected range.
  • modules or steps of the present application can be implemented by a general-purpose computer device. Alternatively, they can be implemented by program code executable by the computing device, so that they can be stored in the storage.
  • the devices are implemented by computing devices, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. This application is not limited to any specific combination of hardware and software.

Abstract

本申请公开了一种基于可穿戴设备的身份认证方法，包括：用户终端向目标服务器发起认证请求并提供所述用户终端的设备信息，目标服务器生成临时会话，将临时会话ID和设备信息发送至量子密钥分配网络；量子密钥分配网络生成标识信息，查找与用户终端绑定的可穿戴设备，向该可穿戴设备发送标识信息；所述可穿戴设备接收并向用户终端提供所述标识信息，用户终端获取所述标识信息，向所述可穿戴设备发送验证信息，继而发送至量子密钥分配网络；所述量子密钥分配网络根据验证信息生成验证结果发送至目标服务器；所述目标服务器生成身份认证结果，发送至用户终端。本申请的技术方案提高了身份认证的安全性和可靠性。

Description

基于可穿戴设备的身份认证方法及系统
本申请要求于2018年03月09日提交中国专利局、申请号为201810194979.9、发明名称为“基于可穿戴设备的身份认证方法及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及信息安全认证领域，具体涉及一种基于可穿戴设备的身份认证方法及系统。
背景技术
随着移动互联网的迅速发展，企事业单位内部业务网站也逐步向移动终端方向发展，为了便于工作人员随时了解工作内容，用户希望能够通过便携的移动终端来访问单位内部网站服务器。若身份认证存在漏洞会导致数据的泄露，会为企业带来不可挽回的后果，因此，安全可靠的登录认证方法是非常必要的。现有的对移动终端的认证方式主要有：通过账号和密码登录认证、通过动态口令认证、通过将设备标识信息与认证服务器中预存的用户设备信息比对进行认证等，但账号密码、动态口令和设备ID都存在被截获或泄露的可能。随着可穿戴设备的普及，已有很多将可穿戴设备引入到身份认证技术中的相关技术，有将普通密码技术与可穿戴设备的结合的认证技术，也有生物识别技术与可穿戴设备的结合认证技术。例如《一种可穿戴设备的认证方法》(申请号：201510598684.4)，该方法引入伪随机函数、异或运算和单向认证函数等轻量级算子实现智能手机与可穿戴设备的相互认证，在智能手机与可穿戴设备交互过程中，可穿戴设备的伪身份标识符和预共享密值等敏感数据通过匿名的方式进行传输，保证交互数据的安全性，同时引入动态更新机制，提高了会话周期的新鲜性和随机性，避免恶意攻击者进行重放、假冒等攻击；《通过穿戴式设备进行认证的方法和穿戴式设备》(申请号：201310190418.9)根据生物特征获取用户的身份认证信息，并通过穿戴式设备将身份认证信息发送至终端进行认证；还有《基于可穿戴设备的认证支付方法以及支付认证系统》(申请号：201410295802.X)也是通过增加对可穿戴设备的认证进一步提高支付的安全 性。
但是，现有的基于可穿戴设备的认证方式通常应用于与用户终端交互过程中的身份认证；并且现有的可穿戴设备认证方式在信息传输过程中往往使用基于数学算法复杂度的加密方式，而基于数学算法的保密机制容易被越来越快速发展的计算技术所破解，新的算法漏洞被不断发现，在未来的量子计算机面前更是非常脆弱，使得现有的基于可穿戴设备的认证方式存在严重的安全隐患，难以适应较高安全要求的身份认证场合。
因此，如何在借助可穿戴设备的条件下，提高移动终端登录目标服务器的身份认证安全性是目前需要本领域技术人员迫切解决的技术问题。
发明内容
为了解决上述问题，本申请提供了一种基于量子密钥与可穿戴设备的认证方法，用于账户管理及访问身份认证，构建了从使用者到用户终端、再到目标服务器的可靠认证链条，提出了一种高安全性的认证机制。
本申请的技术方案为一种基于可穿戴设备的身份认证方法，包括以下步骤：
S1：用户终端向目标服务器发起认证请求并提供所述用户终端的设备信息，所述目标服务器接收所述认证请求生成临时会话，并将临时会话ID和所述设备信息发送至量子密钥分配网络；
S2：所述量子密钥分配网络接收所述临时会话ID和设备信息，生成标识信息，查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
S3：所述可穿戴设备接收并向所述用户终端提供所述标识信息，所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息，然后由所述可穿戴设备发送至所述量子密钥分配网络；
S4：所述量子密钥分配网络接收所述验证信息，根据所述验证信息生成验证结果发送至所述目标服务器；
S5：所述目标服务器接收所述验证结果，生成身份认证结果，发送至所述用户终端。
进一步地，所述设备信息是所述用户终端的设备ID或量子身份号，所述量子身份号是所述量子密钥分配网络为注册入网的所述可穿戴设备分配的全网唯一的身份标识，所述可穿戴设备与所述用户终端建立绑定关系后，所述量子身份号由所述可穿戴设备及与其绑定的所述用户终端所共享。
进一步地，当所述设备信息是所述用户终端的设备ID时，所述步骤S2中查找与所述用户终端绑定的可穿戴设备包括：首先根据所述用户终端的设备ID在所述量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的所述可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的所述用户终端的设备ID。
进一步地，当所述设备信息是量子身份号时，所述步骤S2中查找与所述用户终端绑定的可穿戴设备包括：根据所述用户终端的量子身份号，在所述量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含注册到所述量子密钥分配网络的所述可穿戴设备的量子身份号。
进一步地，所述步骤S3中所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：所述用户终端识别所述标识信息，获取其中包含的所述临时会话ID和设备信息；判断其中包含的所述设备信息与本机是否相同，以及判断其中包含的所述临时会话ID是否对应本机此前向所述目标服务器发起的所述认证请求，将判断结果作为所述验证信息发送至所述可穿戴设备。
进一步地，所述步骤S4中所述量子密钥分配网络根据所述验证信息生成验证结果包括：若所述验证信息中所述设备信息和临时会话ID均对应一致，则所述验证结果为认证成功，反之，所述验证结果为认证失败。
进一步地，所述步骤S3中所述可穿戴设备还采集用户的生物识别信息，并将其发送至所述量子密钥分配网络；所述量子密钥分配网络接收到所述生物识别信息后，将其与预存的生物识别信息进行匹配；当所述生物识别信息匹配成功，且所述验证信息中所述设备信息和临时会话ID均对应一致时，所述验 证结果为认证成功，反之，所述验证结果为认证失败。
进一步地，所述目标服务器生成所述临时会话后与所述用户终端共享所述临时会话ID；
所述步骤S3中所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：所述用户终端获取所述标识信息，将本机当前发起的所有临时会话ID和本机的设备信息作为所述验证信息发送至所述可穿戴设备。
进一步地，所述步骤S4中根据所述验证信息生成验证结果包括：所述量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与所述步骤S2接收到的临时会话ID和设备信息均对应一致的组合，如果找到则所述验证结果为认证成功，反之所述验证结果为认证失败。
进一步地，所述步骤S5中生成身份认证结果，发送至所述用户终端包括：生成所述用户终端登录所述目标服务器认证成功或失败的消息，发送至所述用户终端。
进一步地，所述标识信息的形式为二维码。
进一步地，所述二维码是动态的，所述可穿戴设备上显示所述二维码后，如果用户在一段时间内没有扫描，则所述量子密钥分配网络会每隔一段时间重新生成一次新的二维码，并下发到所述可穿戴设备上进行不断动态更新。
进一步地，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
进一步地，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
进一步地，所述可穿戴设备与所述用户终端的连接方式为无线或有线连接。
进一步地，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
根据本申请的第二方面，本申请还提供了一种基于可穿戴设备的身份认证系统，包括：
用户终端，用于向目标服务器发起认证请求并提供所述用户终端的设备信 息，获取可穿戴设备向所述用户终端提供的标识信息，向所述可穿戴设备发送验证信息，以及接收所述目标服务器发送的身份认证结果；
目标服务器，用于接收所述认证请求并生成临时会话，将临时会话ID和所述设备信息发送至量子密钥分配网络，以及接收所述量子密钥分配网络发送的验证结果，生成所述身份认证结果，发送至所述用户终端；
量子密钥分配网络，用于接收所述临时会话ID和设备信息，生成所述标识信息，查找与所述用户终端绑定的所述可穿戴设备，向所述可穿戴设备发送所述标识信息，以及接收所述可穿戴设备发送的所述验证信息，根据所述验证信息生成所述验证结果发送至所述目标服务器；
可穿戴设备，用于接收并向所述用户终端提供所述标识信息，以及接收所述用户终端发送的所述验证信息，发送至所述量子密钥分配网络。
进一步地，所述设备信息是所述用户终端的设备ID或量子身份号，所述量子身份号是所述量子密钥分配网络为注册入网的所述可穿戴设备分配的全网唯一的身份标识，所述可穿戴设备与所述用户终端建立绑定关系后，所述量子身份号由所述可穿戴设备及与其绑定的所述用户终端所共享。
进一步地，当所述设备信息是所述用户终端的设备ID时，所述查找与所述用户终端绑定的所述可穿戴设备包括：首先根据所述用户终端的设备ID在所述量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的所述可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的所述用户终端的设备ID。
进一步地，当所述设备信息是量子身份号时，所述查找与所述用户终端绑定的所述可穿戴设备包括：根据所述用户终端的量子身份号，在所述量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含注册到所述量子密钥分配网络的所述可穿戴设备的量子身份号。
进一步地，所述用户终端获取所述标识信息，向所述可穿戴设备发送验证 信息包括：识别所述标识信息，获取其中包含的所述临时会话ID和设备信息；判断其中包含的所述设备信息与本机是否相同，以及判断其中包含的所述临时会话ID是否对应本机此前向所述目标服务器发起的所述认证请求，将判断结果作为所述验证信息发送至所述可穿戴设备。
进一步地，所述量子密钥分配网络根据所述验证信息生成所述验证结果的方式为：若所述验证信息中所述设备信息和临时会话ID均对应一致，则所述验证结果为认证成功，反之，所述验证结果为认证失败。
进一步地，所述可穿戴设备还采集用户的生物识别信息，并将其发送至所述量子密钥分配网络；所述量子密钥分配网络接收到所述生物识别信息后，将其与预存的生物识别信息进行匹配；当所述生物识别信息匹配成功，且所述验证信息中所述设备信息和临时会话ID均对应一致时，所述验证结果为认证成功，反之，所述验证结果为认证失败。
进一步地，所述目标服务器生成所述临时会话后与所述用户终端共享所述临时会话ID；
所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：所述用户终端获取所述标识信息，将本机当前发起的所有临时会话ID和本机的设备信息作为所述验证信息发送至所述可穿戴设备。
进一步地，所述量子密钥分配网络根据所述验证信息生成所述验证结果包括：所述量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与自所述目标服务器接收到的临时会话ID和设备信息均对应一致的组合，如果找到则所述验证结果为认证成功，反之所述验证结果为认证失败。
进一步地，所述目标服务器生成所述身份认证结果，发送至所述用户终端包括：生成所述用户终端登录所述目标服务器认证成功或失败的消息，发送至所述用户终端。
进一步地，所述标识信息的形式为二维码。
进一步地，所述二维码是动态的，所述可穿戴设备上显示所述二维码后，如果用户在一段时间内没有扫描，则所述量子密钥分配网络会每隔一段时间重新生成一次新的二维码，并下发到所述可穿戴设备上进行不断动态更新。
进一步地，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
进一步地，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
进一步地，所述可穿戴设备与所述用户终端的连接方式为无线或有线连接。
进一步地，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
根据本申请的第三方面，本申请还提供了一种用于身份认证的量子密钥分配网络：
接收用户终端的设备信息，生成标识信息；
查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
以及接收所述可穿戴设备发送的验证信息，根据所述验证信息生成验证结果。
进一步地，所述设备信息是用户终端向目标服务器发起认证请求时提供的。
进一步地，所述标识信息还包括临时会话ID，所述临时会话ID是所述目标服务器接收所述认证请求生成的。
进一步地，所述验证信息是所述用户终端从所述可穿戴设备获取所述标识信息后向所述可穿戴设备发送的。
进一步地，所述设备信息是所述用户终端的设备ID或量子身份号，所述量子身份号是所述量子密钥分配网络为注册入网的所述可穿戴设备分配的全网唯一的身份标识，所述可穿戴设备与所述用户终端建立绑定关系后，所述量子身份号由所述可穿戴设备及与其绑定的所述用户终端所共享。
进一步地，当所述设备信息是所述用户终端的设备ID时，所述查找与所述用户终端绑定的可穿戴设备包括：首先根据所述用户终端的设备ID在所述量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可 穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的所述可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的所述用户终端的设备ID。
进一步地，当所述设备信息是量子身份号时，所述查找与所述用户终端绑定的可穿戴设备包括：根据所述用户终端的量子身份号，在所述量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含注册到所述量子密钥分配网络的所述可穿戴设备的量子身份号。
进一步地，所述目标服务器生成临时会话后与所述用户终端共享所述临时会话ID；所述验证信息包括所述用户终端当前发起的所有临时会话ID和所述用户终端的设备信息；
所述量子密钥分配网络根据所述验证信息生成验证结果包括：所述量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与自所述目标服务器接收到的临时会话ID和设备信息均对应一致的组合，如果找到则所述验证结果为认证成功，反之所述验证结果为认证失败。
进一步地，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
进一步地，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
根据本申请的第四方面，本申请还提供了一种用于身份认证的可穿戴设备，与用户终端绑定：
向所述用户终端提供量子密钥分配网络发送的标识信息；
接收所述用户终端获取所述标识信息后发送的验证信息，继而发送至所述量子密钥分配网络进行认证。
进一步地，所述用户终端向目标服务器发起认证请求时提供设备信息，所述标识信息是根据所述设备信息生成的。
进一步地，所述量子密钥分配网络接收所述用户终端向目标服务器发起认 证请求时提供的设备信息，以及所述目标服务器接收所述认证请求生成的临时会话ID，所述标识信息是根据所述设备信息和临时会话ID生成的。
进一步地，所述可穿戴设备在所述量子密钥分配网络注册并存储有全网独一无二的量子身份号，具有密钥存储及数据加解密和数据收发功能。
进一步地，所述可穿戴设备还采集用户的生物识别信息，并将其发送至所述量子密钥分配网络。
进一步地，所述标识信息的形式为二维码。
进一步地，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
进一步地，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
根据本申请的第五方面，本申请还提供了一种用户终端，与可穿戴设备绑定：
向目标服务器发起认证请求并提供所述用户终端的设备信息；
从所述可穿戴设备获取标识信息，向所述可穿戴设备发送验证信息继而发送至量子密钥分配网络进行认证得到验证结果；所述标识信息是所述量子密钥分配网络接收所述用户终端向所述目标服务器发起所述认证请求时提供的所述设备信息，根据所述设备信息生成的。
进一步地，所述标识信息还包括临时会话ID，所述临时会话ID是所述目标服务器接收所述认证请求生成的。
进一步地，所述用户终端还接收身份认证结果；所述身份认证结果是所述目标服务器基于所述量子密钥分配网络发送的所述验证结果生成的。
进一步地，所述目标服务器生成临时会话后与所述用户终端共享所述临时会话ID，所述验证信息包括所述用户终端当前发起的所有临时会话ID和所述用户终端的设备信息。
进一步地，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
根据本申请的第六方面，本申请还提供了一种目标服务器：
接收用户终端发送的认证请求，将所述设备信息发送至量子密钥分配网络；
将所述量子密钥分配网络发送的认证结果发送至所述用户终端。
进一步地，所述目标服务器接收用户终端发送的认证请求时，还生成临时会话ID，发送至量子密钥分配网络。
进一步地，所述目标服务器兼具身份认证功能和为所述用户终端提供业务访问的功能；或仅具备身份认证功能，若所述目标服务器身份认证通过，由其他服务器为所述用户终端提供业务访问功能。
进一步地，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
本申请的有益效果
本申请提供了一种用户终端访问第三方目标服务器的身份认证方法，该方法基于量子密钥分配网络，它向第三方目标服务器提供认证服务接口，以代替传统的基于数学算法的认证方式，采用量子密钥加密，提升了身份认证过程中的安全性。
本申请在身份认证过程中加入了可穿戴设备，相比于用户终端，可穿戴设备与具体使用者的身份绑定更加紧密，安全性更高；另外，可穿戴设备使用方便，能有效提高用户体验。
本申请中关键认证环节被量子密码所保护，因此具有极强的抗冒充身份、抗破译的功能。
附图说明
构成本申请的一部分的说明书附图用来提供对本申请的进一步理解，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。
图1为本申请实施例1中的基于可穿戴设备的身份认证方法流程图；
图2为本申请实施例1中的各设备连接和通信方式示意图；
图3为本申请实施例1中的身份认证过程示意图。
具体实施方式
应该指出，以下详细说明都是例示性的，旨在对本申请提供进一步的说明。除非另有指明，本文使用的所有技术和科学术语具有与本申请所属技术领域的普通技术人员通常理解的相同含义。
需要注意的是，这里所使用的术语仅是为了描述具体实施方式，而非意图限制根据本申请的示例性实施方式。如在这里所使用的，除非上下文另外明确指出，否则单数形式也意图包括复数形式，此外，还应当理解的是，当在本说明书中使用术语“包含”和/或“包括”时，其指明存在特征、步骤、操作、器件、组件和/或它们的组合。
在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本申请中所称的移动终端包括但不限于手机、平板，能够进行网络连接的电子设备均适用于本申请的移动终端；本申请中所述的可穿戴设备包括但不限于智能戒指、智能手环、智能手表、智能项链等与人体接触及随身携带的小型设备。
实施例1
图1为本申请实施例1提供的基于可穿戴设备的身份认证方法流程图，如图1所示，包括以下步骤：
S1：用户终端向目标服务器发起认证请求并提供所述用户终端的设备信息，目标服务器接收所述认证请求生成临时会话，并将临时会话ID和设备信息发送至量子密钥分配网络；
S2：量子密钥分配网络接收所述临时会话ID和设备信息，生成标识信息，查找与用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
S3：所述可穿戴设备接收并向用户终端提供所述标识信息，用户终端获取所述标识信息，向所述可穿戴设备发送验证信息，然后由所述可穿戴设备发送至量子密钥分配网络；
S4：所述量子密钥分配网络接收所述验证信息，根据验证信息生成验证结果发送至目标服务器；
S5：所述目标服务器接收所述验证结果，生成身份认证结果，发送至用户终端。
所述目标服务器可以兼具所述身份认证功能和为用户终端提供业务访问功能；也可以仅具备身份认证功能，若所述目标服务器身份认证通过，由其他服务器为用户终端提供业务访问功能。
各设备之间的连接方式如图2所示：
量子密钥分配网络为目标服务器提供接口，与其建立通信，向自身和所述目标服务器分发统一的第一共享密钥，所述第一共享密钥用于量子密钥分配网络与目标服务器之间通信数据的加密和解密；可选地，二者间也可以通过其他形式实现密钥共享，例如量子密钥分配网络先生成量子密钥，再用其他相对可靠的介质(如VPN专网、移动存储介质)传递到目标服务器实现共享。
可穿戴设备注册到量子密钥分配网络，量子密钥分配网络为自身和可穿戴设备分配第二共享密钥，所述第二共享密钥用于量子密钥分配网络与可穿戴设备之间通信数据的加密和解密。
其中，注册方式是：可穿戴设备持有者(可以是个人，或可穿戴设备的生产设备商、销售商)首先去量子密钥分配网络的运营机构办理注册入网的相关手续，量子密钥分配网络的运营机构负责审核用户的入网申请，如审核通过，则为每一台申请入网的可穿戴设备颁发一个由量子密钥分配网络分配的全网内独一无二的量子身份号，该量子身份号被存储在申请入网的可穿戴设备的永久存储介质中。由于每次身份认证过程中所传递的信息很少，因此即使采用一次一密，可穿戴设备上在注册时预存的与量子密钥分配网络间的共享密钥也可以使用很长时间。如果出于提高安全性的考虑，可以定期更换存储在可穿戴设备上的共享密钥。一种方法是量子密钥分配网络生成新密钥，并用旧的共享密钥加密新的共享密钥，下发到可穿戴设备上。
可穿戴设备与用户终端的连接方式为无线或有线连接。
由于执行此过程时用户终端与可穿戴设备的距离很近，二者可以通过蓝牙方式进行绑定和信息传输，在更加严苛的安全环境要求下，也可以通过有线方式进行信息传输。
也可以进一步提高安全级别，例如假设用户周边10米内就有信息泄露危险，可以事先让用户终端和可穿戴设备都注册到量子密钥分配网络上，由量子密钥分配网络向二者分配统一的第三共享密钥，然后使用第三共享密钥加密用 户终端和可穿戴设备间的通信数据。
为了防止重放攻击，使用量子密钥进行保密通信的两个设备之间信息传输时(例如量子密钥分配网络和可穿戴设备之间、量子密钥分配网络和目标服务器之间)，都要携带一个随机码，该随机码取自与对端设备共享的量子密钥，而且只用一次。只有当两边的随机码一致时，本段通信才是合法有效的。
可选地，可以将可穿戴设备注册到量子密钥分配网络中，获取所述可穿戴设备的量子身份号，当所述可穿戴设备与一个用户终端实现绑定时，所述量子身份号也被所述用户终端共享，并且绑定关系存储在量子密钥分配网络中。可穿戴设备可以向量子密钥分配网络申请解除与用户终端的绑定关系，也可以申请与另外的用户终端建立新的绑定关系。
优选地，所述设备信息可以是用户终端的设备ID，也可以是量子身份号。
所述步骤S1中目标服务器生成临时会话后还将临时会话ID反馈给所述用户终端，即，与用户终端共享临时会话ID。
所述步骤S1中将该临时会话ID和设备信息发送至量子密钥分配网络前还包括：目标服务器将临时会话ID和设备信息采用第一共享密钥进行加密；所述第一共享密钥为目标服务器与量子密钥分配网络之间的共享密钥。
所述步骤S2中量子密钥分配网络接收所述临时会话ID和设备信息还包括：采用第一共享密钥对其进行解密。
当发起认证时提供的设备信息为设备ID时，所述步骤S2中查找与用户终端绑定的可穿戴设备，具体包括：首先根据用户终端的设备ID在量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败。其中，量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的用户终端的设备ID。
当发起认证时提供的设备信息为设备量子身份号时，所述步骤S2中查找与用户终端绑定的可穿戴设备，是根据用户终端的量子身份号，在量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败。其中，量 子密钥分配网络中预存的设备信息应至少包含注册到量子密钥分配网络的可穿戴设备的量子身份号。
所述步骤S2中向所述可穿戴设备发送标识信息还包括：将标识信息采用第二共享密钥进行加密；所述第二共享密钥为可穿戴设备与量子密钥分配网络之间的共享密钥。
所述步骤S3中可穿戴设备接收所述标识信息还包括：采用第二共享密钥对其进行解密；
优选地，所述步骤S3中用户终端获取所述标识信息，向可穿戴设备发送验证信息包括：用户终端识别所述标识信息，获取其中包含的临时会话ID和设备信息；判断其中包含的设备信息与本机是否相同，以及判断其中包含的临时会话ID是否对应本机此前向目标服务器发起的认证请求，将判断结果作为验证信息发送至可穿戴设备。
所述步骤S3中由所述可穿戴设备发送至量子密钥分配网络前还包括：可穿戴设备将验证信息采用第二共享密钥进行加密。
所述步骤S4中所述量子密钥分配网络接收所述验证信息还包括：量子密钥分配网络将加密后的验证信息采用第二共享密钥进行解密。
所述步骤S4中根据验证信息生成验证结果包括：若验证信息中设备信息和临时会话ID均对应一致，则验证结果为认证成功，反之，验证结果为认证失败。
所述步骤S4中发送至目标服务器前还包括：量子密钥分配网络将验证结果采用第一共享密钥进行加密。
所述步骤S5中所述目标服务器接收所述验证结果还包括：对加密后的验证结果采用第一共享密钥进行解密。
所述步骤S5生成身份认证结果，发送至用户终端包括：生成用户终端登录目标服务器认证成功或失败的消息，发送至该用户终端。
认证成功的消息还可以包括但不限于令牌token、过期时间、重定向地址中的任意一个或多个。
认证完成后，此次认证消息即时失效。
所述临时会话ID只使用一次，一旦身份认证过程结束，无论是否成功， 均不重复使用。每次建立的临时会话ID均不相同。
优选地，所述标识信息为二维码的形式；
优选地，当所述标识信息为二维码的形式时，用户终端通过光学方式获取其中包含的信息；当所述标识信息为其他数字形式的信息时，用户终端也可通过其他方式，如无线、蓝牙、红外线、声波等方式获取其中包含的信息。
所述标识信息可以是动态的，以二维码形式为例，可穿戴设备上生成二维码后，等待用户扫描，如果用户在一段时间内没有扫描，则量子密钥分配网络会每隔一段时间重新生成一次新的二维码，并使用与可穿戴设备间共享的量子密钥加密下发到可穿戴设备上进行不断动态更新。
可选地，步骤S3中所述可穿戴设备还采集用户的生物识别信息，并将其发送至量子密钥分配网络。相应地，步骤S4中量子密钥分配网络接收到所述生物识别信息后，将其与预存的生物识别信息进行匹配；当生物识别信息匹配成功，且验证信息中设备信息和临时会话ID均对应一致时，生成认证成功的验证结果。
可选地，作为一种替代方式，所述步骤S3的一种简化方案是，用户终端直接将验证信息发送至量子密钥分配网络。这种简化方案需要用户终端事先预置与量子密钥分配网络间的共享密钥。
可选地，作为一种替代方式，所述步骤S3中用户终端获取所述标识信息，向可穿戴设备发送验证信息包括：用户终端获取所述标识信息，将本机当前发起的所有临时会话ID和本机的设备信息作为验证信息发送至可穿戴设备。
相应地，所述步骤S4中根据验证信息生成验证结果包括：量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与所述步骤S2中接收到的临时会话ID和设备信息均对应一致的组合，如果找到则验证结果为认证成功，反之验证结果为认证失败。
为了更清楚地阐述本申请，下面通过一实例描述本实施例，如图3所示：
①用户终端访问目标服务器，将自己身份告知服务器。目标服务器为此次登陆生成一个临时会话。
②目标服务器向量子密钥分配网络申请授权认证，并将此次临时会话的相关信息以及用户终端身份用与量子密钥分配网络间的共享量子密钥加密之后， 发送到量子密钥分配网络。量子密钥分配网络收到后解密还原信息。
③量子密钥分配网络在内部查找登陆者身份，并向拥有该身份的可穿戴设备发送验证二维码作为标识信息，该二维码中包含了标识此次临时会话的相关信息以及标识用户终端的设备信息。该标识信息使用与可穿戴设备间预置的共享量子密钥加密后下发。可穿戴设备收到后解密还原信息。
④用户终端扫描二维码，以光学方式获取其中信息。
⑤用户终端根据获取到的信息判断二维码中包含的身份认证请求是否为本机提出，据此生成验证信息，发送到可穿戴设备。
⑥可穿戴设备将验证信息用与量子密钥分配网络共享的量子密钥加密后，发送给量子密钥分配网络。量子密钥分配网络解密后得到验证信息，据此生成验证结果。
⑦量子密钥分配网络将验证结果使用与目标服务器间的共享量子密钥加密后，发送给目标服务器。目标服务器解密后得到验证结果。
⑧目标服务器根据验证结果生成最终的身份认证结果，并发送给用户终端。认证完成后，此次身份认证流程中产生的全部中间过程信息即时失效。
本申请的身份认证尤其适合于复杂应用场合。例如同一个用户终端在一个较短的时间段内发出两次或者多次认证请求(比如先申请对目标服务器A的授权，再马上接着申请对目标服务器B的授权)，对于量子密钥分配网络，此时就可能出现前一次认证尚未完成，后一次认证就接着到来的情况，采用临时会话ID来区分两次不同的认证过程保证的身份认证的准确性。
作为本实施例的简化方案，用户终端发起认证请求，在该认证请求得到响应之前(即认证通过或不通过之前)，不能发起另一次认证请求，即，在一个时间段内，一个用户设备仅会有一次认证请求，不需要采用临时会话ID来进行标识。此时，只需要采用用户终端的设备信息来标识在此次临时会话的身份即可。具体地，包括以下步骤：
S1：用户终端向目标服务器发起认证请求并提供所述用户终端的设备信息，目标服务器接收所述认证请求生成临时会话，将设备信息发送至量子密钥分配网络；
S2：量子密钥分配网络接收所述设备信息，生成标识信息，查找与用户终 端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
S3：所述可穿戴设备接收并向用户终端提供所述标识信息，用户终端根据所述标识信息获取设备信息；判断所述设备信息与本机是否相同，将判断结果作为验证信息发送至可穿戴设备，然后由所述可穿戴设备发送至量子密钥分配网络；
S4：所述量子密钥分配网络接收所述验证信息，根据验证信息生成验证结果发送至目标服务器；若验证信息中设备信息对应一致，则验证结果为认证成功，反之，验证结果为认证失败。
S5：所述目标服务器接收所述验证结果，生成身份认证结果，发送至用户终端。
实施例2
基于实施例1的身份认证方法，本申请还提供了一种基于可穿戴设备的身份认证系统，包括：
用户终端，用于向目标服务器发起认证请求并提供所述用户终端的设备信息，获取可穿戴设备向用户终端提供的标识信息，向所述可穿戴设备发送验证信息，以及接收目标服务器发送的身份认证结果；
目标服务器，用于接收所述认证请求并生成临时会话，将临时会话ID和设备信息发送至量子密钥分配网络，以及接收量子密钥分配网络发送的验证结果，生成身份认证结果，发送至用户终端；
量子密钥分配网络，用于接收所述临时会话ID和设备信息，生成标识信息，查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息，以及接收可穿戴设备发送的验证信息，根据验证信息生成验证结果发送至目标服务器；
可穿戴设备，用于接收并向用户终端提供所述标识信息，以及接收用户终端发送的验证信息，发送至量子密钥分配网络。
所述目标服务器可以兼具所述身份认证功能和为用户终端提供业务访问功能；也可以仅具备身份认证功能，若所述目标服务器身份认证通过，由其他服务器为用户终端提供业务访问功能。
可选地，所述设备信息是用户终端的设备ID或量子身份号，所述量子身份号是量子密钥分配网络为注册入网的可穿戴设备分配的全网唯一的身份标识，可穿戴设备与用户终端建立绑定关系后，量子身份号由可穿戴设备及与其绑定的用户终端所共享。
可选地，所述目标服务器生成临时会话后还将临时会话ID反馈给所述用户终端，即，与用户终端共享临时会话ID。
可选地，查找与用户终端绑定的可穿戴设备的一种方式包括：首先根据用户终端的设备ID在量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败。其中，量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的用户终端的设备ID。
可选地，查找与用户终端绑定的可穿戴设备的另一种方式包括：根据用户终端的量子身份号，在量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败。其中，量子密钥分配网络中预存的设备信息应至少包含注册到量子密钥分配网络的可穿戴设备的量子身份号。
优选地，所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：识别所述标识信息，获取其中包含的临时会话ID和设备信息；判断其中包含的设备信息与本机是否相同，以及判断其中包含的临时会话ID是否对应本机此前向目标服务器发起的认证请求，将判断结果作为验证信息发送至可穿戴设备。所述量子密钥分配网络根据验证信息生成验证结果的方式为：若验证信息中设备信息和临时会话ID均对应一致，则验证结果为认证成功，反之，验证结果为认证失败。
可选地，所述可穿戴设备还采集用户的生物识别信息，并将其发送至量子密钥分配网络；量子密钥分配网络接收到所述生物识别信息后，将其与预存的生物识别信息进行匹配；当生物识别信息匹配成功，且验证信息中设备信息和临时会话ID均对应一致时，生成认证成功的验证结果。
作为一种替代实施方式，所述用户终端获取所述标识信息，向所述可穿戴 设备发送验证信息包括：用户终端获取所述标识信息，将本机当前发起的所有临时会话ID和本机的设备信息作为验证信息发送至可穿戴设备。所述量子密钥分配网络根据验证信息生成验证结果包括：量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与自所述目标服务器接收到的临时会话ID和设备信息均对应一致的组合，如果找到则验证结果为认证成功，反之验证结果为认证失败。
优选地，所述目标服务器生成身份认证结果，发送至用户终端包括：生成用户终端登录目标服务器认证成功或失败的消息，发送至该用户终端。
优选地，所述标识信息的形式可以为二维码。所述二维码是动态的，可穿戴设备上显示二维码后，如果用户在一段时间内没有扫描，则量子密钥分配网络会重新生成新的二维码发送至可穿戴设备上。
可选地，各设备间的通信连接方式为：
用户终端访问目标服务器。
量子密钥分配网络与目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
可穿戴设备与量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
可穿戴设备与用户终端的连接方式为无线或有线连接。
基于更安全的通信要求考虑，用户终端和可穿戴设备都预先注册到量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于用户终端和可穿戴设备之间通信数据的加密和解密。
作为本实施例的简化方案，用户终端发起认证请求，在该认证请求得到响应之前(即认证通过或不通过之前)，不能发起另一次认证请求，即，在一个时间段内，一个用户设备仅会有一次认证请求，不需要采用临时会话ID来进行标识。此时，只需要采用用户终端的设备信息来标识在此次临时会话的身份即可。具体地，所述系统包括：
用户终端，用于向目标服务器发起认证请求并提供所述用户终端的设备信息，获取可穿戴设备向用户终端提供的标识信息，用户终端根据所述标识信息获取设备信息；判断所述设备信息与本机是否相同，将判断结果作为验证信息 发送至可穿戴设备，以及接收目标服务器发送的身份认证结果；
目标服务器，用于接收所述认证请求并生成临时会话，将设备信息发送至量子密钥分配网络，以及接收量子密钥分配网络发送的验证结果，生成身份认证结果，发送至用户终端；
量子密钥分配网络，用于接收所述设备信息，生成标识信息，查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息，以及接收可穿戴设备发送的验证信息，根据验证信息生成验证结果发送至目标服务器；具体地，若验证信息中设备信息对应一致，则验证结果为认证成功，反之，验证结果为认证失败。
可穿戴设备，用于接收并向用户终端提供所述标识信息，以及接收用户终端发送的验证信息，发送至量子密钥分配网络。
实施例3
基于实施例1的身份认证方法，本实施例还提供了一种用于身份认证的量子密钥分配网络，包括：
接收用户终端向目标服务器发起认证请求时提供的设备信息，以及目标服务器接收所述认证请求生成的临时会话ID，根据所述设备信息和临时会话ID生成标识信息；
查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
以及接收可穿戴设备发送的验证信息，根据验证信息生成验证结果发送至目标服务器，所述验证信息是用户终端从可穿戴设备获取所述标识信息后向所述可穿戴设备发送的。
可选地，所述设备信息是用户终端的设备ID或量子身份号，所述量子身份号是量子密钥分配网络为注册入网的可穿戴设备分配的全网唯一的身份标识，可穿戴设备与用户终端建立绑定关系后，量子身份号由可穿戴设备及与其绑定的用户终端所共享。
其中，所述查找与用户终端绑定的可穿戴设备的一种方式包括：首先根据用户终端的设备ID在量子密钥分配网络查找到相应的量子身份号，然后查找 具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败。其中，量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的用户终端的设备ID。
所述查找与用户终端绑定的可穿戴设备的另一种方式包括：根据用户终端的量子身份号，在量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败。其中，量子密钥分配网络中预存的设备信息应至少包含注册到量子密钥分配网络的可穿戴设备的量子身份号。
其中，目标服务器生成临时会话后与用户终端共享临时会话ID；所述验证信息包括所述用户终端当前发起的所有临时会话ID和所述用户终端的设备信息；所述量子密钥分配网络根据验证信息生成验证结果包括：量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与自目标服务器接收到的临时会话ID和设备信息均对应一致的组合，如果找到则验证结果为认证成功，反之验证结果为认证失败。
可选地，量子密钥分配网络与目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
可选地，可穿戴设备与量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
作为本实施例的简化方案，用户终端发起认证请求，在该认证请求得到响应之前(即认证通过或不通过之前)，不能发起另一次认证请求，即，在一个时间段内，一个用户设备仅会有一次认证请求，不需要采用临时会话ID来进行标识。此时，只需要采用用户终端的设备信息来标识在此次临时会话的身份即可。具体地，所述量子密钥分配网络：
接收用户终端向目标服务器发起认证请求时提供的设备信息，根据所述设备信息生成标识信息；
查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
以及接收可穿戴设备发送的验证信息，根据验证信息生成验证结果发送至 目标服务器，所述验证信息是用户终端从可穿戴设备获取所述标识信息后向所述可穿戴设备发送的。其中，若验证信息中设备信息对应一致，则验证结果为认证成功，反之，验证结果为认证失败。
实施例4
基于实施例1的身份认证方法，本实施例还提供了一种用于身份认证的可穿戴设备，与用户终端绑定，包括：
向用户终端提供量子密钥分配网络发送的标识信息，所述标识信息是量子密钥分配网络接收用户终端向目标服务器发起认证请求时提供的设备信息，以及目标服务器接收所述认证请求生成的临时会话ID，根据所述设备信息和临时会话ID生成的；
以及接收用户终端获取所述标识信息后发送的验证信息，继而发送至量子密钥分配网络进行认证。
可选地，所述可穿戴设备在量子密钥分配网络注册并存储有全网独一无二的量子身份号，具有密钥存储及数据加解密和数据收发功能。
可选地，所述标识信息的形式为二维码。
可选地，所述可穿戴设备还采集用户的生物识别信息，并将其发送至量子密钥分配网络。
可选地，可穿戴设备与量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
可选地，用户终端和可穿戴设备都预先注册到量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于用户终端和可穿戴设备之间通信数据的加密和解密。
作为本实施例的简化方案，用户终端发起认证请求，在该认证请求得到响应之前(即认证通过或不通过之前)，不能发起另一次认证请求，即，在一个时间段内，一个用户设备仅会有一次认证请求，不需要采用临时会话ID来进行标识。此时，只需要采用用户终端的设备信息来标识在此次临时会话的身份即可。具体地，所述可穿戴设备，与用户终端绑定，包括：
向用户终端提供量子密钥分配网络发送的标识信息，所述标识信息是根据 量子密钥分配网络接收用户终端向目标服务器发起认证请求时提供的设备信息生成的；
以及接收用户终端获取所述标识信息后发送的验证信息，继而发送至量子密钥分配网络进行认证。
实施例5
基于实施例1的身份认证方法，本实施例还提供了一种用户终端，与可穿戴设备绑定，包括：
向目标服务器发起认证请求并提供所述用户终端的设备信息；
从所述可穿戴设备获取标识信息，向所述可穿戴设备发送验证信息继而发送至量子密钥分配网络进行认证得到验证结果；其中，所述标识信息是量子密钥分配网络接收用户终端向目标服务器发起认证请求时提供的设备信息，以及目标服务器接收所述认证请求生成的临时会话ID，根据所述设备信息和临时会话ID生成的；
以及接收身份认证结果；所述身份认证结果是所述目标服务器基于量子密钥分配网络发送的验证结果生成的。
其中，目标服务器生成临时会话后与用户终端共享临时会话ID，所述验证信息包括所述用户终端当前发起的所有临时会话ID和所述用户终端的设备信息。
可选地，用户终端和可穿戴设备都预先注册到量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于用户终端和可穿戴设备之间通信数据的加密和解密。
作为本实施例的简化方案，用户终端发起认证请求，在该认证请求得到响应之前(即认证通过或不通过之前)，不能发起另一次认证请求，即，在一个时间段内，一个用户设备仅会有一次认证请求，不需要采用临时会话ID来进行标识。此时，只需要采用用户终端的设备信息来标识在此次临时会话的身份即可。具体地，所述用户终端，与可穿戴设备绑定，包括：
向目标服务器发起认证请求并提供所述用户终端的设备信息；
从所述可穿戴设备获取标识信息，向所述可穿戴设备发送验证信息继而发 送至量子密钥分配网络进行认证得到验证结果；其中，所述标识信息是量子密钥分配网络根据设备信息生成的；所述设备信息是用户终端向目标服务器发起认证请求时提供的。
以及接收身份认证结果；所述身份认证结果是所述目标服务器基于量子密钥分配网络发送的验证结果生成的。
实施例6
基于实施例1的身份认证方法，本实施例还提供了一种目标服务器，包括：
接收用户终端发送的认证请求以及所述用户终端提供的设备信息，生成临时会话，并将临时会话ID和设备信息发送至量子密钥分配网络；
将量子密钥分配网络发送的认证结果发送至所述用户终端。
其中，所述目标服务器兼具身份认证功能和为用户终端提供业务访问的功能；或仅具备身份认证功能，若所述目标服务器身份认证通过，由其他服务器为用户终端提供业务访问功能。
可选地，量子密钥分配网络与目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
作为本实施例的简化方案，用户终端发起认证请求，在该认证请求得到响应之前(即认证通过或不通过之前)，不能发起另一次认证请求，即，在一个时间段内，一个用户设备仅会有一次认证请求，不需要采用临时会话ID来进行标识。此时，只需要采用用户终端的设备信息来标识在此次临时会话的身份即可。具体地，所述目标服务器，包括：
接收用户终端发送的认证请求以及所述用户终端提供的设备信息，将设备信息发送至量子密钥分配网络；
将量子密钥分配网络发送的认证结果发送至所述用户终端。
本申请对用户身份的认证，以一次一密的对称量子密钥取代了基于数学算法复杂度的加密方式，提高了安全性；将可穿戴设备介入目标服务器的登录认证，增强了用户体验；将量子密码技术和可穿戴设备进行有机结合，极大提高了设备与设备之间、人和设备之间的身份认证的可靠性。由此，建立了一条从人(使用者)到远程业务服务器的完整可靠认证链路，铺平了“最后一公里” 的安全。
量子密钥的使用方式均为一次一密。但如果降低安全性要求，使得密钥使用方式不再严格遵循一次一密，或者在本实施例的基础上，以其他密钥替代量子密钥，此种变通也应被视为本申请提案的保护范围。
本领域技术人员应该明白，上述本申请的各模块或各步骤可以用通用的计算机装置来实现，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。本申请不限制于任何特定的硬件和软件的结合。
上述虽然结合附图对本申请的具体实施方式进行了描述，但并非对本申请保护范围的限制，所属领域技术人员应该明白，在本申请的技术方案的基础上，本领域技术人员不需要付出创造性劳动即可做出的各种修改或变形仍在本申请的保护范围以内。

Claims (59)

  1. 一种基于可穿戴设备的身份认证方法，其特征在于，包括以下步骤：
    S1：用户终端向目标服务器发起认证请求并提供所述用户终端的设备信息，所述目标服务器接收所述认证请求生成临时会话，并将临时会话ID和所述设备信息发送至量子密钥分配网络；
    S2：所述量子密钥分配网络接收所述临时会话ID和设备信息，生成标识信息，查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
    S3：所述可穿戴设备接收并向所述用户终端提供所述标识信息，所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息，然后由所述可穿戴设备发送至所述量子密钥分配网络；
    S4：所述量子密钥分配网络接收所述验证信息，根据所述验证信息生成验证结果发送至所述目标服务器；
    S5：所述目标服务器接收所述验证结果，生成身份认证结果，发送至所述用户终端。
  2. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述设备信息是所述用户终端的设备ID或量子身份号，所述量子身份号是所述量子密钥分配网络为注册入网的所述可穿戴设备分配的全网唯一的身份标识，所述可穿戴设备与所述用户终端建立绑定关系后，所述量子身份号由所述可穿戴设备及与其绑定的所述用户终端所共享。
  3. 如权利要求2所述的一种基于可穿戴设备的身份认证方法，其特征在于，当所述设备信息是所述用户终端的设备ID时，所述步骤S2中查找与所述用户终端绑定的可穿戴设备包括：首先根据所述用户终端的设备ID在所述量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的所述可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的所述用户终端的设备ID。
  4. 如权利要求2所述的一种基于可穿戴设备的身份认证方法，其特征在 于，当所述设备信息是量子身份号时，所述步骤S2中查找与所述用户终端绑定的可穿戴设备包括：根据所述用户终端的量子身份号，在所述量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含注册到所述量子密钥分配网络的所述可穿戴设备的量子身份号。
  5. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述步骤S3中所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：所述用户终端识别所述标识信息，获取其中包含的所述临时会话ID和设备信息；判断其中包含的所述设备信息与本机是否相同，以及判断其中包含的所述临时会话ID是否对应本机此前向所述目标服务器发起的所述认证请求，将判断结果作为所述验证信息发送至所述可穿戴设备。
  6. 如权利要求5所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述步骤S4中所述量子密钥分配网络根据所述验证信息生成验证结果包括：若所述验证信息中所述设备信息和临时会话ID均对应一致，则所述验证结果为认证成功，反之，所述验证结果为认证失败。
  7. 如权利要求5所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述步骤S3中所述可穿戴设备还采集用户的生物识别信息，并将其发送至所述量子密钥分配网络；所述量子密钥分配网络接收到所述生物识别信息后，将其与预存的生物识别信息进行匹配；当所述生物识别信息匹配成功，且所述验证信息中所述设备信息和临时会话ID均对应一致时，所述验证结果为认证成功，反之，所述验证结果为认证失败。
  8. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述目标服务器生成所述临时会话后与所述用户终端共享所述临时会话ID；
    所述步骤S3中所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：所述用户终端获取所述标识信息，将本机当前发起的所有临时会话ID和本机的设备信息作为所述验证信息发送至所述可穿戴设备。
  9. 如权利要求8所述的一种基于可穿戴设备的身份认证方法，其特征在 于，所述步骤S4中根据所述验证信息生成验证结果包括：所述量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与所述步骤S2中接收到的临时会话ID和设备信息均对应一致的组合，如果找到则所述验证结果为认证成功，反之所述验证结果为认证失败。
  10. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述步骤S5中生成身份认证结果，发送至所述用户终端包括：生成所述用户终端登录所述目标服务器认证成功或失败的消息，发送至所述用户终端。
  11. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述标识信息的形式为二维码。
  12. 如权利要求11所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述二维码是动态的，所述可穿戴设备上显示所述二维码后，如果用户在一段时间内没有扫描，则所述量子密钥分配网络会每隔一段时间重新生成一次新的二维码，并下发到所述可穿戴设备上进行不断动态更新。
  13. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
  14. 如权利要求1-13任一项所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
  15. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述可穿戴设备与所述用户终端的连接方式为无线或有线连接。
  16. 如权利要求1所述的一种基于可穿戴设备的身份认证方法，其特征在于，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
  17. 一种基于可穿戴设备的身份认证系统，其特征在于，包括：
    用户终端，用于向目标服务器发起认证请求并提供所述用户终端的设备信息，获取可穿戴设备向所述用户终端提供的标识信息，向所述可穿戴设备发送验证信息，以及接收所述目标服务器发送的身份认证结果；
    目标服务器，用于接收所述认证请求并生成临时会话，将临时会话ID和所述设备信息发送至量子密钥分配网络，以及接收所述量子密钥分配网络发送的验证结果，生成所述身份认证结果，发送至所述用户终端；
    量子密钥分配网络，用于接收所述临时会话ID和设备信息，生成所述标识信息，查找与所述用户终端绑定的所述可穿戴设备，向所述可穿戴设备发送所述标识信息，以及接收所述可穿戴设备发送的所述验证信息，根据所述验证信息生成所述验证结果发送至所述目标服务器；
    可穿戴设备，用于接收并向所述用户终端提供所述标识信息，以及接收所述用户终端发送的所述验证信息，发送至所述量子密钥分配网络。
  18. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述设备信息是所述用户终端的设备ID或量子身份号，所述量子身份号是所述量子密钥分配网络为注册入网的所述可穿戴设备分配的全网唯一的身份标识，所述可穿戴设备与所述用户终端建立绑定关系后，所述量子身份号由所述可穿戴设备及与其绑定的所述用户终端所共享。
  19. 如权利要求18所述的一种基于可穿戴设备的身份认证系统，其特征在于，当所述设备信息是所述用户终端的设备ID时，所述查找与所述用户终端绑定的所述可穿戴设备包括：首先根据所述用户终端的设备ID在所述量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的所述可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的所述用户终端的设备ID。
  20. 如权利要求18所述的一种基于可穿戴设备的身份认证系统，其特征在于，当所述设备信息是量子身份号时，所述查找与所述用户终端绑定的所述可穿戴设备包括：根据所述用户终端的量子身份号，在所述量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含注册到所述量子密钥分配网络的所述可穿戴设备的量子身份号。
  21. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：识别所述标识信息，获取其中包含的所述临时会话ID和设备信息；判断其中包含的所述设备信息与本机是否相同，以及判断其中包含的所述临时会话ID是否对应本机此前向所述目标服务器发起的所述认证请求，将判断结果作为所述验证信息发送至所述可穿戴设备。
  22. 如权利要求21所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述量子密钥分配网络根据所述验证信息生成所述验证结果的方式为：若所述验证信息中所述设备信息和临时会话ID均对应一致，则所述验证结果为认证成功，反之，所述验证结果为认证失败。
  23. 如权利要求21所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述可穿戴设备还采集用户的生物识别信息，并将其发送至所述量子密钥分配网络；所述量子密钥分配网络接收到所述生物识别信息后，将其与预存的生物识别信息进行匹配；当所述生物识别信息匹配成功，且所述验证信息中所述设备信息和临时会话ID均对应一致时，所述验证结果为认证成功，反之，所述验证结果为认证失败。
  24. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述目标服务器生成所述临时会话后与所述用户终端共享所述临时会话ID；
    所述用户终端获取所述标识信息，向所述可穿戴设备发送验证信息包括：所述用户终端获取所述标识信息，将本机当前发起的所有临时会话ID和本机的设备信息作为所述验证信息发送至所述可穿戴设备。
  25. 如权利要求24所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述量子密钥分配网络根据所述验证信息生成所述验证结果包括：所述量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与自所述目标服务器接收到的临时会话ID和设备信息均对应一致的组合，如果找到则所述验证结果为认证成功，反之所述验证结果为认证失败。
  26. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在 于，所述目标服务器生成所述身份认证结果，发送至所述用户终端包括：生成所述用户终端登录所述目标服务器认证成功或失败的消息，发送至所述用户终端。
  27. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述标识信息的形式为二维码。
  28. 如权利要求27所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述二维码是动态的，所述可穿戴设备上显示所述二维码后，如果用户在一段时间内没有扫描，则所述量子密钥分配网络会每隔一段时间重新生成一次新的二维码，并下发到所述可穿戴设备上进行不断动态更新。
  29. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
  30. 如权利要求17-29任一项所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
  31. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述可穿戴设备与所述用户终端的连接方式为无线或有线连接。
  32. 如权利要求17所述的一种基于可穿戴设备的身份认证系统，其特征在于，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
  33. 一种用于身份认证的量子密钥分配网络，其特征在于：
    接收用户终端的设备信息，生成标识信息；
    查找与所述用户终端绑定的可穿戴设备，向所述可穿戴设备发送所述标识信息；
    以及接收所述可穿戴设备发送的验证信息，根据所述验证信息生成验证结果。
  34. 如权利要求33所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述设备信息是用户终端向目标服务器发起认证请求时提供的。
  35. 如权利要求33所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述标识信息还包括临时会话ID，所述临时会话ID是所述目标服务器接收所述认证请求生成的。
  36. 如权利要求33所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述验证信息是所述用户终端从所述可穿戴设备获取所述标识信息后向所述可穿戴设备发送的。
  37. 如权利要求33所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述设备信息是所述用户终端的设备ID或量子身份号，所述量子身份号是所述量子密钥分配网络为注册入网的所述可穿戴设备分配的全网唯一的身份标识，所述可穿戴设备与所述用户终端建立绑定关系后，所述量子身份号由所述可穿戴设备及与其绑定的所述用户终端所共享。
  38. 如权利要求37所述的一种用于身份认证的量子密钥分配网络，其特征在于，当所述设备信息是所述用户终端的设备ID时，所述查找与所述用户终端绑定的可穿戴设备包括：首先根据所述用户终端的设备ID在所述量子密钥分配网络查找到相应的量子身份号，然后查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到则身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含事先注册到所述量子密钥分配网络上的所述可穿戴设备的量子身份号，以及与这些可穿戴设备绑定的所述用户终端的设备ID。
  39. 如权利要求37所述的一种用于身份认证的量子密钥分配网络，其特征在于，当所述设备信息是量子身份号时，所述查找与所述用户终端绑定的可穿戴设备包括：根据所述用户终端的量子身份号，在所述量子密钥分配网络中预存的设备信息中查找具备该量子身份号的可穿戴设备，即为与所述用户终端绑定的可穿戴设备；若不能查找到，则此次身份认证失败；其中，所述量子密钥分配网络中预存的设备信息应至少包含注册到所述量子密钥分配网络的所述可穿戴设备的量子身份号。
  40. 如权利要求33所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述目标服务器生成临时会话后与所述用户终端共享所述临时会话ID；所述验证信息包括所述用户终端当前发起的所有临时会话ID和所述用户终端 的设备信息；
    所述量子密钥分配网络根据所述验证信息生成验证结果包括：所述量子密钥分配网络在接收到的所有由所述用户终端发起的临时会话ID和设备信息中，查找与自所述目标服务器接收到的临时会话ID和设备信息均对应一致的组合，如果找到则所述验证结果为认证成功，反之所述验证结果为认证失败。
  41. 如权利要求33所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
  42. 如权利要求33-41任一项所述的一种用于身份认证的量子密钥分配网络，其特征在于，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
  43. 一种用于身份认证的可穿戴设备，与用户终端绑定，其特征在于：
    向所述用户终端提供量子密钥分配网络发送的标识信息；
    接收所述用户终端获取所述标识信息后发送的验证信息，继而发送至所述量子密钥分配网络进行认证。
  44. 如权利要求43所述的一种用于身份认证的可穿戴设备，其特征在于，所述用户终端向目标服务器发起认证请求时提供设备信息，所述标识信息是根据所述设备信息生成的。
  45. 如权利要求43所述的一种用于身份认证的可穿戴设备，其特征在于，所述量子密钥分配网络接收所述用户终端向目标服务器发起认证请求时提供的设备信息，以及所述目标服务器接收所述认证请求生成的临时会话ID，所述标识信息是根据所述设备信息和临时会话ID生成的。
  46. 如权利要求43所述的一种用于身份认证的可穿戴设备，其特征在于，所述可穿戴设备在所述量子密钥分配网络注册并存储有全网独一无二的量子身份号，具有密钥存储及数据加解密和数据收发功能。
  47. 如权利要求43所述的一种用于身份认证的可穿戴设备，其特征在于，所述可穿戴设备还采集用户的生物识别信息，并将其发送至所述量子密钥分配网络。
  48. 如权利要求43所述的一种用于身份认证的可穿戴设备，其特征在于， 所述标识信息的形式为二维码。
  49. 如权利要求43所述的一种用于身份认证的可穿戴设备，其特征在于，所述可穿戴设备与所述量子密钥分配网络中均预存第二共享密钥，用于二者之间通信数据的加密和解密。
  50. 如权利要求43-49任一项所述的一种用于身份认证的可穿戴设备，其特征在于，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
  51. 一种用户终端，与可穿戴设备绑定，其特征在于：
    向目标服务器发起认证请求并提供所述用户终端的设备信息；
    从所述可穿戴设备获取标识信息，向所述可穿戴设备发送验证信息继而发送至量子密钥分配网络进行认证得到验证结果；所述标识信息是所述量子密钥分配网络接收所述用户终端向所述目标服务器发起所述认证请求时提供的所述设备信息，根据所述设备信息生成的。
  52. 如权利要求51所述的一种用户终端，其特征在于，所述标识信息还包括临时会话ID，所述临时会话ID是所述目标服务器接收所述认证请求生成的。
  53. 如权利要求51所述的一种用户终端，其特征在于，所述用户终端还接收身份认证结果；所述身份认证结果是所述目标服务器基于所述量子密钥分配网络发送的所述验证结果生成的。
  54. 如权利要求52所述的一种用户终端，其特征在于，所述目标服务器生成临时会话后与所述用户终端共享所述临时会话ID，所述验证信息包括所述用户终端当前发起的所有临时会话ID和所述用户终端的设备信息。
  55. 如权利要求51-54任一项所述的一种用户终端，其特征在于，所述用户终端和所述可穿戴设备都预先注册到所述量子密钥分配网络，彼此之间获取成对的第三共享密钥，用于所述用户终端和所述可穿戴设备之间通信数据的加密和解密。
  56. 一种目标服务器，其特征在于：
    接收用户终端发送的认证请求，将所述设备信息发送至量子密钥分配网络；
    将所述量子密钥分配网络发送的认证结果发送至所述用户终端。
  57. 如权利要求56所述的一种目标服务器，其特征在于，所述目标服务器接收用户终端发送的认证请求时，还生成临时会话ID，发送至量子密钥分配网络。
  58. 如权利要求56所述的一种目标服务器，其特征在于，所述目标服务器兼具身份认证功能和为所述用户终端提供业务访问的功能；或仅具备身份认证功能，若所述目标服务器身份认证通过，由其他服务器为所述用户终端提供业务访问功能。
  59. 如权利要求56-58任一项所述的一种目标服务器，其特征在于，所述量子密钥分配网络与所述目标服务器中均预存第一共享密钥，用于二者之间通信数据的加密和解密。
PCT/CN2019/076403 2018-03-09 2019-02-28 基于可穿戴设备的身份认证方法及系统 WO2019170026A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/978,119 US11356442B2 (en) 2018-03-09 2019-02-28 Wearable device-based identity authentication method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810194979.9A CN110493162A (zh) 2018-03-09 2018-03-09 基于可穿戴设备的身份认证方法及系统
CN201810194979.9 2018-03-09

Publications (1)

Publication Number Publication Date
WO2019170026A1 true WO2019170026A1 (zh) 2019-09-12

Family

ID=67845796

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/076403 WO2019170026A1 (zh) 2018-03-09 2019-02-28 基于可穿戴设备的身份认证方法及系统

Country Status (3)

Country Link
US (1) US11356442B2 (zh)
CN (1) CN110493162A (zh)
WO (1) WO2019170026A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113708929A (zh) * 2021-08-26 2021-11-26 东南大学 一种物联网边缘网关定时推送量子密钥的方法
CN115277176A (zh) * 2022-07-25 2022-11-01 中国电信股份有限公司 通信方法、通信装置、存储介质与电子设备

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3832406A1 (fr) * 2019-12-06 2021-06-09 Tissot S.A. Procédé de gestion de l'utilisation de données dans une montre
CN113112785A (zh) * 2021-03-10 2021-07-13 中国—东盟信息港股份有限公司 电能计量的数据传输方法、系统、计算机设备及存储介质
CN113242126B (zh) * 2021-06-09 2022-06-21 国网湖南省电力有限公司 基于身份认证的智能电表与蓝牙断路器的配对方法及系统
CN113783938A (zh) * 2021-08-18 2021-12-10 深圳市冠旭电子股份有限公司 基于可穿戴设备的数据分享方法、系统、设备及存储介质

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107368723A (zh) * 2017-06-06 2017-11-21 深圳市科迈爱康科技有限公司 一种身份认证方法、可穿戴设备及计算机可读存储介质

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8483394B2 (en) * 2010-06-15 2013-07-09 Los Alamos National Security, Llc Secure multi-party communication with quantum key distribution managed by trusted authority
KR102127927B1 (ko) * 2013-07-30 2020-07-09 엘지전자 주식회사 이동 단말기, 스마트 워치 및 이동 단말기와 스마트 워치간 보안 인증방법
CN106161359B (zh) * 2015-04-02 2019-09-17 阿里巴巴集团控股有限公司 认证用户的方法及装置、注册可穿戴设备的方法及装置
CN106161392B (zh) * 2015-04-17 2019-08-23 深圳市腾讯计算机系统有限公司 一种身份验证方法和设备
CN106209569B (zh) * 2015-05-04 2020-04-07 腾讯科技（深圳）有限公司 一种企业即时通讯的鉴权方法及装置
CN105471584B (zh) * 2015-12-04 2019-02-22 长春大学 一种基于量子密钥加密的身份认证方法
CN105471920A (zh) * 2016-01-15 2016-04-06 天脉聚源（北京）科技有限公司 一种验证码处理方法及装置
CN116012992A (zh) * 2016-03-08 2023-04-25 达斯特一致有限责任公司 根据取向信息生成唯一码
CN106953729B (zh) * 2017-04-14 2023-06-13 江苏亨通问天量子信息研究院有限公司 基于量子密钥的卫星通信加密系统及方法

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107368723A (zh) * 2017-06-06 2017-11-21 深圳市科迈爱康科技有限公司 一种身份认证方法、可穿戴设备及计算机可读存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZHENG, XIANG: "A New Method Of Biological Quantum Key Distribution For Wireless Body Area Network", MASTER'S DISSERTATION, 31 December 2014 (2014-12-31) *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113708929A (zh) * 2021-08-26 2021-11-26 东南大学 一种物联网边缘网关定时推送量子密钥的方法
CN113708929B (zh) * 2021-08-26 2022-07-01 东南大学 一种物联网边缘网关定时推送量子密钥的方法
CN115277176A (zh) * 2022-07-25 2022-11-01 中国电信股份有限公司 通信方法、通信装置、存储介质与电子设备
CN115277176B (zh) * 2022-07-25 2024-04-05 中国电信股份有限公司 通信方法、通信装置、存储介质与电子设备

Also Published As

Publication number Publication date
US20210014226A1 (en) 2021-01-14
US11356442B2 (en) 2022-06-07
CN110493162A (zh) 2019-11-22

Similar Documents

Publication Publication Date Title
US11463435B2 (en) Identity authentication method and system based on wearable device
US10412061B2 (en) Method and system for encrypted communications
WO2019170026A1 (zh) 基于可穿戴设备的身份认证方法及系统
US10574460B2 (en) Mechanism for achieving mutual identity verification via one-way application-device channels
US11501294B2 (en) Method and device for providing and obtaining graphic code information, and terminal
WO2019020051A1 (zh) 一种安全认证的方法及装置
US11510054B2 (en) Methods, apparatuses, and computer program products for performing identification and authentication by linking mobile device biometric confirmation with third-party mobile device account association
JP2020511016A (ja) モノのインターネットデバイスの記録検証方法及び装置、ならびにｉｄ認証方法及び装置
JP2018503199A (ja) アカウント復元プロトコル
KR20200107931A (ko) 멀티 포인트 인증을 위한 키 생성 및 보관을 위한 시스템 및 방법
KR20180095873A (ko) 무선 네트워크 접속 방법 및 장치, 및 저장 매체
US8397281B2 (en) Service assisted secret provisioning
JP5489775B2 (ja) 秘密鍵共有システム、方法、データ処理装置、管理サーバ、及びプログラム
US20210390533A1 (en) User-Centric, Blockchain-Based and End-to-End Secure Home IP Camera System
US20220245631A1 (en) Authentication method and apparatus of biometric payment device, computer device, and storage medium
ES2665887T3 (es) Sistema de datos seguro
CN108599926A (zh) 一种基于对称密钥池的HTTP-Digest改进型AKA身份认证系统和方法
Hanumanthappa et al. Privacy preserving and ownership authentication in ubiquitous computing devices using secure three way authentication
WO2018099407A1 (zh) 账户认证登录方法及装置
KR20090012013A (ko) 커버로스를 이용한 상호 인증 방법 및 그 시스템
CN109561431B (zh) 基于多口令身份鉴别的wlan接入访问控制系统及方法
CN117041956A (zh) 通信认证方法、装置、计算机设备和存储介质
KR102171377B1 (ko) 로그인 제어 방법
CN114051244A (zh) 一种终端侧设备与网络侧设备之间的认证方法、系统
CN109818903B (zh) 数据传输方法、系统、装置和计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19764142

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19764142

Country of ref document: EP

Kind code of ref document: A1