WO2020216131A1 - 数字钥匙的身份认证方法、终端设备及介质 - Google Patents

数字钥匙的身份认证方法、终端设备及介质 Download PDF

Info

Publication number
WO2020216131A1
WO2020216131A1 PCT/CN2020/085225 CN2020085225W WO2020216131A1 WO 2020216131 A1 WO2020216131 A1 WO 2020216131A1 CN 2020085225 W CN2020085225 W CN 2020085225W WO 2020216131 A1 WO2020216131 A1 WO 2020216131A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
identity authentication
user identity
instruction
operating state
Prior art date
Application number
PCT/CN2020/085225
Other languages
English (en)
French (fr)
Inventor
王思善
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020217035330A priority Critical patent/KR20210145243A/ko
Priority to US17/605,110 priority patent/US20220203933A1/en
Priority to JP2021562902A priority patent/JP7194847B2/ja
Priority to EP20794615.3A priority patent/EP3941014B1/en
Publication of WO2020216131A1 publication Critical patent/WO2020216131A1/zh

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/24—Means to switch the anti-theft system on or off using electronic identifiers containing a code not memorised by the user
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/20—Means to switch the anti-theft system on or off
    • B60R25/25—Means to switch the anti-theft system on or off using biometry
    • B60R25/252—Fingerprint recognition
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00563—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys using personal physical data of the operator, e.g. finger prints, retinal images, voicepatterns
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
    • G07C9/23—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder by means of a password
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/04—Protocols specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/55—Push-based network services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/40—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G07C2009/00412—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks the transmitted data signal being encrypted
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G07C2009/00507—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks keyless data carrier having more than one function
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C2009/00753—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by active electrical keys
    • G07C2009/00769—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by active electrical keys with data transmission performed by wireless means
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00857—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys where the code of the data carrier can be programmed
    • G07C2009/00865—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys where the code of the data carrier can be programmed remotely by wireless communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Definitions

  • This application relates to the technical field of digital keys, and in particular to a digital key identity authentication method, terminal equipment and computer-readable storage media.
  • Digital Key is opposite to physical key (ie, physical key)/key fob. It can use communication technology to use terminal devices, such as mobile phones or wearable smart devices, as key carriers to make Users can perform business operations such as unlocking, locking, and starting vehicles through terminal devices.
  • terminal devices such as mobile phones or wearable smart devices, as key carriers to make Users can perform business operations such as unlocking, locking, and starting vehicles through terminal devices.
  • Figure 1 is a system architecture diagram involved when a digital key is used to unlock a vehicle.
  • the authentication key is stored in the authentication unit 810.
  • SE secure element
  • the security unit 910 is a hardware unit capable of preventing physical attacks and tampering.
  • the security unit 910 has an independent processor, which can provide a secure operating environment for the Digital Key Applet (DK Applet) 911 running in it, and can ensure the security of the assets (such as authentication keys) stored in it. Sex and confidentiality.
  • DK Applet Digital Key Applet
  • the digital key applet 911 in the mobile phone When unlocking, the digital key applet 911 in the mobile phone responds to the business instruction sent by the car, and sends a business response message including the cipher text to the communication unit 820 in the car through the communication unit 920, where the cipher text in the business response message Use authentication key generation.
  • the authentication unit 810 uses the authentication key to verify the cipher text.
  • the electronic control unit 830 determines whether to authorize unlocking according to the verification result. In this way, the digital key can be used to unlock the lock.
  • NFC Near Field Communication
  • the NFC module and the security unit in the terminal device can be powered separately, even if the main chip of the terminal device is not powered, the NFC module and the security unit can be used alone to complete the information interaction with the car. In other words, even when the terminal device is turned off, the terminal device can be used to complete business operations such as unlocking, locking, and starting the vehicle.
  • identity authentication systems which can use passwords, fingerprints, and faces to complete user identity authentication.
  • identity authentication can be added when using the digital key.
  • users can set the use of digital keys to always require identity authentication to prevent fraudulent use of digital keys.
  • the user can use the digital key only after performing identity authentication on the terminal device.
  • the vehicle can also initiate a request to require the user to perform an identity authentication on the terminal device.
  • the identity authentication system in the terminal device is all executed in a Trusted Execution Environment (TEE).
  • TEE Trusted Execution Environment
  • Applications running on terminal devices can only initiate identity authentication through the system service interface and obtain identity authentication results. In other words, the identity authentication system can only run when the main chip of the terminal device is in working condition.
  • the terminal device when the terminal device is turned off, the user cannot complete identity authentication.
  • the identity authentication is often not performed when using the digital key. This allows the attacker to forcibly bypass the authentication restrictions set by the legal user by shutting down the terminal device after obtaining the legal user's terminal device, that is, the digital key has security loopholes.
  • This application provides a digital key identity authentication method to solve the problem that the digital key cannot be used to complete the identity authentication when the terminal device is turned off, and there are security loopholes.
  • this application provides a digital key identity authentication method, including:
  • the first terminal sends a service instruction to the second terminal
  • the first terminal uses the first key to verify the service response message and obtains user identity authentication information, where the first key is a secret pre-appointed by the second terminal and the first terminal.
  • the user identity authentication information is stored in the security unit of the second terminal, the user identity authentication information includes the user identity authentication result, the user identity authentication result is in the first terminal by the identity authentication system of the second terminal 2.
  • Generated before the terminal enters a preset operating state where the preset operating state refers to a state where the identity authentication system of the second terminal cannot generate an identity authentication result;
  • the first terminal verifies the user identity authentication information.
  • the first terminal can also use the second terminal to enter the preset operating state.
  • the user identity authentication information previously stored in the security unit of the second terminal is used to verify the identity of the user. Therefore, with this implementation, even if the second terminal is turned off or in low battery mode, it can be verified whether the user using the digital key in the second terminal is a legal user of the second terminal, thereby improving the security of using the digital key .
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal authorizes the service operation corresponding to the service instruction.
  • the first terminal can also use the user identity authentication result and the preset The authentication result is verified to determine whether to authorize the business operation, thereby improving the security of the use of the digital key and reducing the risk of the first terminal being used by illegal users.
  • a preset operating state such as shutdown or low battery mode
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first A terminal authorizes the business operation corresponding to the business instruction
  • the first terminal authorizes the service operation corresponding to the service instruction.
  • the first terminal can use the user identity authentication result and the cumulative number or frequency of service operation authorizations when the second terminal is in the preset operating state to perform double verification, thereby further improving the security of the use of the digital key.
  • the risk of malicious use of the digital key on the second terminal that is in the preset operating state and lacks real-time protection can be reduced.
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated;
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal responds to the service instruction Business operation authorization.
  • the first terminal can use the user identity authentication result and the first timestamp to perform double verification, thereby further improving the security of the use of the digital key and reducing risks.
  • the first terminal can use the user identity authentication result and the first timestamp to perform double verification, thereby further improving the security of the use of the digital key and reducing risks.
  • the first terminal by restricting the interval between the time when the digital key is used in the preset operating state and the first time stamp, the number of digital keys on the second terminal that is in the preset operating state and lacks real-time protection can be reduced. The use of risk.
  • the method further includes:
  • the first terminal freezes the digital key or instructs the second
  • the terminal freezes the digital key, or instructs the user to perform identity authentication again.
  • the second terminal by determining whether the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, it can be determined whether the identity authentication information provided this time is the latest user identity authentication information , So as to determine whether the second terminal has abnormal behavior in this service. If there is abnormal behavior, you can take certain protective measures, such as freezing the number, or instructing the user to re-authenticate. Therefore, by adding the verification on the basis of the aforementioned single or double verification, the risk of using the digital key can be further reduced.
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated;
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal authorizes the service operation corresponding to the service instruction.
  • the first terminal can use the user identity authentication result and the first time stamp to perform double verification, thereby further improving the security of the use of the digital key.
  • the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, it can be determined whether the identity authentication information provided this time is the latest user identity authentication information, thereby determining Whether the second terminal has abnormal behavior in this service. Therefore, by adding the verification, the risk of using the digital key can be further reduced.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal authorizes the first operation corresponding to the first instruction
  • the first terminal After the first operation is authorized, if the cumulative number of authorized service operations is within the preset threshold when the second terminal is in the preset operating state, or the second terminal is in The frequency of authorization for business operations in the preset operating state is within a preset frequency threshold, or the interval between the current time and the first time stamp is within the preset duration threshold, or The second terminal does not switch from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, then the first terminal authorizes the second operation corresponding to the second instruction.
  • the first terminal can use the user identity authentication result, the cumulative number or frequency of authorized service operations when the second terminal is in the preset operating state, and the first time stamp , Using different verification conditions to verify different business instructions, thereby further improving the security of the use of digital keys.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal authorizes the first operation corresponding to the first instruction
  • the first terminal determines whether the second terminal has switched from the preset time after the time indicated by the first time stamp. Set the operating state to switch to a non-preset operating state;
  • the first terminal authorizes the second operation corresponding to the second instruction.
  • the first terminal can use the user identity authentication result and the first time stamp to verify different business instructions with different verification conditions, thereby further improving the use of digital keys Security.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal responds to the first instruction The first operation authorization
  • the second terminal After the first operation is authorized, if the second terminal does not switch from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, the first terminal pair The second operation authorization corresponding to the second instruction.
  • the first terminal can use the user identity authentication result and the first time stamp to verify different business instructions with different verification conditions, thereby further improving the use of digital keys Security.
  • the step of verifying the user identity authentication information by the first terminal further includes:
  • the first terminal freezes the digital key, or instructs all
  • the second terminal freezes the digital key, or instructs the user to perform identity authentication again.
  • the second terminal by determining whether the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, it can be determined whether the identity authentication information provided this time is the latest user identity authentication information , So as to determine whether the second terminal has abnormal behavior in this service. If there is abnormal behavior, you can take certain protective measures, such as freezing the number, or instructing the user to re-authenticate. Therefore, by adding the verification on the basis of the foregoing verification, the risk of using the digital key can be further reduced.
  • it is determined whether the second terminal is after the time indicated by the first timestamp Switching from the preset operating state to the non-preset operating state includes:
  • the first terminal determines that the second terminal does not switch from the preset operating state to the all after the time indicated by the first time stamp.
  • the non-preset operating state
  • the first terminal determines that the second terminal switches from the preset operating state to the preset operating state after the time indicated by the first time stamp Non-preset operating state.
  • Whether to switch from the preset operating state to the non-preset operating state includes:
  • the first terminal obtains the online verification result sent by the server, and the online verification result is determined by the server according to whether the second terminal switches from the preset operating state after the time indicated by the first time stamp To the non-preset operating state;
  • the first terminal determines that the second terminal has not switched from the preset operating state to the non-preset operating state after the time indicated by the first time stamp;
  • the first terminal determines that the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp.
  • online verification can be performed on the remote server, and the server determines whether the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction, and A second operation corresponding to the second instruction
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal authorizes the first operation corresponding to the first instruction
  • the first terminal refuses to authorize the second operation corresponding to the second instruction
  • the method also includes:
  • the first terminal sends a new service instruction to the second terminal, where the new service instruction includes the second instruction.
  • the first terminal can use the user identity authentication result to verify different business instructions. Regardless of whether the user identity authentication result is verified or not, in order to improve the user experience, part of the business operations with relatively low risks can be authorized, and the other part of the business operations with relatively high risks can be denied authorization. Then initiate a new business instruction to verify whether the business operation that has not been authorized is authorized.
  • the service response message further includes second verification data, and the second verification data is obtained by passing the user identity authentication information through a second key Process generation
  • the step of verifying the user identity authentication information by the first terminal includes:
  • the first terminal will give the service instruction Corresponding service operation authorization; wherein, the second key is a key agreed upon in advance by the second terminal and the first terminal, and the second key is different from the first key.
  • the second key and the second verification data are used to verify the user identity authentication information itself.
  • the user identity authentication information can be guaranteed It is not tampered with in the transmission process, that is, to ensure the integrity of the user identity authentication information; on the other hand, it can ensure that the source of the user identity authentication information is legal, that is, to ensure the legal holder of the key on the second terminal.
  • this application provides a digital key identity authentication method, including:
  • the second terminal receives the service instruction from the first terminal
  • the second terminal sends a service response message processed with the first key to the first terminal in response to the service instruction; wherein, the service response message includes the user identity Authentication information, the user identity authentication information is stored in the security unit of the second terminal, the user identity authentication information includes a user identity authentication result, and the user identity authentication result is stored in the second terminal by the identity authentication system of the second terminal.
  • the second terminal is generated before entering the preset operating state, the preset operating state refers to a state where the identity authentication system of the second terminal cannot generate an identity authentication result, and the first key is the second terminal A key pre-appointed with the first terminal.
  • the second terminal before the second terminal enters the preset operating state, the second terminal needs to perform identity authentication on the user once, and save the user identity authentication information in the security unit of the second terminal.
  • a preset operating state for example, shutdown or low battery mode
  • the user uses the digital key in the second terminal, and the second terminal can send the user identity authentication information in the security unit to the first terminal, so that The first terminal can use this information for verification. Therefore, adopting this implementation manner can ensure that it is a legitimate user of the second terminal using the digital key in the second terminal, which improves the security of using the digital key when the second terminal is in a preset operating state.
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the user identity authentication result is generated.
  • the first terminal can use the user identity authentication result and the first timestamp to perform double or even triple verification, and it can also use the user identity authentication result and the first timestamp to verify different business instructions separately, so that Further improve the safety of the use of digital keys.
  • the service response message further includes second verification data
  • the second verification data is generated by the User identity authentication information is generated by processing the second key
  • the second key is a key agreed upon in advance by the second terminal and the first terminal
  • the second key is the same as the first secret key. The keys are not the same.
  • the first terminal can use the second key and the second verification data to verify the user identity authentication information itself before using the user identity authentication information to verify whether the service operation can be authorized.
  • it can ensure The user identity authentication information has not been tampered with during the transmission process, that is to ensure the integrity of the user identity authentication information; on the other hand, it can ensure that the source of the user identity authentication information is legal, that is, ensure that the key on the second terminal is legal Holder.
  • the step of receiving a service instruction from the first terminal at the second terminal before, it also included:
  • a digital key configured with mandatory identity authentication Before the second terminal enters the preset operating state, if there is a digital key configured with mandatory identity authentication, a user identity authentication result is generated; wherein the digital key configured with mandatory identity authentication requires the second terminal to be Perform user identity authentication before entering the preset operating state;
  • the second terminal stores user identity authentication information in a security unit of the second terminal, and the user identity authentication information includes the user identity authentication result.
  • the second terminal before the second terminal enters the preset operating state, the second terminal needs to perform user identity authentication on the digital key configured with mandatory identity authentication, and save the user identity authentication information in the security unit of the second terminal.
  • the second terminal can also send the user identity authentication information in the security unit to the first terminal, so that the first terminal The terminal can use this information for verification, which improves the security of using the digital key when the second terminal is in the preset operating state.
  • this application provides a terminal device, including:
  • a first transceiver configured to send a service instruction to a second terminal; and, receive a service response message sent by the second terminal;
  • the processor is configured to obtain user identity authentication information after passing the verification of the service response message by using the first key; and verify the user identity authentication information; wherein, the first key is the second terminal
  • the identity authentication system of the terminal is generated before the second terminal enters a preset operating state, and the preset operating state refers to a state in which the identity authentication system of the second terminal cannot generate an identity authentication result.
  • the processor is further configured to: when the user identity authentication result matches a preset authentication result, the service corresponding to the service instruction Operation authorization.
  • the processor is further configured to match the user identity authentication result with a preset authentication result, and when the second terminal is in the When the cumulative number of authorized service operations in the preset running state is within the preset threshold of times, the service operation corresponding to the service instruction is authorized; or, the processor is also used to authenticate the user identity
  • the result matches the preset authentication result, and when the frequency of authorization of the service operation when the second terminal is in the preset running state is within the preset frequency threshold, the service instruction is corresponding to Business operation authorization.
  • the processor is further configured to: when the user identity authentication result matches a preset authentication result, and the current time is away from the first time stamp In the case that the interval duration of is within the preset duration threshold, the business operation corresponding to the business instruction is authorized.
  • the processor is further configured to: In the case of switching from the preset operating state to the non-preset operating state after the time indicated by the time stamp, freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to perform identity authentication again .
  • the processor is further configured to match the user identity authentication result with a preset authentication result, and the second terminal is in the In the case of not switching from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, the business operation corresponding to the business instruction is authorized; wherein, the user identity authentication information further includes the first A timestamp, the first timestamp is used to indicate the time when the identity authentication result is generated.
  • the processor is further configured to correspond to the first instruction when the user identity authentication result matches a preset authentication result And, after the first operation is authorized, when the cumulative number of authorized service operations is within the preset threshold when the second terminal is in the preset operating state , Authorize the second operation corresponding to the second instruction; or, in the case where the frequency of authorization of the service operation when the second terminal is in the preset operating state is within a preset frequency threshold, Authorize the second operation corresponding to the second instruction; or, when the interval between the current time and the first time stamp is within a preset duration threshold, perform the second operation corresponding to the second instruction Authorization; or, if the second terminal does not switch from the preset operating state to the non-preset operating state after the time indicated by the first time stamp, perform the second operation corresponding to the second instruction Authorization.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction, and a second operation corresponding to the second instruction
  • the user identity authentication The information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated.
  • the processor is further configured to correspond to the first instruction when the user identity authentication result matches a preset authentication result The first operation authorization; in the case that the interval between the current time and the first time stamp is outside the preset time threshold, it is determined whether the second terminal is from after the time indicated by the first time stamp The preset operating state is switched to a non-preset operating state; and, in the case that the second terminal is not switched to the non-preset operating state, the second operation corresponding to the second instruction is authorized.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction, and a second operation corresponding to the second instruction
  • the user identity authentication The information also includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated.
  • the processor is further configured to: when the user identity authentication result matches a preset authentication result, and the current time is away from the first time stamp When the interval duration is within the preset duration threshold, the first operation corresponding to the first instruction is authorized; and, after the first operation is authorized, the second terminal is in the first operation. If the preset operating state is not switched to the non-preset operating state after the time indicated by a time stamp, the second operation corresponding to the second instruction is authorized.
  • the business instruction includes a first instruction and a second instruction
  • the business operation includes a first operation corresponding to the first instruction, and a second operation corresponding to the second instruction
  • the user identity authentication The information also includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated.
  • the processor when the second terminal starts from the time after the time indicated by the first time stamp When the preset operating state is switched to the non-preset operating state, the processor is further configured to freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to restart Authentication.
  • the terminal device further includes:
  • the third transceiver is configured to receive a second time stamp sent by the server, where the second time stamp is used to indicate the time when the second terminal switches from the preset operating state to the non-preset operating state , The closest time to the time when the second terminal sends the service response message;
  • the processor is further configured to determine that the second terminal does not start from the preset operation after the time indicated by the first time stamp when the second time stamp is earlier than the first time stamp.
  • the state is switched to the non-preset operating state; and, in the case that the second time stamp is later than the first time stamp, it is determined that the second terminal is switched from after the time indicated by the first time stamp
  • the preset operating state is switched to the non-preset operating state.
  • the terminal device further includes:
  • the third transceiver is configured to send the first time stamp to the server; and to receive the online verification result sent by the server, wherein the online verification result is determined by the server according to the second terminal's Whether to switch from the preset operating state to the non-preset operating state after a time indicated by a time stamp;
  • the processor is further configured to, if the online verification result is successful, determine that the second terminal has not switched from the preset operating state to the non-prevented state after the time indicated by the first time stamp. Set the operating state; and, in a case where the online verification result is a failure, it is determined that the second terminal switches from the preset operating state to the non-preset operating after the time indicated by the first time stamp status.
  • the processor is further configured to: if the user identity authentication result does not match a preset authentication result, The first operation authorization corresponding to the instruction, and the second operation authorization corresponding to the second instruction is denied; wherein, the business instruction includes a first instruction and a second instruction, and the business operation includes the same as the first instruction A corresponding first operation, and a second operation corresponding to the second instruction;
  • the first transceiver is further configured to send a new service instruction to the second terminal, and the new service instruction includes a second instruction.
  • the processor is further configured to use the second key and the second verification data to verify that the user identity authentication information is valid,
  • the service operation corresponding to the service instruction is authorized; wherein, the service response message further includes second verification data, the second verification data
  • the user identity authentication information is generated by processing a second key, where the second key is a key agreed upon in advance by the second terminal and the first terminal, and the second key and the first The keys are not the same.
  • this application provides a terminal device, including:
  • the second transceiver is configured to receive a service command from the first terminal; and, in a preset operating state, in response to the service command, send a service response message processed with the first key to the first terminal Terminal; wherein the service response message includes user identity authentication information, the user identity authentication information includes user identity authentication results, and the first key is a secret pre-appointed by the second terminal and the first terminal key;
  • a security unit for storing the user identity authentication information and the first key
  • the user identity authentication system is configured to generate a user identity authentication result before the terminal device enters the preset operating state, wherein the preset operating state means that the identity authentication system of the terminal device cannot generate the identity authentication result status.
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the user identity authentication result is generated.
  • the service response message further includes second verification data, and the second verification data is generated by the The user identity authentication information is generated by processing the second key, the second key being a key agreed upon in advance by the terminal device and the first terminal, and the second key and the first key Not the same.
  • the user identity authentication system before the terminal device enters the preset operating state, when the terminal When there is a digital key configured with mandatory identity authentication in the device, the user identity authentication system is also used to generate a user identity authentication result; wherein, the digital key configured with mandatory identity authentication requires the second terminal to enter the preset operating state Perform user identity authentication before;
  • the second terminal further includes:
  • the digital key service is used to store user identity authentication information in the security unit of the terminal device, and the user identity authentication information includes the user identity authentication result.
  • the present application provides a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute any method of the first aspect.
  • the present application provides a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute any method of the second aspect.
  • the present application provides a computer program product containing instructions that, when run on a computer, causes the computer to execute any method of the first aspect.
  • the present application provides a computer program product containing instructions that, when run on a computer, causes the computer to execute any method of the second aspect.
  • Figure 1 is a diagram of the system architecture involved when the digital key is applied to the vehicle to unlock;
  • FIG. 2 is a schematic diagram of an application scenario of the digital key identity authentication method in the embodiment of the application.
  • FIG. 3 is a schematic flowchart of an embodiment of the digital key identity authentication method of this application.
  • FIG. 4 is an example of a user interface when performing identity authentication in an example of an application scenario where a digital key is used as a car key;
  • Fig. 5 is an example of a user interface when the user cancels the authorization in an example of the application scenario of the digital key as the car key;
  • FIG. 6 is an example of an application scenario of a digital key as a car key, another schematic diagram of a user interface when the user cancels authorization;
  • FIG. 7 is another schematic diagram of the application scenario of the digital key identity authentication method in the embodiment of the application.
  • FIG. 8 is a schematic structural diagram of an implementation manner of the terminal device of this application.
  • FIG. 9 is a schematic structural diagram of an implementation manner of another terminal device of this application.
  • Fig. 2 is a schematic diagram of an application scenario of a digital key identity authentication method in an embodiment of the present application.
  • the second terminal is a terminal with a digital key.
  • the second terminal includes a security unit 210, and at least one digital key is stored in the digital key applet 211. Since the security unit 210 and the main chip (not shown in the figure) of the second terminal can independently supply power, the security unit 210 can be powered on regardless of the state of the main chip.
  • the digital key applet 211 may run in the security unit 210 to realize the function of the digital key.
  • the second terminal may include a mobile phone (cellphone), a smart phone (smartphone), a computer (computer), a tablet computer (tablet computer), a personal digital assistant (PDA), and a mobile Internet device (MID) , Wearable devices, etc.
  • the second terminal and the first terminal each have a communication unit 220 and 120, and the two terminals use these two communication units to interact.
  • the above-mentioned communication units 220 and 120 may adopt medium-range communication technologies, such as Bluetooth, Ultra Wide Band (UWB) technology, etc., or may adopt short-range wireless communication technologies, such as Near Field Communication (NFC), etc. .
  • the communication unit can simultaneously use the aforementioned multiple communication technologies to cope with diverse application scenarios.
  • the communication units of the first terminal and the second terminal can work independently of the power on of the main chip, and work independently through internal/external power supply when the main chip is not powered on, such as an NFC module.
  • the aforementioned external power supply refers to a power supply method that obtains energy from an electromagnetic field to supply power to the communication module.
  • the aforementioned internal power supply refers to a power supply mode in which the second terminal power supply is not completely consumed, and a small amount of power is reserved for powering the communication module. It should be noted that for communication units using Bluetooth, UWB and other technologies, if they can be powered on independently of the main chip, the communication modules using these technologies can also be used alone or together with other communication modules. In the first terminal of this application.
  • the first terminal is a terminal that verifies the legality of the digital key in the second terminal. After obtaining the information received by the communication unit 120, the processing unit 110 in the first terminal uses the received information to verify the legality of the digital key. When the processing unit 110 verifies that a certain digital key is legal, it sends a signal to the execution unit (not shown in the figure) in the first terminal to make the execution unit perform a preset or user-specified operation.
  • the digital key in this application can be applied in a variety of scenarios.
  • the aforementioned second terminal may be a mobile phone, a tablet computer, a smart wearable device, etc.
  • the first terminal may be a vehicle.
  • the aforementioned second terminal may be a mobile phone, a tablet computer, a smart wearable device, etc.
  • the first terminal may be a point of sale (POS), a transportation credit card machine, etc.
  • POS point of sale
  • the above-mentioned second terminal may be a mobile phone, a tablet computer, a smart wearable device, etc.
  • the first terminal may be an access control system.
  • a method for identity authentication of a digital key is provided.
  • the preset operating state such as shutdown or low power mode
  • a non-preset operating state such as normal battery mode
  • the user identity authentication information stored in the security unit is sent to the first terminal, and the first terminal can determine whether the user is the second terminal according to the user identity authentication information Legal holders of In this way, even if the second terminal is in a preset operating state (for example, shutdown or low battery mode), when the user uses the digital key in the second terminal, the user can verify the identity of the user on the basis of the original digital key to ensure the use of The user of the digital key in the second terminal is a legal user of the second terminal, which improves the security of using the digital key. In addition, this also prevents illegal users of the second terminal from bypassing the identity authentication step by shutting down or entering the second terminal into a low battery mode, causing losses to legitimate users of the second terminal.
  • a preset operating state for example, shutdown or low battery mode
  • Phase 1 Before the second terminal enters the preset operating state from the non-preset operating state
  • FIG. 3 is a schematic flowchart of an embodiment of the digital key identity authentication method of this application.
  • the second terminal may perform steps S101 to S102.
  • the aforementioned preset operating state may refer to a state where the identity authentication system of the second terminal cannot generate an identity authentication result, such as shutdown or low battery mode. For example, when the power level of the second terminal is less than a preset threshold, such as 5%, the second terminal enters a low power mode. At this time, only a small number of components in the second terminal work normally, and most components, such as the identity authentication system , Display screen, etc., all enter the non-working state.
  • the non-preset operating state may refer to a state other than the preset operating state, for example, the second terminal is in a normal power mode.
  • the digital key configured with mandatory identity authentication requires the second terminal to perform user identity authentication before entering the preset operating state.
  • the second terminal may include a digital key service.
  • the digital key service provides the management function of the digital key. Through the management interface of the digital key service, users can view one or more digital keys stored in the digital key applet, and perform mandatory identity authentication configuration for these digital keys. If the user configures mandatory identity authentication for a certain digital key, the user is required to perform identity authentication every time the digital key is used.
  • the second terminal may notify the first terminal through the wireless network, so that the first terminal performs related checks when authorizing service operations.
  • the second terminal When the second terminal switches from the non-preset operating state to the preset operating state, it needs to enter the state switching process to perform a series of preset operations. For example, when the second terminal switches directly from the normal power mode to the shutdown state, the second terminal enters the shutdown process and performs the preset operations in the shutdown process, such as displaying a dialog box confirming shutdown, and sending prompts to various applications to store data Broadcast etc. For another example, when the second terminal switches directly from the normal battery mode to the low battery mode, the second terminal enters the low battery processing flow and performs the preset operations in the low battery processing flow, such as voice prompts, dialog prompts, and display screens. Brightness adjustment, closing or suspending running programs in the background, etc.
  • the digital key service can add an identity authentication operation to the state switching process when the user has configured at least one digital key for mandatory identity authentication. That is, when the second terminal enters the state switching process of switching from the non-preset operating state to the preset operating state, the identity authentication system in the second terminal is activated, the user is authenticated, and the user identity authentication result is generated.
  • the aforementioned identity authentication process can be triggered by a digital key service.
  • the identity authentication system can use one or more existing identity authentication methods to authenticate users, such as personal identification number (Personal Identification Number, PIN), fingerprint, face, iris, bone Conduction, and behavior-based authentication, etc.
  • PIN Personal Identification Number
  • This may include active identity authentication means, such as PIN code, fingerprint, face, iris, etc., which need to be executed by the user according to the guidance of the user interface of the second terminal.
  • active identity authentication means such as PIN code, fingerprint, face, iris, etc.
  • it may also include passive (that is, user unaware) identity authentication means, such as behavior-based identity authentication, identity authentication based on wearable devices, and so on.
  • the identity authentication based on the wearable device may be wearable presence detection, wearable bone conduction identity authentication, wearable pulse identity authentication, and so on.
  • passive identity authentication means can be realized by the components of the second terminal itself (such as sensors, etc.), and can be realized by the third terminal (such as wearable devices, etc.) that can interact with the second terminal. Not limited. Which identity authentication method or methods are used in actual applications mainly depends on the identity authentication capabilities possessed or supported by the second terminal identity authentication system.
  • the identity authentication system collects the password, biometrics or other authentication data entered by the user, and then compares it with the pre-stored password, biometrics or other authentication data, so as to generate a user identity authentication result.
  • the digital key service can generate a user interface to inform it of the purpose of identity authentication performed this time.
  • this identity authentication is used to run at least one digital key in a preset operation. Use it for authorization under status.
  • the user interface can also display guidance information to guide the user to complete identity authentication.
  • FIG. 4 is a schematic diagram of a user interface during identity authentication in an example of an application scenario where a digital key is used as a car key.
  • the prompt text in the middle area is used to inform the user that this identity authentication is used to authorize the use of the digital key A in the shutdown state.
  • the images and text in the lower area are used to indicate that the user can use fingerprints or faces for identity authentication or cancel authorization.
  • FIG. 5 is a schematic diagram of a user interface when a user cancels authorization in an example of an application scenario where a digital key is used as a car key.
  • the prompt text in the upper area is used to inform the user of the consequences of canceling the authorization, that is, the digital car key cannot be used in the shutdown state.
  • the text in the lower area is used to instruct the user to confirm or re-authorize.
  • FIG. 6 is a schematic diagram of another user interface when a user cancels authorization in an example of an application scenario where a digital key is used as a car key.
  • the prompt text in the upper area is used to inform the user that the authorization has been cancelled, and other operations that the user can take if they want to use the car key in the off state.
  • the text and images in the lower area are used to instruct the user to re-configure the mandatory identity authentication of the digital car key.
  • the second terminal may not display the above-mentioned user interface, and the entire identity authentication process is executed in the background.
  • S102 Store the user identity authentication information including the user identity authentication result in the security unit.
  • the user identity authentication information including the user identity authentication result can be stored in the security unit so as to be recalled when the digital key is subsequently used.
  • existing security units can be used, such as embedded security units (eSE), inSE security modules integrated into the main chip (System on Chip, SoC) of mobile phones, and general integrated circuit card security units. (Universal Integrated Circuit Cards Secure Element, UICC SE) etc.
  • the digital key service can obtain the user identity authentication result, use it as the user identity authentication information, and directly store it in the security unit.
  • the digital key service can obtain the user identity authentication result, and then process the user identity authentication result with the second key agreed upon with the first terminal in advance to generate the second verification data, using To ensure that user identity authentication information has the characteristics of verifiability and non-repudiation.
  • the first terminal receives the user identity authentication information, it can use the pre-appointed second key to verify the user identity authentication information, so as to ensure that the user identity authentication information has not been tampered with during transmission, and the user identity The source of the authentication information is legal.
  • the second verification data and the user identity authentication result are used as user identity authentication information, and are stored in the security unit together.
  • the user identity authentication information at this time is sometimes also called identity authentication proof (Attestation).
  • the second verification data may be a digital signature, a message authentication code (Message Authentication Code, MAC), a hashed message authentication code (Hashed Message Authentication Code, HMAC), etc.
  • MAC message authentication code
  • HMAC hashed message authentication code
  • the digital key service can obtain the user identity authentication result and the first time stamp, and then use the user identity authentication result and the first time stamp together as the user identity authentication information and store them in the security unit. in.
  • the first time stamp in the embodiment of the present application is used to indicate the time when the user identity authentication result is generated.
  • the time when the user identity authentication system generates the user identity authentication result can be used as the first time stamp, or the time when the digital key service obtains the user identity authentication result as the first time stamp, or other
  • the approximate time point is used as the first time stamp. These time points are within a short period of time before the second terminal enters the preset operating state, and can also be understood as the short time from the start of the handover process to the storage of the user identity authentication information in the security unit Within paragraph. Therefore, no matter which time point is used as the first time stamp, it can indicate the time when the user identity authentication result is generated.
  • the first time stamp can be obtained from the outside by the digital key service, for example, generated by the identity authentication system, or generated by the digital key service itself, which is not limited in this application.
  • the digital key service can obtain the first time stamp from the identity authentication system or the trusted time service in the mobile phone’s trusted execution environment TEE, or from a trusted time server to ensure the first time stamp.
  • the credibility of the source of a timestamp may carry anti-tampering attributes (such as digital signatures), which is not limited in this application.
  • the digital key service can obtain the user identity authentication result and the first time stamp, and then use the user identity authentication result and the first time stamp with the second secret pre-appointed with the first terminal.
  • Key processing generates second verification data, which is used to ensure that the user identity authentication information has the characteristics of verifiability and non-repudiation.
  • the second verification data, the user identity authentication result, and the first time stamp are used together as user identity authentication information, and they are jointly stored in the security unit.
  • the user identity authentication information at this time can also be called identity authentication proof.
  • the user identity authentication information may be written into the digital key applet in the security unit.
  • the digital key service can set a specific indication field in the digital key applet, and use different values of the indication field to indicate the three states of the user identity authentication result, thereby writing the user identity authentication result Enter the digital key applet.
  • the tag indicates the identity authentication result
  • the value can be "1" to indicate user identity authentication
  • the result is passed, "2" indicates that the user identity authentication result is not passed, and "3" indicates that the user identity authentication result is incomplete.
  • TLV Type-Lenght-Value
  • Such information is referred to as the first information in this application, that is, the first information is a form of representation that the digital key applet displays the result of user identity authentication to the outside.
  • the aforementioned user identity authentication information includes the user identity authentication result, and it can also be considered that the user identity authentication information includes the first information, where the first information is used to indicate whether the identity authentication result is passed or failed, or that the identity authentication system is The identity authentication is not completed before the second terminal enters the preset operating state.
  • the digital key service can set another specific indication field in the digital key applet, and use the specific value of the indication field to indicate whether the second terminal writes the user identity authentication information into the security unit.
  • the indication field is used to indicate whether the second terminal is in a preset operating state when responding to the service instruction of the first terminal. For example, in external presentation, "1" may be used to indicate that the second terminal is in a preset operating state when sending a service response message to the first terminal, and "0" may be used to indicate that the second terminal is responding to a service command from the first terminal. In other operating states, such as non-preset operating states.
  • Such information is referred to as second information in this application. Therefore, in addition to the first information, the user identity authentication information may also include second information, where the second information is used to indicate whether the second terminal is in a preset operating state when sending a service response message to the first terminal.
  • the aforementioned second information may also be provided to the digital key applet by an NFC controller (NFC Controller).
  • NFC controller NFC Controller
  • first information and second information may be independently represented by two indication fields, or may be merged together and represented by the same indication field, which is not limited in this application.
  • the same specific indication field is used to indicate, the three states indicated by the first information and the two states that can be indicated by the second information can be combined, so that the six different specific indication fields can be selected. Value to indicate the six situations respectively.
  • the digital key service can set a specific indication field to indicate the existence of data. Then, the first time stamp, the second verification data, etc. are stored in the preset storage address, so that other information besides the first information and the second information can also be stored in the security unit.
  • the first information, the second information, and other information it is possible to determine whether the second terminal has completed identity authentication before entering the preset operating state, and the operating state of the second terminal when it sends a service response message to the first terminal .
  • the first time stamp, verification information, etc. are stored in the digital key applet, and transmitted to the first terminal when the digital key is used. In this way, the first terminal can know the situation of the second terminal through the information, and then perform risk control according to the preset security policy. How to carry out risk control will be explained in detail in the subsequent steps performed by the first terminal.
  • the user identity authentication information may be written into a broker applet in the security unit.
  • the security unit used in the embodiments of this application supports the Broker Interface (Amendment J) specification of the Global Platform (GP).
  • FIG. 7 is another schematic diagram of the application scenario of the digital key identity authentication method in this embodiment.
  • the agent applet 212 can provide user identity for all applets in the security unit 210 (including the digital key applet 211 and other applets that may exist). Certification Information. Therefore, the digital key service 230 can transmit any of the aforementioned user identity authentication information to the agent applet 212 for storage.
  • the user identity authentication result in the user identity authentication information is generated by the identity authentication system 240.
  • the digital key applet 211 in the second terminal interacts with the first terminal, if user identity authentication information needs to be provided, the digital key applet 211 obtains the stored user identity authentication information from the agent applet 212 through a standard interface .
  • the user can be authenticated one or more times to avoid the user entering the wrong password or failing to collect valid biometrics, etc. happensing. In this case, just store the result of the last identity authentication in the security unit.
  • the identity authentication system is triggered to authenticate the user.
  • the user interface shown in Figure 4 is displayed on the display screen of the second terminal to guide the user to input a fingerprint. The user prints in the print area and enters the fingerprint.
  • the fingerprint image collected by the identity authentication system during the first imprinting and the fingerprint image pre-stored in the second terminal are less than the preset threshold, so the identity authentication system judges the fingerprint entered for the first time The image does not match, that is, the identity authentication fails.
  • the second terminal does not store the result of "failure” in the security unit, but prompts the user that the identity authentication fails, and requires the user to re-enter the fingerprint image. The user wipes off the water from the finger and then reprints. If the similarity between the entered fingerprint image and the pre-stored fingerprint image is higher than the preset threshold, and the identity authentication is passed at this time, the second terminal stores the result of “pass” obtained last time in the security unit. If the number of times that the user repeatedly enters the fingerprint image exceeds the preset number of times, the results are all fail, and the second terminal stores the last result of "failure" in the security unit.
  • the original switching process in the second terminal can be suspended. Wait until the identity authentication information has been stored, and then continue the switching process. After the switching process is completed, the second terminal officially enters the preset operating state.
  • Phase 2 The user uses the digital key when the second terminal is in the preset running state
  • the second terminal may perform steps S103 to S104.
  • S103 The second terminal receives a service instruction from the first terminal.
  • the first terminal and the second terminal exchange information through a communication unit, and the communication unit needs to include a communication module that can be separately powered, such as an NFC module.
  • a communication module that can be separately powered such as an NFC module.
  • S104 In the preset operating state, the second terminal sends the service response message processed by using the first key to the first terminal in response to the service instruction.
  • the preset operating state in this application may refer to a state where the identity authentication system of the second terminal cannot generate an identity authentication result.
  • the second terminal adds the user identity authentication information stored in the security unit in phase one to the service response message, and uses the first key for processing.
  • the first key is a key agreed upon in advance by the second terminal and the first terminal, and the first key is different from the aforementioned second key used to generate the second verification data.
  • the first key in the second terminal can be stored in the digital key applet in the security unit. Then, the second terminal sends the processed service response message to the first terminal.
  • the service response message in this embodiment includes user identity authentication information.
  • the user identity authentication information may include only the user identity authentication result, the user identity authentication result and the second verification data, or the user identity authentication result and the first verification data.
  • the timestamp may also include the user identity authentication result, the first timestamp and the second verification data.
  • the service response message may also include other information, such as the aforementioned second information, protocol information, transaction/service identification information, identification information of the first terminal, random information values generated by the first terminal/second terminal, etc. The application is not limited.
  • the service response message may also include the first verification data.
  • the first verification data in this application refers to the use of the first key to process the user identity authentication information in the business response message, or process the user identity authentication information and other information in the business response message. Verification data.
  • the service response message can be regarded as a service response message processed by using the first key. Similar to the second verification data, when using the first key to process user identity authentication information, or user identity authentication information and other information, you can directly use the first key to process the information to obtain the first verification data, or you can This information is first compressed into a message digest, and then the message digest is processed with the first key to obtain the first verification data.
  • the encryption mechanism of the first key in this application can use existing symmetric or asymmetric encryption, or generate a session key after key negotiation based on asymmetric encryption, which will not be repeated here.
  • the service instructions are different, the corresponding service operations are correspondingly different, and the information required for the first terminal to determine whether to authorize the service operation is also different. Therefore, in an implementation manner, the information contained in the service response message may also be different according to different service instructions.
  • the second terminal before the second terminal responds to the service instruction, it may be judged whether the service instruction sent by the first terminal requires the second terminal to provide user identity authentication information, that is, whether the service operation corresponding to the service instruction is authorized, Need user authentication information. If user identity authentication information is required, the user identity authentication information in the security unit is added to the service response message; if it is not required, there is no need to provide the user identity authentication information to the first terminal.
  • the first terminal sends a service instruction to the second terminal; corresponding to the foregoing S104, the first terminal receives a service response message sent by the second terminal in response to the service instruction.
  • the first terminal may perform steps S105 to S106.
  • S105 The first terminal obtains user identity authentication information after passing the verification of the service response message using the first key.
  • the first key is a key agreed upon in advance by the second terminal and the first terminal. If the first terminal uses the first key to verify the service response message and fails, it means that the second terminal does not hold a digital key approved by the first terminal. If the first terminal uses the first key to successfully verify the service response message, it means that the second terminal successfully proves that it holds a digital key recognized by the first terminal, that is, the digital key in the second terminal is legal . At this time, the first terminal may further verify the user identity authentication information contained in the service response message.
  • the service response message includes user identity authentication information, other information, and first verification data
  • the first terminal uses the first key to process the user identity authentication information and other information, and calculates the first verification data. Then the first verification data is compared with the first verification data, and if the two are the same, the verification passes; if the two are different, the verification fails.
  • the first terminal can directly use the content in the user identity authentication information and the preset security policy to determine whether to authorize the service operation corresponding to the service instruction.
  • the service response message includes the second verification data
  • the first terminal needs to use the second key pre-appointed with the second terminal to verify whether the user identity authentication information is valid, and to ensure that the user identity authentication information is the digital key of the second terminal Service or identity authentication system generated.
  • the first terminal also needs to determine whether the content in the user identity authentication information conforms to a preset security policy. Only when these two conditions are met, can the business operation corresponding to the business instruction be authorized.
  • the user identity authentication information includes the user identity authentication result, the first time stamp, and the service response message includes the second verification data as an example to further illustrate the process of verifying whether the user identity authentication information is valid.
  • the first terminal uses the second key to process the user identity authentication information, that is, the user identity authentication result and the first time stamp, and calculate a second verification data. Then the second verification data is compared with the second verification data. If the two are the same, it is determined that the user identity authentication information is valid; if the two are different, it is determined that the user identity authentication information is invalid.
  • this method on the one hand, it can ensure that the user identity authentication information has not been tampered with during the transmission process, that is, the integrity of the user identity authentication information; on the other hand, it can ensure that the source of the user identity authentication information is legal, that is, Ensure the legal holder of the key on the second terminal, thereby ensuring that the user identity authentication information has the characteristics of verifiability and non-repudiation.
  • the service response message originally includes user identity authentication information. Even if the first key is not used for verification, the first terminal can obtain user identity authentication information from it. However, as mentioned above, if the verification using the first key fails, it means that the second terminal does not hold a digital key recognized by the first terminal. In this case, you do not need to use the user identity authentication information to perform the subsequent steps, directly Refuse to authorize business operations. If the first key is used to verify successfully, it means that the digital key in the second terminal is legal. At this time, the user identity authentication information in the service response message is then used to perform subsequent steps to increase the verification of the user identity, thereby improving the security of the digital key.
  • the business instruction sent by the first terminal does not require verification of user identity authentication information, that is, if the user identity authentication information is not required when determining whether to authorize the business operation corresponding to the business instruction, you can There is no need to use user authentication information to perform subsequent steps. In an implementation manner, at this time, it is possible to directly determine whether the service operation corresponding to the service instruction is authorized according to the verification result of the first key.
  • a preset security policy is stored in the first terminal, and the security policy includes one or more rules related to user identity authentication information.
  • the first terminal can compare the user identity authentication information with the rules in the security policy, and determine whether the user identity authentication information meets the rules in the security policy.
  • the business operation authorization corresponding to the business instruction.
  • the security policies of different first terminals can be different, and the security policies of the first terminal can also be different in different application scenarios.
  • the manufacturer of the first terminal such as a car factory, can bear their own risks.
  • the user identity authentication information here is obtained from the security unit in the second terminal, and the second terminal is in a preset operating state when obtained.
  • the user identity authentication information includes a user identity authentication result, which is generated by the identity authentication system of the second terminal before the second terminal enters the preset operating state.
  • the user identity authentication information may include the aforementioned second information.
  • the first terminal can clearly understand whether the second terminal is in a preset operating state when the second terminal sends a service response message to the first terminal.
  • the second information is used to indicate whether the second terminal is in a preset operating state when sending the service response message. Then, if the user identity authentication information includes the second information, the first terminal can use the second information to determine the state when the second terminal sends the service response message.
  • the identity authentication system of the second terminal cannot be used normally.
  • the user identity authentication result obtained is generated and stored before the second terminal enters the preset operating state, and is not generated in real time, which indicates that the current user is at greater risk when using the digital key.
  • the first terminal can perform risk control according to the preset security policy and user identity authentication information, and determine whether to authorize the business operation, thereby reducing the risk.
  • the user identity authentication information may include the aforementioned first information.
  • the first information is used to indicate whether the identity authentication result is "passed", "failed” or “not completed”.
  • the security policy includes a first rule, and the authentication result is preset to "pass” in the first rule. If the identity authentication result in the business response message is also "passed”, it matches the preset authentication result; if the identity authentication result in the business response message is also "failed” or "not completed", it matches the pre-defined authentication result. The authentication result set does not match.
  • Business instructions can include one or more different instructions.
  • the service instruction includes multiple different instructions
  • the multiple different instructions can be sent to the second terminal independently or together, which is not limited in this application.
  • the second terminal may respond separately and send corresponding service response messages to the first terminal respectively, or may respond once and send a service response message to the first terminal.
  • the first terminal sends multiple different commands to the second terminal, and the second terminal responds separately
  • the second terminal can first respond to the command sent first, and then the command sent after receiving it. You can first receive the command sent and then respond to multiple commands received one by one. That is, the present application does not limit the sequence between the steps of the second terminal receiving multiple instructions and responding to multiple instructions.
  • the second terminal can respond once, send a service response message to the first terminal, or respond separately, which is not limited in this application.
  • the business operation corresponding to the business instruction may include one operation or multiple operations, which is not limited in this application.
  • the first terminal and the second terminal may negotiate multiple service commands in different scenarios, and each service command in different scenarios may include one or more service operation requests. For which type or types of service operation requests are contained in the service instruction scenario currently sent by the first terminal to the second terminal, the first terminal judges whether to authorize the service operation.
  • the first terminal may be a vehicle, and the second terminal may be a mobile phone.
  • the communication unit in the vehicle includes multiple communication units. Different communication units can be used to distinguish different service instructions and corresponding service operations.
  • the corresponding service operation can be to unlock one side or all the car doors.
  • the communication module associated with the trunk of the vehicle sends a business instruction
  • the corresponding business operation may be unlocking the trunk.
  • the communication module associated with the startup module located inside the vehicle sends a business instruction
  • the corresponding business operation may be to start the engine. In this way, when the vehicle receives the service response message sent by the mobile phone, it can use different security policies to determine whether to authorize the corresponding service operation according to the different service instructions.
  • Security policy 1 includes the first rule.
  • the first rule is a rule regarding the result of user identity authentication, including two sub-rules.
  • the authentication result is preset to "pass” in the first rule.
  • Sub-rule a If the user identity authentication result in the service response message is also "passed", it matches the preset authentication result.
  • Sub-rule b If the identity authentication result in the service response message is "failed” or "not completed", it does not match the preset authentication result.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule. If it does, the first terminal directly authorizes the service operation corresponding to the service instruction. If not, the first terminal refuses to authorize the service operation corresponding to the service instruction.
  • the first terminal is a vehicle and the second terminal is a mobile phone
  • the business operation corresponding to the business instruction includes "unlocking" or "starting the engine”.
  • the phone is currently turned off.
  • the vehicle successfully verifies the service response message sent by the mobile phone, if the user identity authentication result in the user identity authentication information is "passed” and conforms to sub-rule a, then the business operation of "unlocking" or "starting the engine” is authorized.
  • Security policy 2 includes a first rule and a second rule.
  • the first rule is the same as in the aforementioned security policy 1, and will not be repeated here.
  • the second rule is a rule regarding the cumulative number of authorized service operations by the first terminal when the second terminal is in the preset operating state.
  • the accumulated number of authorizations for business operation authorization in the past when the second terminal is in the preset operating state is recorded.
  • a threshold of times is preset in the second rule, and the accumulated times of authorization are required to be within the threshold of times.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the accumulated authorization times meets the second rule. If these two rules are met at the same time, the first terminal authorizes the service operation corresponding to the service instruction. If any one of the rules is not met, the first terminal refuses to authorize the service operation corresponding to the service instruction.
  • the first terminal or the second terminal can display prompt information to the user to inform the user of the current cumulative number of authorizations, the upcoming consequences in the future, and the measures the user can take.
  • the first terminal is a vehicle and the second terminal is a mobile phone, and the business operation corresponding to the business instruction is "start the engine”.
  • the number threshold set in the second rule is 4. After the vehicle successfully verifies the service response message sent by the mobile phone, if the user identity authentication result in the user identity authentication information is "passed", it conforms to sub-rule a. If the digital key was used when the mobile phone was turned off or in low battery mode in the past, the vehicle has been authorized 4 times, and this is the 5th time, it does not meet the second rule. Therefore, the vehicle refused to authorize the business operation of "start the engine”.
  • a time period can also be preset in the second rule, requiring that the cumulative number of authorizations within a time period is within the threshold.
  • the second rule may require that the cumulative number of authorizations within 24 hours from the current time is within the number threshold.
  • the first terminal can impose certain restrictions on the use of the digital key in the preset operating state, thereby further reducing malicious use of the digital key on the second terminal that is in the preset operating state and lacks real-time protection. risks of.
  • Security policy 3 includes the first rule and the third rule.
  • the first rule is the same as in the aforementioned security policy 1, and will not be repeated here.
  • the third rule is a rule regarding the frequency of authorization of service operations by the first terminal when the second terminal is in the preset operating state.
  • the frequency of authorization can be determined by the number of authorizations within a certain period of time. In the first terminal, the number of authorizations for service operations in the past when the second terminal is in the preset operating state and the time corresponding to each authorization are recorded.
  • a frequency threshold is preset in the third rule, a time period is preset, and the frequency of authorization (that is, the number of authorizations in a time period) is required to be within the frequency threshold.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the authorization frequency meets the third rule. If these two rules are met at the same time, the first terminal authorizes the service operation corresponding to the service instruction. If any one of the rules is not met, the first terminal refuses to authorize the service operation corresponding to the service instruction.
  • the authorization frequency threshold is set to 10 times/month. After the vehicle successfully verifies the service response message sent by the mobile phone, if the user identity authentication result in the user identity authentication information is "passed", it conforms to sub-rule a. If the digital key has been used for 5 times when the mobile phone is turned off or in low-battery mode in the past month, this is the 6th time, which complies with the third rule. Therefore, the vehicle authorizes the business operation "start the engine".
  • the first terminal can impose certain restrictions on the use of the digital key in the preset operating state, thereby further reducing malicious use of the digital key on the second terminal that is in the preset operating state and lacks real-time protection. risks of.
  • the security policy 4 includes the first rule and the fourth rule.
  • the first rule is the same as in the aforementioned security policy 1, and will not be repeated here.
  • the fourth rule is a rule regarding the length of the interval between the time when the digital key is used and the time when the user identity authentication result is generated.
  • the user identity authentication information obtained by the first terminal further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated in the second terminal.
  • a duration threshold is preset in the fourth rule, and the interval duration between the current time and the first time stamp is required to be within the preset duration threshold.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the first time stamp meets the fourth rule. If these two rules are met at the same time, the first terminal authorizes the service operation corresponding to the service instruction. If any one of the rules is not met, the first terminal refuses to authorize the service operation corresponding to the service instruction.
  • the current time in the fourth rule may be the real-time time when the first terminal judges whether the first time stamp meets the fourth rule, or the time when the first terminal receives the service response message, or the first terminal Time to obtain user authentication information, etc. Since these time points are relatively close, no matter which time point is used as the current time, it can indicate the length of the interval between the time point when the user uses the digital key and the time point when the user identity authentication result is generated. The specific time point is not limited.
  • the first terminal is a vehicle and the second terminal is a mobile phone
  • the business operation corresponding to the business instruction includes "starting the engine”.
  • the interval is set to 24 hours.
  • the vehicle successfully verifies the service response message sent by the mobile phone, if the user identity authentication result in the user identity authentication information is "passed", it conforms to sub-rule a. If the first time stamp is 20:00 on March 5th, and the current time is 12:00 on March 6th, the interval between the two is 16 hours, which is less than the duration threshold of 24 hours, which complies with the fourth rule. Therefore, the vehicle authorizes the business operation "start the engine".
  • the security policy 5 includes the first rule and the fifth rule. Among them, the first rule is the same as that in the aforementioned security policy 1, which will not be repeated here.
  • the fifth rule is a rule regarding whether the second terminal switches to a non-preset operating state again after entering the preset operating state.
  • the first time stamp needs to be compared with the second time stamp, and the second time stamp is required to be earlier than the first time stamp, that is, the time indicated by the first time stamp is required After that, the second terminal does not switch from the preset operating state to the non-preset operating state again.
  • the user identity authentication information further includes a first time stamp, and the first time stamp is used to indicate the time when the identity authentication result is generated in the second terminal.
  • the second time stamp is used to indicate the time when the second terminal last switched from the preset operating state to the non-preset operating state. That is, the second time stamp is used to indicate the time when the second terminal switches from the preset operating state to the non-preset operating state, which is the closest time to the time when the second terminal sends the service response message.
  • the first time stamp and the third time stamp need to be compared, and the interval between the third time stamp and the first time stamp is required to be less than a preset threshold.
  • the first time stamp is used to indicate the time when the identity authentication result is generated in the second terminal.
  • the second terminal is about to enter the preset operating state
  • the third time stamp is used to indicate the last time the second terminal has been The time when the running state is switched to the preset running state. That is to say, in this implementation, the fifth rule requires that the third time stamp is very close to the first time stamp, and the third time stamp cannot be much later than the first time stamp.
  • the first time stamp does not meet the fifth rule, it means that after the first time stamp, the second terminal has entered a non-preset operating state, and the identity authentication system of the second terminal can work normally at the current moment, or the second terminal can provide The updated identity authentication information, the identity authentication information provided this time cannot represent the latest user authentication status. In either case, it proves that the second terminal has made an abnormal behavior in this service, that is, it provides information that should not be provided under normal circumstances, indicating that the current use of digital keys may have certain security risks. For example, the second terminal is replaying the outdated identity authentication information in an attempt to authorize the current business operation. If the second terminal has not been restarted after the time of shutdown, it means that the risk of replaying and misusing the identity authentication information is low. Therefore, the fifth rule can be combined with the aforementioned first rule to further reduce the security risk when using the digital key.
  • the step of determining may be performed locally in the first terminal, or may be sent by the first terminal to the server, and the server performs online verification.
  • the second time stamp may be obtained by the first terminal from the server.
  • the first terminal first receives the second time stamp sent by the server, and then determines whether the second terminal switches from the preset operating state to the non-default operating state after the time indicated by the first time stamp according to whether the second time stamp is later than the first time stamp. Preset running status.
  • the first terminal may send the online verification request including the first time stamp to the server. Then, based on the fifth rule stored in the server, the server determines whether the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp according to the first time stamp and the second time stamp Status, get the online verification result. The server then sends the online verification result to the first terminal.
  • the first terminal can determine that the second terminal has not switched from the preset operating state to the non-preset operating state after the time indicated by the first time stamp; if the online verification result is a failure, the first terminal It may be determined that the second terminal switches from the preset operating state to the non-preset operating state after the time indicated by the first time stamp.
  • the aforementioned server may be a server directly or indirectly communicating with the second terminal.
  • the second terminal is a mobile phone
  • the aforementioned server may be a server of a vehicle manufacturer, which communicates with the mobile phone account server, and the mobile phone account server communicates with the mobile phone.
  • the mobile phone is indirectly connected to the server of the vehicle manufacturer. Since the mobile phone is automatically connected to the mobile phone account server as soon as it is turned on, the vehicle manufacturer's server can obtain the mobile phone's boot time through the mobile phone account server.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the first timestamp meets the fifth rule. If these two rules are met at the same time, the first terminal authorizes the service operation corresponding to the service instruction. If any one of the rules is not met, the first terminal refuses to authorize the service operation corresponding to the service instruction. In addition, if the first time stamp does not comply with the fifth rule, the first terminal can also freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to perform identity authentication again, thereby improving the security of the digital key.
  • the first terminal is a vehicle and the second terminal is a mobile phone
  • the business operation corresponding to the business instruction includes "starting the engine”.
  • the security strategy adopts the aforementioned security strategy 5.
  • the vehicle After the vehicle successfully verifies the service response message sent by the mobile phone, it can be determined whether the user identity authentication result meets the sub-rule a in the first rule. Assuming that the user identity authentication result in the user identity authentication information is "passed", the sub-rule a is met.
  • the vehicle obtains the second time stamp, and determines whether the first time stamp and the second time stamp comply with the fifth rule. Assume that the first time stamp is 20:00 on March 5th, and the second time stamp is 10:00 on March 5th (the time of last power-on).
  • the second timestamp is earlier than the first timestamp, which means that the mobile phone was not restarted after it was turned off at 20:00 on March 5th, which complies with the fifth rule. Therefore, the vehicle is authorized to operate the business operation of "starting the engine".
  • the above-mentioned fifth rule may also be applied to any one of the aforementioned security policies 1-4 and subsequent security policies 6-8. That is, security policy 1-4 and security policy 6-8 can be combined with the above-mentioned fifth rule.
  • security policy 1-4 and security policy 6-8 can be combined with the above-mentioned fifth rule.
  • the second terminal runs from the preset after the time indicated by the first time stamp. The state re-enters the non-preset operating state. If it re-enters the non-preset operating state and does not meet the fifth rule, it means that although the second terminal provides the user identity verification result that meets the requirements, the first terminal subsequently determines that the user identity verification result is not the latest according to the fifth rule. Therefore, there are certain security risks.
  • the first terminal may freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to perform identity authentication again.
  • the aforementioned security policies 1-5 can also be combined with each other, and different security policies are adopted to correspond to different business operations.
  • the door opening operation of the car uses safety strategy 1, and any one of the safety strategies 2-5 is used to start the engine.
  • NFC NFC as a communication technology
  • the user first places the phone close to the NFC card reader on the car handle.
  • the car NFC card reader sends a business instruction, and after receiving the business response sent by the mobile phone, it judges based on the conditions of the security policy 1. If the verification is passed, the door lock in the car door is unlocked.
  • the user enters the car and puts the mobile phone in the card reading area in the car.
  • the car sends another business instruction, and after receiving the business response sent by the mobile phone, it verifies based on any of the security policies 2-5. If the verification passes, the user is allowed to start the engine.
  • the security policy 6 includes a first rule and a second rule.
  • the security policy 7 includes the first rule and the third rule.
  • the security policy 8 includes a first rule and a fourth rule.
  • the first rule is the same as in the foregoing security policy 1
  • the second rule is the same as in the foregoing security policy 2
  • the third rule is the same as in the foregoing security policy 3
  • the fourth rule is the same as in the foregoing security policy 4. I won't repeat them here.
  • the service instruction sent by the first terminal to the second terminal may include multiple instructions, and each instruction corresponds to multiple different business operations.
  • a business instruction may include a first instruction and a second instruction.
  • the business operation includes a first operation corresponding to the first instruction and a second operation corresponding to the second instruction.
  • the first terminal authorizes different business operations.
  • the first terminal needs to sequentially determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the cumulative number of authorizations meets the second rule. If the user identity authentication result conforms to the sub-rule a in the first rule, the first terminal authorizes the first operation; if not, the first terminal refuses to authorize the first operation. After the first operation is authorized, if the cumulative number of authorizations meets the second rule, the first terminal authorizes the second operation; if not, the first terminal refuses to authorize the second operation.
  • the first terminal needs to sequentially determine whether the user identity authentication result conforms to the sub-rule a in the first rule, and whether the authorization frequency conforms to the third rule. If the user identity authentication result conforms to the sub-rule a in the first rule, the first terminal authorizes the first operation; if not, the first terminal refuses to authorize the first operation. After the first operation is authorized, if the frequency of authorization meets the third rule, the first terminal authorizes the second operation; if not, the first terminal refuses to authorize the second operation.
  • the first terminal needs to sequentially determine whether the user identity authentication result conforms to the sub-rule a in the first rule, and whether the first time stamp conforms to the first rule. Four rules. If the user identity authentication result conforms to the sub-rule a in the first rule, the first terminal authorizes the first operation; if not, the first terminal refuses to authorize the first operation. After the first operation is authorized, if the first time stamp conforms to the fourth rule, the first terminal authorizes the second operation; if not, the first terminal refuses to authorize the second operation.
  • the first terminal may directly refuse to authorize the second operation without making subsequent judgments.
  • the first terminal is a vehicle and the second terminal is a mobile phone
  • the business instruction includes the first instruction and the second instruction, and both are sent to the mobile phone together.
  • the business operation corresponding to the first instruction is the first operation "unlock”
  • the business operation corresponding to the second instruction is the second operation "start the engine”.
  • the security policy adopts the aforementioned security policy 8. Among them, the interval length is set as 24 hours in the fourth rule.
  • the mobile phone After receiving the first instruction and the second instruction, the mobile phone sends a service response message to the vehicle, which contains the user identity authentication result and the first time stamp. After the vehicle successfully verifies the service response message sent by the mobile phone, it first determines whether the user identity authentication result meets the sub-rule a in the first rule. Assuming that the user identity authentication result in the user identity authentication information is "passed” and conforms to the sub-rule a, the vehicle is authorized for the business operation of "unlocking". At this time, the car lock is opened, allowing the user to enter the car first. Then determine whether the first timestamp meets the fourth rule.
  • the vehicle authorizes the business operation of "starting the engine". At this time, the vehicle engine starts and the user can drive the vehicle.
  • first instruction and second instruction may also be sent to the mobile phone separately.
  • the authentication module on the car sends different business instructions to the mobile phone at different stages.
  • first when the user approaches the car, he uses his mobile phone to interact with the communication module associated with the car door.
  • the car sends a business instruction about unlocking to the mobile phone, the first instruction.
  • the mobile phone After receiving the first instruction, the mobile phone sends a service response message to the vehicle, which contains the user identity authentication result. After the vehicle successfully verifies the service response message sent by the mobile phone, it is determined whether the user identity authentication result meets the sub-rule a in the first rule.
  • the vehicle is authorized for the business operation of "unlocking".
  • the car lock is opened, allowing the user to enter the car first.
  • positioning technology such as UWB positioning
  • the car sends the mobile phone a business instruction about starting the engine, that is, the second instruction.
  • the mobile phone sends another service response message to the vehicle, which contains the user identity authentication result and the first time stamp.
  • the vehicle After the vehicle verifies the service response message sent by the mobile phone successfully, and determines that the user identity authentication result meets the sub-rule a in the first rule, it is determined whether the first time stamp meets the fourth rule. Assuming that the first time stamp conforms to the fourth rule as mentioned above, the vehicle authorizes the business operation of "starting the engine”. At this time, the vehicle engine starts and the user can drive the vehicle.
  • the mobile phone may send multiple service response messages, and multiple service response messages may all include the same user identity authentication information.
  • the process of determining whether the first rule is met may also be repeated one or more times.
  • the security policy 9 includes the first rule and the fifth rule. Among them, the first rule is the same as in the aforementioned security policy 1, and the fifth rule is the same as in the aforementioned security policy 5, which will not be repeated here.
  • the business instruction may include a first instruction and a second instruction.
  • the business operation includes a first operation corresponding to the first instruction and a second operation corresponding to the second instruction.
  • the first terminal authorizes different business operations.
  • the first terminal needs to sequentially determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the first timestamp meets the fifth rule. If the user identity authentication result conforms to the sub-rule a in the first rule, the first terminal authorizes the first operation; if not, the first terminal refuses to authorize the first operation. After the first operation is authorized, if the first time stamp conforms to the fifth rule, the first terminal authorizes the second operation; if not, the first terminal refuses to authorize the second operation. In addition, if the first time stamp does not comply with the fifth rule, the first terminal may also freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to perform identity authentication again, thereby improving the security of the use of the digital key.
  • the first terminal may directly refuse to authorize the second operation without determining whether the first timestamp meets the fifth rule.
  • the first terminal is a vehicle
  • the second terminal is a mobile phone
  • the business instruction includes the first instruction and the second instruction.
  • the business operation corresponding to the first instruction is the first operation "unlock”
  • the business operation corresponding to the second instruction is the second operation "start the engine”.
  • the security policy adopts the aforementioned security policy 9.
  • the vehicle After the vehicle successfully verifies the service response message sent by the mobile phone, it first determines whether the user identity authentication result meets the sub-rule a in the first rule. Assuming that the user identity authentication result in the user identity authentication information is "passed” and conforms to the sub-rule a, the vehicle is authorized for the business operation of "unlocking". At this time, the car lock is opened, allowing the user to enter the car first. Then, the second time stamp is obtained, and it is judged whether the first time stamp and the second time stamp comply with the fifth rule.
  • the vehicle is authorized to operate the business operation of "starting the engine". At this time, the vehicle engine starts and the user can drive the vehicle.
  • the security policy 10 includes a first rule, a fourth rule, and a fifth rule.
  • the first rule is the same as in the aforementioned security policy 1
  • the fourth rule is the same as in the aforementioned security policy 4
  • the fifth rule is the same as in the aforementioned security policy 5, which will not be repeated here.
  • the business instruction may include a first instruction and a second instruction.
  • the business operation includes a first operation corresponding to the first instruction and a second operation corresponding to the second instruction.
  • the first terminal authorizes different business operations.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the first timestamp meets the fourth rule and the fifth rule. If the user identity authentication result conforms to the sub-rule a in the first rule, the first terminal authorizes the first operation; if not, the first terminal refuses to authorize the first operation. After the first terminal authorizes the first operation, if the first time stamp conforms to the fourth rule, the first terminal authorizes the second operation; if not, it is determined whether the first time stamp conforms to the fifth rule. If the first time stamp conforms to the fifth rule, the first terminal authorizes the second operation; if not, the first terminal refuses to authorize the second operation.
  • the first terminal can also freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to perform identity authentication again, thereby increasing the number The safety of the key. If the first terminal refuses to authorize the first operation, the first terminal may directly refuse to authorize the second operation without determining whether the first time stamp conforms to the fifth rule.
  • the first terminal is a vehicle
  • the second terminal is a mobile phone
  • the business instruction includes the first instruction and the second instruction.
  • the business operation corresponding to the first instruction is the first operation "unlock”
  • the business operation corresponding to the second instruction is the second operation "start the engine”.
  • the security policy adopts the aforementioned security policy 10.
  • the vehicle After the vehicle successfully verifies the service response message sent by the mobile phone, it first determines whether the user identity authentication result meets the sub-rule a in the first rule. Assume that the user identity authentication result in the user identity authentication information is "passed", which conforms to sub-rule a. Therefore, the vehicle is authorized to "unlock” the business operation. At this time, the car lock is opened, allowing the user to enter the car first. Then, it is judged whether the first time stamp meets the fourth rule. Assuming that the first time stamp is 20:00 on March 5th, and the current time is 12:00 on March 7th, the interval between the two is 40 hours, which is greater than the duration threshold of 24 hours, which does not meet the fourth rule.
  • the second time stamp is obtained again, and it is judged whether the first time stamp and the second time stamp comply with the fifth rule. Assuming that the second timestamp is 10:00 on March 5th, and the second timestamp is earlier than the first timestamp, it means that the mobile phone has not been restarted after being turned off at 20:00 on March 5th, which complies with the fifth rule.
  • the vehicle authorizes the business operation of "starting the engine”. At this time, the vehicle engine starts and the user can drive the vehicle.
  • the security policy 11 also includes the first rule, the fourth rule, and the fifth rule.
  • the first rule is the same as in the aforementioned security policy 1
  • the fourth rule is the same as in the aforementioned security policy 4
  • the fifth rule is the same as that in the aforementioned security policy 8, which will not be repeated here.
  • the business instruction may include a first instruction and a second instruction.
  • the business operation includes a first operation corresponding to the first instruction and a second operation corresponding to the second instruction.
  • the first terminal authorizes different business operations.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule a in the first rule, and whether the first timestamp meets the fourth rule and the fifth rule. If the user identity authentication result conforms to the sub-rule a in the first rule, and whether the first timestamp conforms to the fourth rule, the first terminal authorizes the first operation; if any of the two does not conform, the first The terminal refuses to authorize the first operation. After the first terminal authorizes the first operation, if the first time stamp conforms to the fifth rule, the first terminal authorizes the second operation; if not, the first terminal refuses to authorize the second operation.
  • the first terminal can also freeze the digital key, or instruct the second terminal to freeze the digital key, or instruct the user to perform identity authentication again, thereby increasing the number The safety of the key. If the first terminal refuses to authorize the first operation, the first terminal may directly refuse to authorize the second operation without determining whether the first time stamp conforms to the fifth rule.
  • the first terminal is a vehicle
  • the second terminal is a mobile phone
  • the business instruction includes the first instruction and the second instruction.
  • the business operation corresponding to the first instruction is the first operation "unlock”
  • the business operation corresponding to the second instruction is the second operation "start the engine”.
  • the security policy adopts the aforementioned security policy 11.
  • the vehicle After the vehicle successfully verifies the service response message sent by the mobile phone, it first determines whether the user identity authentication result meets the subrule a in the first rule, and whether the first time stamp meets the fourth rule. Assume that the user identity authentication result in the user identity authentication information is "passed", which conforms to sub-rule a. Assuming that the first time stamp is 20:00 on March 5th and the current time is 12:00 on March 6th, the interval between the two is 16 hours, which is less than the duration threshold of 24 hours, which complies with the fourth rule. Therefore, the vehicle is authorized to "unlock" the business operation. At this time, the car lock is opened, allowing the user to enter the car first.
  • the second time stamp is acquired, and it is judged whether the first time stamp and the second time stamp comply with the fifth rule. Assuming that the second timestamp is 10:00 on March 5th, and the second timestamp is earlier than the first timestamp, it means that the mobile phone has not been restarted after being turned off at 20:00 on March 5th, which complies with the fifth rule. Therefore, the vehicle authorizes the business operation of "starting the engine". At this time, the vehicle engine starts and the user can drive the vehicle.
  • the security policy 12 includes the first rule, and any one or more of the second rule, the third rule, the fourth rule, and the fifth rule.
  • the first rule is the same as in the foregoing security policy 1
  • the second rule is the same as in the foregoing security policy 2
  • the third rule is the same as in the foregoing security policy 3
  • the fourth rule is the same as in the foregoing security policy 4.
  • the fifth rule is the same as in the aforementioned security policy 5, and will not be repeated here.
  • the business instruction may include a first instruction and a second instruction.
  • the business operation includes a first operation corresponding to the first instruction and a second operation corresponding to the second instruction.
  • the first terminal authorizes different business operations.
  • the first terminal needs to determine whether the user identity authentication result meets the sub-rule b in the first rule. If the user identity authentication result meets the sub-rule b in the first rule, the first terminal authorizes the first operation corresponding to the first instruction, and the first terminal may also directly reject the second operation corresponding to the second instruction Authorization, there is no need to judge whether it meets other rules.
  • the aforementioned digital key identity authentication method may further include the following steps: the first terminal sends a new service instruction to the second terminal, wherein the new service instruction includes the second instruction.
  • the first terminal when the first terminal sends a new service instruction to the second terminal, it may be sent cyclically once or multiple times, which is not limited in this application.
  • the first terminal is a vehicle
  • the second terminal is a mobile phone
  • the mobile phone is currently in the off state.
  • Business instructions include first instructions and second instructions.
  • the business operation corresponding to the first instruction is the first operation "unlock”
  • the business operation corresponding to the second instruction is the second operation "start the engine”.
  • the security strategy adopts the aforementioned security strategy 12.
  • the vehicle After the vehicle successfully verifies the service response message sent by the mobile phone, it first determines whether the user identity authentication result meets the subrule b in the first rule. Assuming that the user identity authentication result in the user identity authentication information is "incomplete” and conforms to sub-rule b, the vehicle authorizes the business operation of "unlocking” and refuses the business operation authorization of "start the engine". In fact, whether the business operation of "unlocking” is authorized here does not depend on the result of user identity authentication. Regardless of whether the user identity authentication result is "passed", “failed” or “not completed", the business operation of "unlocking" can be authorized.
  • the vehicle sends a new business instruction to the mobile phone.
  • the new business instruction no longer includes the instruction about "unlocking", that is, the first instruction, but only includes the instruction about "start the engine", that is, the second instruction. Since the car lock has been opened, the user can enter the car first to charge the mobile phone. After the user turns on the mobile phone again and enters the normal power mode, the user can complete the user identity authentication in real time in the power-on state.
  • the vehicle sends a new service instruction to the mobile phone. After receiving a service response message that satisfies the authorized second operation preset security policy, the vehicle authorizes the service operation "start the engine", the vehicle engine is started, and the user can drive the vehicle.
  • security policies 1-12 are only a few examples that can be applied to the digital key identity authentication method in this application. Those skilled in the art can also make other combinations of the aforementioned five rules according to different application scenarios. , Or combine these five rules with other rules to form other security policies. Moreover, as long as there is no conflict between several security policies, several security policies can be combined.
  • business instructions can also include more instructions. Whether to authorize the business operation corresponding to a certain business instruction can be determined by one or more rules.
  • the second terminal of the present application when the second terminal of the present application is in a non-preset operating state, if a service instruction sent by the first terminal is received, the second terminal may also generate a service response message in response to the service instruction.
  • the service response message may also include the aforementioned user identity authentication result, the first time stamp and other content.
  • the user identity authentication result at this time may be generated by the second terminal performing identity authentication on the user in real time, or may be previously stored in the security unit.
  • the first terminal can use the first key to verify the service response message, and use the aforementioned possible security policies, such as security policy 1, security policy 4, etc., to further perform risk judgments, thereby improving the number The safety of the key.
  • the second terminal may also perform the following steps:
  • the second terminal may also perform the following steps:
  • the second terminal Before storing the user identity authentication information in the security unit, the second terminal invalidates the original user identity authentication information stored in the security unit.
  • the user identity authentication information stored in the digital key applet or the proxy applet stored in the security unit can be deleted.
  • the user identity authentication information previously stored in the security unit may be marked as invalid.
  • the server can also invalidate the original user identity authentication information.
  • the server may also send notification information to the first terminal, such as "the mobile phone is back online”, “user identity authentication information is invalid”, etc., to inform the user that the original user identity authentication information has expired.
  • a terminal device is provided.
  • the terminal device can be used in a variety of different scenarios, such as vehicles, POS machines, traffic card readers, access control systems, etc. Please refer to FIG. 8, which is a schematic structural diagram of an implementation manner of the terminal device.
  • the terminal device 300 includes: a first transceiver 320 and one or more processors 310.
  • the first transceiver 320 is configured to send a service instruction to the second terminal; and to receive a service response message sent by the second terminal.
  • the first transceiver 320 may be an NFC communication module, or may be a Bluetooth module, UWB module, or the like.
  • the processor 310 is configured to obtain user identity authentication information after passing the verification of the service response message by using the first key; and verify the user identity authentication information; wherein, the first key is the second The terminal and the terminal device 300 pre-appointed key; the user identity authentication information is stored in the security unit of the second terminal, the user identity authentication information includes the user identity authentication result, the user identity authentication result is determined by the The identity authentication system of the second terminal is generated before the second terminal enters a preset operating state, and the preset operating state refers to a state where the identity authentication system of the second terminal cannot generate an identity authentication result.
  • the processor 310 may use various interfaces and lines to connect various parts of the entire terminal device 300.
  • the processor 310 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the aforementioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (generic array logic, GAL), or any combination thereof.
  • the terminal device 300 may also include a memory, and the memory stores one or more computer programs, and the one or more computer programs include instructions. When the instructions are executed by the one or more processors 310, the terminal device 300 is caused to implement part or all of the steps of any method executed by the first terminal in the first embodiment.
  • the memory may include volatile memory (volatile memory), such as random access memory (RAM); it may also include non-volatile memory, such as flash memory (flash memory), hard disk Hard disk drive (HDD) or solid-state drive (SSD); the memory may also include a combination of the above types of memory.
  • the terminal device 400 includes a security unit 410, a second transceiver 420, and an identity authentication system 440.
  • the second transceiver 420 is configured to receive a service command from the first terminal; and, in a preset operating state, in response to the service command, send a service response message processed with the first key to the first terminal One terminal.
  • the service response message includes user identity authentication information
  • the user identity authentication information includes a user identity authentication result
  • the first key is a key agreed upon in advance by the terminal device 400 and the first terminal.
  • the second transceiver 420 may be an NFC communication module, or a Bluetooth module, UWB module, or the like.
  • the second transceiver 420 can be powered on independently, and the second transceiver 420 can be powered on independently regardless of whether the main chip of the terminal device is in the normal power mode, or in the shutdown or low power mode.
  • the security unit 410 is configured to store the user identity authentication information and the first key.
  • the security unit can be an embedded security unit (embedded SE, eSE), an inSE security module integrated into the main chip (System on Chip, SoC) of a mobile phone, and a universal integrated circuit card security unit (Universal Integrated Circuit Cards). Secure Element, UICC SE), etc.
  • the security unit 410 stores a digital key applet 411, and the aforementioned first key is stored in the digital key applet 411.
  • the user identity authentication system 440 is configured to generate a user identity authentication result before the terminal device 400 enters the preset operating state, where the preset operating state means that the identity authentication system of the terminal device cannot generate identity authentication The status of the result. It should be noted that, when the terminal device 400 is in the normal power mode, the user identity authentication system 440 may also collect the user's password or biometrics to authenticate the user.
  • the terminal device 400 may also include a digital key service 430.
  • the digital key service 430 can be connected to the identity authentication system 440 and the security unit 410 respectively.
  • the digital key service provides the terminal device 400 with digital key management functions. Through the management interface provided by the digital key service 430, the user can view one or more digital keys stored in the digital key applet 411, and perform mandatory identity authentication configuration on these digital keys.
  • the digital key service 430 can add an identity authentication operation to the state switching process of the terminal device 400 when the user has configured at least one digital key (for example, the first key) for mandatory identity authentication.
  • the digital key service 430 can trigger the identity authentication process in the terminal device 400, and the identity authentication system 440 is used to generate a user identity authentication result.
  • the digital key service 430 may also generate a user interface to inform the user of the purpose of the identity authentication performed this time.
  • the digital key service 430 may obtain the user identity authentication result and the first time stamp, and then store the user identity authentication result and the first time stamp together as user identity authentication information in the security unit 410.
  • this embodiment also provides a computer-readable storage medium, the storage medium includes instructions, when the instructions are run on a computer, the computer is caused to execute any task executed by the first terminal in the first embodiment. a way.
  • This embodiment also provides another computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute any method executed by the second terminal in the first embodiment.
  • the readable storage medium here may be a magnetic disk, an optical disc, a DVD, a USB, a read-only memory (ROM) or a random access memory (RAM), etc.
  • the application does not limit the specific storage medium form.
  • embodiments of the present application also provide a computer program product containing instructions, which when run on a computer, cause the computer to execute the steps of any method executed by the first terminal in the first embodiment. , Or execute the steps of any method executed by the second terminal in the first embodiment.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the terminal device and the computer-readable storage medium in this embodiment are used to execute part or all of the steps of any digital key identity authentication method in the first embodiment, and accordingly have the beneficial effects of the aforementioned method. I won't repeat it here.
  • the execution order of each step should be determined by its function and internal logic, and the size of each step sequence number does not mean the order of execution, and does not limit the implementation process of the embodiment.
  • the “plurality” in this specification refers to two or more.
  • words such as “first” and “second” are used to distinguish the same or similar items with basically the same function and effect.
  • the words “first”, “second” and the like do not limit the quantity and execution order, and the words “first” and “second” do not limit the difference.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Mechanical Engineering (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Human Computer Interaction (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)
  • Lock And Its Accessories (AREA)

Abstract

本发明实施例公开一种数字钥匙的身份认证方法、终端及介质。在第二终端机从非预设运行状态进入到预设运行状态之前，首先利用第二终端中的身份认证系统对用户进行身份认证，将得到的身份认证信息存储到第二终端的安全单元中。然后，当需要使用第二终端中的数字钥匙时，再将存储在第二终端的安全单元中的身份认证信息发送给第一终端，第一终端就可以根据身份认证信息来验证，从而判断使用第二终端中的数字钥匙的用户是否为第二终端的合法持有者。通过这样的方法，即便第二终端处于预设运行状态(例如关机或者低电量模式)下，用户使用第二终端中的数字钥匙时也可以对用户身份进行认证，从而提高了数字钥匙的安全性。

Description

数字钥匙的身份认证方法、终端设备及介质
本申请要求在2019年4月22日提交中国国家知识产权局、申请号为201910324313.5、发明名称为“数字钥匙的身份认证方法、终端设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数字钥匙技术领域，具体涉及一种数字钥匙的身份认证方法、终端设备以及计算机可读存储介质。
背景技术
数字钥匙(Digital Key,DK)与物理钥匙(即实体钥匙)/遥控钥匙(key fob)相对，其可以利用通信技术，以终端设备，例如手机或可穿戴智能设备等，作为密钥载体，使用户可以通过终端设备来进行开锁、锁止以及启动车辆等业务操作。
请参见图1，图1为数字钥匙应用于车辆开锁时所涉及的系统架构图。在汽车内存在认证单元810、电子控制单元(Electronic Control Unit，ECU)830和通信单元820。在认证单元810中保存有认证密钥。在手机中存在安全单元(Secure Element，SE)910和通信单元920。安全单元910是具备防物理攻击、防篡改能力的硬件单元。安全单元910具备独立的处理器，能够为在其中运行的数字钥匙小程序(Digital Key Applet，DK Applet)911提供安全的运行环境，并且能够保证存储在其中的资产(例如认证密钥)的安全性和机密性。在开锁时，手机中的数字钥匙小程序911响应于汽车发送的业务指令，并通过通信单元920发送包括密文的业务响应消息给汽车中的通信单元820，其中，业务响应消息中的密文使用认证密钥生成。汽车中的通信单元820接收到包含密文的业务响应消息之后，由认证单元810利用认证密钥对密文进行验证。电子控制单元830根据验证结果来判断是否授权开锁。通过这样的方式，就可以实现利用数字钥匙进行开锁的操作。
近场通信(Near Field Communication，NFC)是一种短距离的无线通信技术。由于终端设备中的NFC模块和安全单元均可以单独供电，故而即便不给终端设备的主芯片供电，也可以单独利用NFC模块和安全单元来完成与汽车的信息交互。也就是说，即便在终端设备处于关机的情况下，也可以用终端设备来完成开锁、锁止、启动车辆等业务操作。
很多终端设备中都具有身份认证系统，可以利用密码、指纹、人脸等来完成用户的身份认证。为了增强数字钥匙的安全性，可以在使用数字钥匙时增加身份认证。例如，用户可以设置使用数字钥匙始终需要进行身份认证，防止数字钥匙被冒用。此时，在用户使用数字钥匙执行开锁、启动车辆等业务操作时，用户在终端设备上进行一次身份认证才能够使用该数字钥匙。又例如，车辆在开锁、启动之前，也可以主动发起请求，要求用户在终端设备上进行一次身份认证。但是，终端设备中的身份认证系统都在一个可信执行环境(Trusted Execution Environment，TEE)中执行。运行在终端设备上的应用，只能通过系统服务接口 发起身份认证并获得身份认证结果。也就是说，身份认证系统必须在终端设备的主芯片处于工作状态下才能运行。
因此，当终端设备在关机状态下，用户就无法完成身份认证。为了使终端设备处于关机时也可以实现数字钥匙的功能，故而当终端设备在关机状态下，往往在使用数字钥匙时不进行身份认证。这就使得攻击者能够在获取合法用户的终端设备后，通过关机来强行绕过合法用户设置的身份认证限制，即数字钥匙存在安全漏洞。
发明内容
本申请提供一种数字钥匙的身份认证方法，以解决在终端设备处于关机状态下使用数字钥匙，无法完成身份认证，存在安全漏洞的问题。
第一方面，本申请提供一种数字钥匙的身份认证方法，包括：
第一终端向第二终端发送业务指令；
所述第一终端接收所述第二终端发送的业务响应消息；
所述第一终端采用第一密钥对所述业务响应消息验证通过后，得到用户身份认证信息，其中，所述第一密钥为所述第二终端与所述第一终端预先约定的密钥；所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无法生成身份认证结果的状态；
所述第一终端验证所述用户身份认证信息。
采用本实现方式，即便第二终端处于预设运行状态(例如关机或者低电量模式)下，用户在使用第二终端中的数字钥匙时，第一终端也可以利用第二终端在进入预设运行状态之前保存在第二终端的安全单元中的用户身份认证信息，来对用户的身份进行验证。因此，采用本实现方式，即便第二终端处于关机或者低电量模式下，也可以验证使用第二终端中的数字钥匙的用户是否为第二终端的合法用户，从而提高了数字钥匙使用的安全性。
结合第一方面，在第一方面第一种可能的实现方式中，所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，则所述第一终端对所述业务指令对应的业务操作授权。
采用本实现方式，即便第二终端处于预设运行状态(例如关机或者低电量模式)下，用户在使用第二终端中的数字钥匙时，第一终端也可以利用用户身份认证结果以及预设的认证结果来验证，从而决定是否对业务操作授权，进而提高了数字钥匙使用的安全性，也降低了第一终端被非法用户使用的风险。
结合第一方面，在第一方面第二种可能的实现方式中，所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内，则所述第一终端对所述业务指令对应的业务操作授权；或者，
如果所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内，则所述第一终端对所述业务指令对应的业务操作授权。
采用本实现方式，第一终端可以利用用户身份认证结果，以及第二终端处于预设运行状态时对业务操作授权的累计次数或者频度来进行双重验证，进而进一步提高数字钥匙使用的安全性。其中，通过对在预设运行状态下使用数字钥匙的情况进行一定的限制，可以减少恶意使用处于预设运行状态下的、缺少实时保护的第二终端上的数字钥匙的风险。
结合第一方面，在第一方面第三种可能的实现方式中，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内，则所述第一终端对所述业务指令对应的业务操作授权。
采用本实现方式，第一终端可以利用用户身份认证结果，以及第一时间戳来进行双重验证，进而进一步提高数字钥匙使用的安全性，降低风险。其中，通过对在预设运行状态下使用数字钥匙的时间点与第一时间戳的间隔时长进行一定的限制，可以减少处于预设运行状态下的、缺少实时保护的第二终端上的数字钥匙的使用风险。
结合第一方面及第一方面的第一种至第二种实现方式，在第一方面第四种可能的实现方式中，该方法还包括：
如果所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至非预设运行状态，则所述第一终端冻结所述数字钥匙，或者指示所述第二终端冻结所述数字钥匙，或者指示用户重新进行身份认证。
采用本实现方式，通过判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态，可以判断本次提供的身份认证信息是否是最新的用户身份认证信息，从而确定本次业务中第二终端是否存在异常行为。如果存在异常行为，则可以采取一定的保护措施，例如冻结数字要是，或者指示用户重新进行身份认证。因此，通过在前述单次或者双重验证的基础上，增加该验证可以进一步降低数字钥匙的使用风险。
结合第一方面，在第一方面第五种可能的实现方式中，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，并且，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态，则所述第一终端对所述业务指令对应的业务操作授权。
采用本实现方式，第一终端可以利用用户身份认证结果，以及第一时间戳来进行双重验证，进而进一步提高数字钥匙使用的安全性。其中，通过判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态，可以判断本次提供的身份认证信息是否是最新的用户身份认证信息，从而确定本次业务中第二终端是否存在异常行为。因此，通过增加该验证可以进一步降低数字钥匙的使用风险。
结合第一方面，在第一方面第六种可能的实现方式中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，则所述第一终端对所述第一指令对应的第一操作授权；
在对所述第一操作授权之后，如果在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内，或者，在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内，或者，当前时间距离所述第一时间戳的间隔时长处于预设时长阈值之内，或者，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态，则所述第一终端对所述第二指令对应的第二操作授权。
采用本实现方式，当业务指令包括多个指令的时候，第一终端可以利用用户身份认证结果、第二终端处于预设运行状态时对业务操作授权的累计次数或频度，以及第一时间戳，采用不同的验证条件来对不同的业务指令做验证，从而进一步提高数字钥匙使用的安全性。
结合第一方面，在第一方面第七种可能的实现方式中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，则所述第一终端对所述第一指令对应的第一操作授权；
如果当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之外，则所述第一终端判断所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至非预设运行状态；
如果没有切换至所述非预设运行状态，则所述第一终端对所述第二指令对应的第二操作授权。
采用本实现方式，当业务指令包括多个指令的时候，第一终端可以利用用户身份认证结果以及第一时间戳，采用不同的验证条件来对不同的业务指令做验证，从而进一步提高数字钥匙使用的安全性。
结合第一方面，在第一方面第八种可能的实现方式中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内，则所述第一终端对所述第一指令对应的第一操作授权；
在对所述第一操作授权之后，如果所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态，则所述第一终端对所述第二指令对应的第二操作授权。
采用本实现方式，当业务指令包括多个指令的时候，第一终端可以利用用户身份认证结果以及第一时间戳，采用不同的验证条件来对不同的业务指令做验证，从而进一步提高数字钥匙使用的安全性。
结合第一方面及第一方面的第五种至第八种实现方式，在第一方面第九种可能的实现方式中，所述第一终端验证所述用户身份认证信息的步骤，还包括：
如果所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态，则所述第一终端冻结所述数字钥匙，或者，指示所述第二终端冻结所述数字钥匙，或者，指示用户重新进行身份认证。
采用本实现方式，通过判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态，可以判断本次提供的身份认证信息是否是最新的用户身份认证信息，从而确定本次业务中第二终端是否存在异常行为。如果存在异常行为，则可以采取一定的保护措施，例如冻结数字要是，或者指示用户重新进行身份认证。因此，通过在前述验证的基础上，增加该验证可以进一步降低数字钥匙的使用风险。
结合第一方面及第一方面的第五种至第九种实现方式，在第一方面第十种可能的实现方式中，确定所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至所述非预设运行状态，包括：
接收服务器发送的第二时间戳，所述第二时间戳用于指示所述第二终端从所述预设运行状态切换至所述非预设运行状态的时间中，距离所述第二终端发送所述业务响应消息的时间最近的时间；
如果所述第二时间戳早于所述第一时间戳，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至所述非预设运行状态；
如果所述第二时间戳晚于所述第一时间戳，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态。
采用本实现方式，可以在第一终端本地判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态。
结合第一方面及第一方面的第五种至第九种实现方式，在第一方面第十一种可能的实现方式中，确定所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至非预设运行状态，包括：
所述第一终端向服务器发送所述第一时间戳；
所述第一终端获取所述服务器发送的联机验证结果，所述联机验证结果由所述服务器根据所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至所述非预 设运行状态而确定；
如果所述联机验证结果为成功，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至所述非预设运行状态；
如果所述联机验证结果为失败，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态。
采用本实现方式，可以在远程服务器上进行联机验证，由服务器来判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态。
结合第一方面，在第一方面第十二种可能的实现方式中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果所述用户身份认证结果与预设的认证结果不匹配，则所述第一终端对所述第一指令对应的第一操作授权；
如果所述用户身份认证结果与预设的认证结果不匹配，则所述第一终端拒绝对所述第二指令对应的第二操作授权；
所述方法还包括：
第一终端向第二终端发送新的业务指令，所述新的业务指令包括第二指令。
采用本实现方式，当业务指令包括多个指令的时候，第一终端可以利用用户身份认证结果等来对不同的业务指令做验证。无论用户身份认证结果的验证是否通过，为了提高用户体验，都可以对一部分风险相对较低的业务操作授权，对另一部分风险相对较高的业务操作拒绝授权。然后再发起新的业务指令，针对是否对尚未获得授权的业务操作进行授权进行验证。
结合第一方面，在第一方面第十三种可能的实现方式中，所述业务响应消息中还包括第二验证数据，所述第二验证数据由所述用户身份认证信息经过第二密钥处理生成；
所述第一终端验证所述用户身份认证信息的步骤，包括：
如果利用第二密钥和所述第二验证数据，验证所述用户身份认证信息为有效，并且，所述用户身份认证信息符合预设的安全策略，则所述第一终端对所述业务指令对应的业务操作授权；其中，所述第二密钥为所述第二终端与所述第一终端预先约定的密钥，所述第二密钥与所述第一密钥不相同。
采用本实现方式，在利用用户身份认证信息来验证是否可以对业务操作授权之前，先利用第二密钥和第二验证数据对用户身份认证信息本身进行验证，一方面，可以保证用户身份认证信息在传输过程中没有被篡改，即确保用户身份认证信息的完整性；另一方面，可以保证用户身份认证信息的发送来源合法，即确保第二终端上的密钥的合法持有者。
第二方面，本申请提供一种数字钥匙的身份认证方法，包括：
第二终端接收来自第一终端的业务指令；
所述第二终端在预设运行状态下，响应于所述业务指令，将采用第一密钥处理过的业务 响应消息发送给所述第一终端；其中，所述业务响应消息中包括用户身份认证信息，所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入所述预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无法生成身份认证结果的状态，所述第一密钥为所述第二终端与所述第一终端预先约定的密钥。
采用本实现方式，第二终端进入预设运行状态之前，第二终端需要对用户进行一次身份认证，将用户身份认证信息保存在第二终端的安全单元中。当第二终端处于预设运行状态(例如关机或者低电量模式)时，用户使用第二终端中的数字钥匙，第二终端就可以将安全单元中的用户身份认证信息发送给第一终端，使第一终端可以利用这些信息来进行验证。因此，采用本实现方式可以确保是第二终端的合法用户在使用第二终端中的数字钥匙，提高了在第二终端处于预设运行状态下使用数字钥匙的安全性。
结合第二方面，在第二方面第一种可能的实现方式中，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述用户身份认证结果生成的时间。
采用本实现方式，第一终端可以利用用户身份认证结果，以及第一时间戳进行双重甚至三重验证，也可以利用用户身份认证结果和第一时间戳来对不同的业务指令分别进行验证，从而可以进一步提高数字钥匙使用的安全性。
结合第二方面及第二方面的第一种实现方式，在第二方面第二种可能的实现方式中，所述业务响应消息中还包括第二验证数据，所述第二验证数据由所述用户身份认证信息经过所述第二密钥处理生成，所述第二密钥为所述第二终端与所述第一终端预先约定的密钥，所述第二密钥与所述第一密钥不相同。
采用本实现方式，第一终端在利用用户身份认证信息来验证是否可以对业务操作授权之前，可以先利用第二密钥和第二验证数据对用户身份认证信息本身进行验证，一方面，可以保证用户身份认证信息在传输过程中没有被篡改，即确保用户身份认证信息的完整性；另一方面，可以保证用户身份认证信息的发送来源是合法的，即确保第二终端上的密钥的合法持有者。
结合第二方面及第二方面的第一种至第二种实现方式，在第二方面第三种可能的实现方式中，在所述第二终端接收来自所述第一终端的业务指令的步骤之前，还包括：
所述第二终端在进入所述预设运行状态之前，如果存在配置有强制身份认证的数字钥匙，则生成用户身份认证结果；其中，配置有强制身份认证的数字钥匙要求所述第二终端在进入所述预设运行状态之前进行用户身份认证；
所述第二终端将用户身份认证信息存储到第二终端的安全单元中，所述用户身份认证信息包括所述用户身份认证结果。
采用本实现方式，第二终端进入预设运行状态之前，第二终端需要对配置有强制身份认证的数字钥匙进行一次用户身份认证，将用户身份认证信息保存在第二终端的安全单元中。这样，即便第二终端处于预设运行状态(例如关机或者低电量模式)时需要使用该数字钥匙，第二终端也可以将安全单元中的用户身份认证信息发送给第一终端，进而使第一终端可以利用这些信息来进行验证，提高了在第二终端处于预设运行状态下使用数字钥匙的安全性。
第三方面，本申请提供一种终端设备，包括：
第一收发器，用于向第二终端发送业务指令；以及，接收所述第二终端发送的业务响应消息；
处理器，用于采用第一密钥对所述业务响应消息验证通过后，得到用户身份认证信息；以及，验证所述用户身份认证信息；其中，所述第一密钥为所述第二终端与所述终端设备预先约定的密钥；所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无法生成身份认证结果的状态。
结合第三方面，在第三方面第一种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配的情况下，所述业务指令对应的业务操作授权。
结合第三方面，在第三方面第二种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内的情况下，对所述业务指令对应的业务操作授权；或者，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内的情况下，对所述业务指令对应的业务操作授权。
结合第三方面，在第三方面第三种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内的情况下，对所述业务指令对应的业务操作授权。
结合第三方面及第三方面的第一种至第二种实现方式，在第三方面第四种可能的实现方式中，所述处理器还用于在所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至非预设运行状态的情况下，冻结所述数字钥匙，或者指示所述第二终端冻结所述数字钥匙，或者指示用户重新进行身份认证。
结合第三方面，在第三方面第五种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态的情况下，则对所述业务指令对应的业务操作授权；其中，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间。
结合第三方面，在第三方面第六种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配的情况下，对所述第一指令对应的第一操作授权；以及，在对所述第一操作授权之后，在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内的情况下，对所述第二指令对应的第二操作授权；或者，在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内的情况下，对所述第二指令对应的第二操作授权；或者，在当前时间距离所述第一时间戳的间隔时长处于预设时长阈值之内的情况下，对所述第二指令对应的第二操作授权；或者，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态的情况下，对所述第二指令对应的第二操作授权。其中，所述业务指令包含第一指令和第二指 令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间。
结合第三方面，在第三方面第七种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配的情况下，对所述第一指令对应的第一操作授权；在当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之外的情况下，判断所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至非预设运行状态；以及，在所述第二终端没有切换至所述非预设运行状态的情况下，对所述第二指令对应的第二操作授权。其中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间。
结合第三方面，在第三方面第八种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内的情况下，对所述第一指令对应的第一操作授权；以及，在对所述第一操作授权之后，处于所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态的情况下，对所述第二指令对应的第二操作授权。其中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间。
结合第三方面及第三方面的第五种至第八种实现方式，在第三方面第九种可能的实现方式中，当所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态时，所述处理器还用于冻结所述数字钥匙，或者，指示所述第二终端冻结所述数字钥匙，或者，指示用户重新进行身份认证。
结合第三方面及第三方面的第五种至第九种实现方式，在第三方面第十种可能的实现方式中，所述终端设备还包括：
第三收发器，用于接收服务器发送的第二时间戳，其中，所述第二时间戳用于指示所述第二终端从所述预设运行状态切换至所述非预设运行状态的时间中，距离所述第二终端发送所述业务响应消息的时间最近的时间；
所述处理器还用于在所述第二时间戳早于所述第一时间戳的情况下，确定所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至所述非预设运行状态；以及，在所述第二时间戳晚于所述第一时间戳的情况下，确定所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态。
结合第三方面及第三方面的第五种至第九种实现方式，在第三方面第十一种可能的实现方式中，所述终端设备还包括：
第三收发器，用于向服务器发送所述第一时间戳；以及，接收所述服务器发送的联机验证结果，其中，所述联机验证结果由所述服务器根据所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至所述非预设运行状态而确定；
所述处理器还用于在所述联机验证结果为成功的情况下，确定所述第二终端在所述第一 时间戳指示的时间之后没有从所述预设运行状态切换至所述非预设运行状态；以及，在所述联机验证结果为失败的情况下，确定所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态。
结合第三方面，在第三方面第十二种可能的实现方式中，所述处理器还用于在所述用户身份认证结果与预设的认证结果不匹配的情况下，对所述第一指令对应的第一操作授权，以及，拒绝对所述第二指令对应的第二操作授权；其中，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作；
所述第一收发器还用于向第二终端发送新的业务指令，所述新的业务指令包括第二指令。
结合第三方面，在第三方面第十三种可能的实现方式中，所述处理器还用于在利用第二密钥和所述第二验证数据，验证所述用户身份认证信息为有效，并且，所述用户身份认证信息符合预设的安全策略的情况下，对所述业务指令对应的业务操作授权；其中，所述业务响应消息中还包括第二验证数据，所述第二验证数据由所述用户身份认证信息经过第二密钥处理生成，所述第二密钥为所述第二终端与所述第一终端预先约定的密钥，所述第二密钥与所述第一密钥不相同。
第四方面，本申请提供一种终端设备，包括：
第二收发器，用于接收来自第一终端的业务指令；以及，在预设运行状态下，响应于所述业务指令，将采用第一密钥处理过的业务响应消息发送给所述第一终端；其中，所述业务响应消息中包括用户身份认证信息，所述用户身份认证信息包括用户身份认证结果，所述第一密钥为所述第二终端与所述第一终端预先约定的密钥；
安全单元，用于存储所述用户身份认证信息以及所述第一密钥；
用户身份认证系统，用于在所述终端设备进入所述预设运行状态之前生成用户身份认证结果，其中，所述预设运行状态是指所述终端设备的身份认证系统无法生成身份认证结果的状态。
结合第四方面，在第四方面第一种可能的实现方式中，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述用户身份认证结果生成的时间。
结合第四方面及第四方面的第一种实现方式，在第四方面第二种可能的实现方式中，所述业务响应消息中还包括第二验证数据，所述第二验证数据由所述用户身份认证信息经过所述第二密钥处理生成，所述第二密钥为所述终端设备与所述第一终端预先约定的密钥，所述第二密钥与所述第一密钥不相同。
结合第四方面及第四方面的第一种至第二种实现方式，在第四方面第三种可能的实现方式中，在所述终端设备进入所述预设运行状态之前，当所述终端设备中存在配置有强制身份认证的数字钥匙时，用户身份认证系统还用于生成用户身份认证结果；其中，配置有强制身份认证的数字钥匙要求所述第二终端在进入所述预设运行状态之前进行用户身份认证；
所述第二终端还包括：
数字钥匙服务，用于将用户身份认证信息存储到所述终端设备的安全单元中，所述用户身份认证信息包括所述用户身份认证结果。
第五方面，本申请提供一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，使得所述计算机执行第一方面的任一种方法。
第六方面，本申请提供一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，使得所述计算机执行第二方面的任一种方法。
第七方面，本申请提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行第一方面的任一种方法。
第八方面，本申请提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行第二方面的任一种方法。
采用上述的终端设备和计算机可读存储介质，其有益效果与第一方面和第二方面的数字钥匙身份认证方法的有益效果相同，此处不再赘述。
附图说明
为了更清楚地说明本申请的技术方案，下面将对实施例中的附图作简单地介绍。
图1为数字钥匙应用于车辆开锁时所涉及的系统架构图；
图2为本申请的实施例中数字钥匙的身份认证方法的应用场景的一个示意图；
图3为本申请的数字钥匙的身份认证方法的一个实施例的流程示意图；
图4为数字钥匙作为车钥匙的应用场景的一个例子中，进行身份认证时的用户界面示意图；
图5为数字钥匙作为车钥匙的应用场景的一个例子中，用户取消授权时的一个用户界面示意图；
图6为数字钥匙作为车钥匙的应用场景的一个例子中，用户取消授权时的另一个用户界面示意图；
图7为本申请的实施例中数字钥匙的身份认证方法的应用场景的另一个示意图；
图8为本申请的终端设备的一种实现方式的结构示意图；
图9为本申请的另一种终端设备的一种实现方式的结构示意图。
具体实施方式
图2是本申请的实施例中数字钥匙的身份认证方法的应用场景的一个示意图。
在图2中，第二终端为具有数字钥匙的终端。第二终端包括了安全单元210，数字钥匙小程序211中存储有至少一把数字钥匙。由于安全单元210与第二终端的主芯片(图中未示出)能够独立供电，因此，无论主芯片处于哪一种状态，安全单元210均可以上电工作。数字钥匙小程序211可以在安全单元210中运行，以实现数字钥匙的功能。第二终端可以包括移动电话(cellphone)，智能手机(smartphone)，计算机(computer)，平板电脑(tablet computer)，个人数码助理(personal digital assistant，PDA)，移动互联网设备(mobile Internet device，MID)，可穿戴设备等。
第二终端和第一终端中各有一个通信单元220和120，两个终端利用这两个通信单元来进行交互。上述的通信单元220和120可以采用中距离通信技术，例如蓝牙、超带宽(Ultra Wide Band，UWB)技术等，也可以采用短距离无线通信技术，例如近场通信(Near Field Communication，NFC)等。此外，通信单元可以同时采用前述的多种通信技术，以便应对多 样的应用场景。在本申请的实施例中，第一终端和第二终端的通信单元能够独立于主芯片上电工作，在主芯片不上电时通过内部/外部供电来单独工作，例如NFC模块等。前述的外部供电是指从电磁场中获取能量来给通信模块供电的供电方式。前述的内部供电是指第二终端电源没完全消耗光，保留有少量电量，用于给通信模块供电的供电方式。需要说明的是，对于采用蓝牙、UWB等技术的通信单元而言，如果其能够独立于主芯片而单独上电工作，采用这些技术的通信模块也可以单独或者与其他通信模块一起，被应用在本申请的第一终端中。
第一终端为验证第二终端中的数字钥匙的合法性的终端。第一终端中的处理单元110在获取到通信单元120接收到的信息之后，利用接收到的信息来验证数字钥匙的合法性。当处理单元110验证某一数字钥匙为合法时，就向第一终端中的执行单元(图中未示出)发出信号，使执行单元去执行预设的或者用户指定的操作。
本申请中的数字钥匙可以应用在多种场景中。例如，在数字钥匙作为车钥匙的应用场景中，上述的第二终端可以是手机、平板电脑、智能穿戴设备等，第一终端可以是车辆。又例如，在数字钥匙用于支付的场景中，上述的第二终端可以是手机、平板电脑、智能穿戴设备等，第一终端可以是销售终端(point of sale，POS)、交通刷卡机等。还例如，在数字钥匙作为门钥匙的应用场景中，上述的第二终端可以是手机、平板电脑、智能穿戴设备等，第一终端可以是门禁系统。
除了终端设备处于关机状态的情况以外，当终端设备处于其中的身份认证系统无法工作的模式(下文叫低电量模式)时，尽管终端设备并没有关机，但是其仍然无法满足在使用数字钥匙时进行身份认证的需求。
为此，在本申请的第一个实施例中，提供一种数字钥匙的身份认证方法。在第二终端从非预设运行状态(例如正常电量模式)进入到预设运行状态(例如关机或者低电量模式)之前，首先利用第二终端中的身份认证系统对用户进行身份认证，将得到的用户身份认证信息存储到第二终端的安全单元中。然后，当要使用第二终端中的数字钥匙时，再将存储在安全单元中的用户身份认证信息发送给第一终端，第一终端就可以根据用户身份认证信息来确定用户是否为第二终端的合法持有者。这样，即便第二终端处于预设运行状态(例如关机或者低电量模式)，用户使用第二终端中的数字钥匙时也可以在原本数字钥匙的基础上，增加对用户身份的验证，从而确保使用第二终端中的数字钥匙的用户是第二终端的合法用户，提高了数字钥匙使用的安全性。另外，这也避免了第二终端的非法用户通过关机或者使第二终端进入低电量模式的方法，来绕过身份认证的步骤，给第二终端的合法用户造成损失。
针对第二终端从非预设运行状态进入到预设运行状态之前，以及用户在第二终端处于预设运行状态下使用数字钥匙这两个阶段，以下将分别说明这两个阶段中第一终端和第二终端所执行的步骤。
阶段一：第二终端从非预设运行状态进入到预设运行状态之前
请参见图3，图3为本申请的数字钥匙的身份认证方法的一个实施例的流程示意图。其中，在阶段一中，第二终端可以执行S101至S102的步骤。
S101：在进入预设运行状态之前，如果存在配置有强制身份认证的数字钥匙，则生成用户身份认证结果。
上述的预设运行状态可以是指第二终端的身份认证系统无法生成身份认证结果的状态，例如关机或者低电量模式等。例如，当第二终端的电源电量小于预设阈值，比如5％时，第二终端进入到低电量模式，此时，第二终端中仅少量的组件正常工作，大部分组件，例如身份认证系统、显示屏等，都进入不工作的状态。而非预设运行状态可以是指除预设运行状态以外的状态，例如第二终端处于正常电量模式。
配置有强制身份认证的数字钥匙要求第二终端在进入预设运行状态之前进行用户身份认证。可选地，在一种实现方式中，第二终端可以包括数字钥匙服务。数字钥匙服务提供了数字钥匙的管理功能。通过数字钥匙服务的管理界面，用户可以查看数字钥匙小程序中所保存的一把或者多把数字钥匙，并对这些数字钥匙进行强制身份认证配置。如果用户对某一把数字钥匙配置了强制身份认证，那么每一次使用该把数字钥匙时都要求用户进行一次身份认证。
可选地，在用户对数字钥匙进行强制身份认证配置后，第二终端可以通过无线网络通知第一终端，使第一终端在授权业务操作时进行相关的检查。
在第二终端从非预设运行状态切换到预设运行状态时，需要进入到状态切换流程，执行一系列的预设操作。例如，当第二终端从正常电量模式切换直接切换至关机状态时，第二终端进入关机流程，执行关机流程中预设的操作，比如显示确认关机的对话框、向各个应用程序发出提示存储数据的广播等。又例如，当第二终端从正常电量模式切换直接切换至低电量模式时，第二终端进入低电量处理流程，执行低电量处理流程中预设的操作，比如声音提示、对话框提示、显示屏亮度调整、关闭或暂停后台正在运行的程序等。数字钥匙服务能够在用户配置了至少一个强制身份认证的数字钥匙时，在状态切换流程中增加一次身份认证操作。即，当第二终端进入从非预设运行状态切换到预设运行状态的状态切换流程时，启动第二终端中的身份认证系统，对用户进行身份认证，生成用户身份认证结果。可选地，前述的身份认证流程可以由数字钥匙服务来触发。
需要说明的是，身份认证系统可以采用现有的一种或者多种身份认证手段来对用户进行身份认证，例如个人通用身份标识码(Personal Identification Number，PIN)、指纹、人脸、虹膜、骨传导，以及基于行为的认证等。这其中可以包括主动的身份认证手段，例如PIN码、指纹、人脸、虹膜等，这些都需要用户根据第二终端的用户界面的引导来执行。此外，也可以包括被动(即用户无感知)的身份认证手段，例如基于行为的身份认证、基于可穿戴设备进行的身份认证等。其中，基于可穿戴设备进行的身份认证可以是可穿戴在场检测、可穿戴骨传导身份认证、可穿戴脉搏身份认证等。这些被动的身份认证手段可以通过第二终端本身具有的组件(例如传感器等)来实现，可以通过能与第二终端进行交互的第三终端(例如可穿戴设备等)来实现，本申请对此不作限定。在实际应用中采用哪一种或者几种身份认证手段，这主要依赖于第二终端身份认证系统所具有或所支持的身份认证能力。身份认证系统采集到用户输入的密码、生物特征或者其他认证数据，然后与预先存储的密码、生物特征或者其他认证数据进行比较，从而可以生成用户身份认证结果。
可选地，在进行身份认证的过程中，数字钥匙服务可以生成用户界面，以告知其本次执行的身份认证的用途，例如本次身份认证是用于对至少一把数字钥匙在预设运行状态下使用进行授权。同时，用户界面还可以显示引导信息，以引导用户完成身份认证。例如，图4为数字钥匙作为车钥匙的应用场景的一个例子中，进行身份认证时的用户界面示意图。在图4的用户界面中，中间区域中的提示文字用于告知用户，本次身份认证是用于对数字钥匙A在 关机状态下的使用进行授权。下方区域中的图像和文字，用于指示用户可以采用指纹或者人脸来进行身份认证，或者取消授权。
可选地，在一种实现方式中，如果用户取消授权，则还可以生成另一用户界面，告知用户取消授权的后果，请用户确认。例如，图5为数字钥匙作为车钥匙的应用场景的一个例子中，用户取消授权时的一个用户界面示意图。在图5的用户界面中，上方区域中的提示文字用于告知用户取消授权的后果，即无法在关机状态下使用数字车钥匙。下方区域中的文字，用于指示用户进行确认操作，或者重新授权。
可选地，在另一种实现方式中，如果用户取消授权，则还可以跳转至强制身份认证的配置界面，使用户可以重新进行强制身份认证的配置，更改原本的配置。例如，图6为数字钥匙作为车钥匙的应用场景的一个例子中，用户取消授权时的另一个用户界面示意图。在图6的用户界面中，上方区域中的提示文字用于告知用户已经取消授权，以及告知用户如果希望在关机状态下使用车钥匙所能够采取的其他操作。下方区域中的文字和图像，用于指示用户重新进行数字车钥匙的强制身份认证的配置。
需要说明的是，当采用前述的被动的身份认证手段来对用户进行身份认证时，第二终端可以不显示上述的用户界面，而将整个身份认证流程放在后台执行。
S102：将包括用户身份认证结果的用户身份认证信息存储到安全单元中。
在生成身份认证结果之后，可以将包括用户身份认证结果的用户身份认证信息存储到安全单元中，以便后续使用数字钥匙的时候调用。本申请实施例中可以采用现有的安全单元，例如嵌入式安全单元(embedded SE，eSE)、集成到手机主芯片(System on Chip，SoC)之中的inSE安全模块，通用集成电路卡安全单元(Universal Integrated Circuit Cards Secure Element，UICC SE)等。
可选地，在第一种实现方式中，数字钥匙服务可以获取用户身份认证结果，将其作为用户身份认证信息，直接存储到安全单元中。
可选地，在第二种实现方式中，数字钥匙服务可以获取用户身份认证结果，然后将用户身份认证结果用预先与第一终端约定好的第二密钥处理，生成第二验证数据，用于保证用户身份认证信息具有可验证、不可抵赖的特性。这样，第一终端在接收到用户身份认证信息之后，就可以利用预先约定的第二密钥对该用户身份认证信息进行验证，从而确保用户身份认证信息在传输过程中没有被篡改，以及用户身份认证信息的发送来源是合法的。最后，将第二验证数据和用户身份认证结果一起作为用户身份认证信息，共同存储到安全单元中。此时的用户身份认证信息，有时也被称为身份认证证明(Attestation)。
需要说明的是，在实际应用时，第二验证数据可以是数字签名、消息认证码(Message Authentication Code，MAC)、散列消息身份验证码(Hashed Message Authentication Code，HMAC)等。在用第二密钥处理用户身份认证结果时，可以直接用第二密钥处理用户身份认证结果，得到第二验证数据，也可以将用户身份认证结果先压缩成消息摘要，然后用第二密钥处理消息摘要，得到第二验证数据。
可选地，在第三种实现方式中，数字钥匙服务可以获取用户身份认证结果和第一时间戳， 然后将用户身份认证结果和第一时间戳一起作为用户身份认证信息，共同存储到安全单元中。
本申请实施例中的第一时间戳用于指示所述用户身份认证结果生成的时间。在实际应用时，可以采用用户身份认证系统生成用户身份认证结果的时间点作为第一时间戳，也可以采用数字钥匙服务获取到用户身份认证结果的时间点作为第一时间戳，还可以采用其他近似的时间点作为第一时间戳。这些时间点处于第二终端进入到预设运行状态之前的一个很短的时间段内，也可以理解为处于从切换流程开始，至将用户身份认证信息存储到安全单元中这一较短的时间段内。因此，无论以哪一个时间点作为第一时间戳，都可以指示出用户身份认证结果生成的时间。第一时间戳可以是数字钥匙服务从外部获取，比如由身份认证系统生成，也可以由数字钥匙服务自己生成，本申请对此不作限定。在一个实现方式中，数字钥匙服务可以从手机可信执行环境TEE中的身份认证系统或可信时间服务获取第一时间戳，也可以从一个可信时间服务器获取第一时间戳，从而确保第一时间戳来源的可信度。此外该第一时间戳可能携带防篡改属性(如数字签名)，本申请对此不作限定。
可选地，在第四种实现方式中，数字钥匙服务可以获取用户身份认证结果和第一时间戳，然后将用户身份认证结果和第一时间戳用预先与第一终端约定好的第二密钥处理，生成第二验证数据，用于保证用户身份认证信息具有可验证、不可抵赖的特性。最后，将第二验证数据、用户身份认证结果和第一时间戳一起作为用户身份认证信息，共同存储到安全单元中。此时的用户身份认证信息，也可以被称为身份认证证明。
本实现方式中的第二验证数据可以参考第二种实现方式中的相关描述，第一时间戳可以参考第三种实现方式中的相关描述，此处不再赘述。
可选地，在将用户身份认证信息存储到安全单元的一种实现方式中，可以将用户身份认证信息写到安全单元中的数字钥匙小程序中。
例如，数字钥匙服务可以对数字钥匙小程序中的某一个特定的指示字段进行设置，以该指示字段的不同取值，来表示关于用户身份认证结果的三种状态，从而将用户身份认证结果写入数字钥匙小程序中。例如，数字钥匙小程序可以在以传统的标签-长度-值(Type-Lenght-Value，TLV)格式编码时，在标签(Tag)中指示身份认证结果，值可以以“1”表示用户身份认证结果为通过，以“2”表示用户身份认证结果为未通过，以“3”表示用户身份认证结果为未完成。这样的信息，在本申请中称之为第一信息，即第一信息是数字钥匙小程序将用户身份认证结果对外展现的一种表示形式。因此，前述的用户身份认证信息包括用户身份认证结果，也可以认为是用户身份认证信息包括第一信息，其中，第一信息用于指示身份认证结果是通过还是未通过，或者指示身份认证系统在第二终端进入预设运行状态之前未完成身份认证。
又例如，数字钥匙服务可以对数字钥匙小程序中的另一个特定的指示字段进行设置，以该指示字段的特定取值，来表示第二终端在将用户身份认证信息写入安全单元中时是否即将要进入预设运行状态。也就是说，该指示字段用于指示第二终端在响应第一终端的业务指令时，是否处于预设运行状态。比如，在对外展现时，可以以“1”表示第二终端在发送业务响应消息给第一终端时处于预设运行状态，以“0”来表示第二终端在响应第一终端的业务指令时处于其他运行状态，例如非预设运行状态。这样的信息，在本申请中称之为第二信息。因此，用户身份认证信息除了包括第一信息以外，还可以包括第二信息，其中，第二信息用于指示第二终端在发送业务响应消息给第一终端时是否处于预设运行状态。
可选地，前述的第二信息还可以是NFC控制器(NFC Controller)提供给数字钥匙小程序的。
需要说明的是，前述的第一信息和第二信息可以各自由两个指示字段来独立表示，也可以融合在一起，以同一个指示字段来表示，本申请对此不作限定。例如，当采用同一个特定的指示字段来表示时，可以将第一信息所指示的三种状态，以及第二信息能够指示的两种状态组合，从而以特定的指示字段的六个不同的取值，来分别表示六种情况。还例如，当写入到安全单元中的用户身份认证信息还包括第一时间戳、第二验证数据等时，数字钥匙服务可以对某一特定指示字段进行设置，以表示数据存在。然后，将第一时间戳、第二验证数据等存储到预设存储地址，从而使除了第一信息、第二信息以外的其他信息也能够被存储到安全单元中。
通过第一信息、第二信息和其他信息，就可以将第二终端在进入预设运行状态之前是否完成身份认证的状态、第二终端在发送业务响应消息给第一终端时所处的运行状态、第一时间戳、验证信息等保存在数字钥匙小程序中，并在使用数字钥匙时传递给第一终端。这样，第一终端就可以通过这些信息知晓第二终端的情况，进而根据预设的安全策略来进行风险控制。具体如何进行风险控制，将在后续第一终端所执行的步骤中详细说明。
可选地，在将用户身份认证信息存储到安全单元的另一种实现方式中，可以将用户身份认证信息写到安全单元中的代理小程序(Broker Applet)中。
本申请实施例中所采用的安全单元支持国际平台组织(Global Platform，GP)的Broker Interface(Amendment J)规范。请参见图7，图7为本实施例中数字钥匙的身份认证方法的应用场景的另一个示意图。在第二终端的安全单元210中存在一个代理小程序212，该代理小程序212能够统一为安全单元210内的所有小程序(包括数字钥匙小程序211以及其他可能存在的小程序)提供用户身份认证信息。因此，数字钥匙服务230可以将前述的任一种用户身份认证信息传送给该代理小程序212保存。其中，用户身份认证信息中的用户身份认证结果由身份认证系统240生成。当第二终端中的数字钥匙小程序211在与第一终端进行交互时，如果需要提供用户身份认证信息，则数字钥匙小程序211通过标准接口向代理小程序212获取存储其中的用户身份认证信息。
需要说明的是，在进行用户身份认证时，如果前一次或者几次认证不通过，可以对用户再进行一次或者多次身份认证，以避免用户输错密码，或者没有采集到有效的生物特征等情况。在这种情况下，只要将最后一次身份认证的结果存储到安全单元中即可。例如，第二终端从正常电量模式切换到关机状态时，触发身份认证系统对用户进行身份认证。首先在第二终端的显示屏上显示如图4所示的用户界面，引导用户输入指纹。用户在捺印区域捺印，录入指纹。由于用户的手指上有水，第一次捺印时身份认证系统采集到的指纹图像与第二终端中预存的指纹图像的相似度低于预设阈值，故而身份认证系统判断第一次录入的指纹图像不匹配，即身份认证不通过。此时，第二终端并不将“不通过”这一结果存储到安全单元中，而是提示用户身份认证不通过，要求用户重新录入指纹图像。用户擦拭掉手指上的水之后重新捺印。如果录入的指纹图像与预存的指纹图像的相似度高于预设阈值，此时身份认证通过，则第二终端将最近一次得到的“通过”这一结果存储到安全单元中。如果用户反复录入指纹图像的次数超过预设的次数，结果均为不通过，则第二终端再将最近一次得到的“不通过”这一结果存储到安全单元中。
在对用户进行身份认证和存储用户身份认证信息时，可以暂停第二终端中原本的切换流程。等到身份认证信息存储完毕，再继续执行切换流程。切换流程执行完毕之后，第二终端正式进入到预设运行状态。
阶段二：用户在第二终端处于预设运行状态下使用数字钥匙
请参见图3，在阶段二中，第二终端可以执行S103至S104的步骤。
S103:第二终端接收来自第一终端的业务指令。
第一终端和第二终端之间通过通信单元交互信息，并且，通信单元需要包括能够被单独供电的通信模块，例如NFC模块等。这样，当第二终端处于预设运行状态下，例如关机或者低电量模式下，单独供电的通信模块不会受到第二终端的主芯片的运行状态的影响，仍然可以与第一终端进行信息交互。
S104：第二终端在预设运行状态下，响应于所述业务指令，将采用第一密钥处理过的业务响应消息发送给第一终端。
本申请中的预设运行状态可以是指第二终端的身份认证系统无法生成身份认证结果的状态。在预设运行状态下，第二终端将阶段一中存储在安全单元中的用户身份认证信息添加到业务响应消息中，并采用第一密钥进行处理。其中，第一密钥为第二终端与第一终端预先约定的密钥，并且，第一密钥与前述的用于生成第二验证数据的第二密钥不相同。第二终端中的第一密钥可以存储在安全单元中的数字钥匙小程序中。然后，第二终端将处理过的业务响应消息发送给第一终端。
本实施例中的业务响应消息包括了用户身份认证信息，用户身份认证信息可以仅包括用户身份认证结果，也可以包括用户身份认证结果和第二验证数据，也可以包括用户身份认证结果和第一时间戳，还可以包括用户身份认证结果、第一时间戳和第二验证数据。关于用户身份认证信息、用户身份认证结果、第一时间戳、第二验证数据，可以参考前述阶段一中的相关描述，此处不再赘述。此外，业务响应消息中还可以包括其他信息，例如前述的第二信息、协议信息、交易/业务标识信息、第一终端的标识信息、第一终端/第二终端生成的随机信息值等，本申请对此不作限定。
可选地，业务响应消息中还可以包括第一验证数据。本申请中的第一验证数据，指的是使用第一密钥，对业务响应消息中的用户身份认证信息进行处理，或者对业务响应消息中的用户身份认证信息和其他信息进行处理，所生成的验证数据。当业务响应消息中包括第一验证数据时，就可以认为该业务响应消息为采用第一密钥处理过的业务响应消息。与第二验证数据类似地，在用第一密钥处理用户身份认证信息，或者用户身份认证信息和其他信息时，可以直接用第一密钥处理这些信息，得到第一验证数据，也可以将这些信息先压缩成消息摘要，然后用第一密钥处理消息摘要，得到第一验证数据。
需要说明的是，本申请中的第一密钥的加密机制可以使用现有的对称或非对称加密，或是基于非对称加密进行密钥协商后生成会话密钥，此处不再赘述。
还需要说明的是，当业务指令不同时，其对应的业务操作也相应的不同，而第一终端判断是否对该业务操作授权所需要的信息也不同。因此，在一种实现方式中，根据业务指令的 不同，业务响应消息中所包含的信息也可以不一样。
可选地，在第二终端响应于业务指令之前，可以先判断第一终端所发送的业务指令是否要求第二终端提供用户身份认证信息，即判断是否该业务指令对应的业务操作授权时，是否需要用户身份认证信息。如果需要用户身份认证信息，则将安全单元中的用户身份认证信息添加到业务响应消息中；如果不需要，则无需将用户身份认证信息提供给第一终端。
与前述S103相对应地，第一终端向第二终端发送业务指令；与前述S104相对应地，第一终端接收第二终端响应于业务指令发送的业务响应消息。
请参见图3，在阶段二中，第一终端可以执行S105至S106的步骤。
S105：第一终端采用第一密钥对业务响应消息验证通过后，得到用户身份认证信息。
其中，第一密钥为第二终端与第一终端预先约定的密钥。如果第一终端采用第一密钥对业务响应消息验证失败，则说明第二终端没有持有一把第一终端认可的数字钥匙。如果第一终端采用第一密钥成功验证业务响应消息，则说明第二终端成功证明其持有了一把第一终端认可的数字钥匙，也就是说，第二终端中的数字钥匙是合法的。此时，第一终端可以对业务响应消息中包含的用户身份认证信息进行进一步验证。
以下以业务响应消息中包括用户身份认证信息、其他信息和第一验证数据的情况为例，来进一步说明验证的一种实现方式。第一终端利用第一密钥对用户身份认证信息和其他信息进行处理，计算得到第一校验数据。然后将第一校验数据与第一验证数据比对，如果二者相同，则验证通过；如果二者不同，则验证失败。
当业务响应消息不包括第二验证数据时，第一终端可以直接利用用户身份认证信息中的内容和预设的安全策略，来判断是否对业务指令对应的业务操作授权。当业务响应消息包括第二验证数据时，第一终端需要利用与第二终端预先约定的第二密钥，来验证用户身份认证信息是否有效，保证用户身份认证信息是由第二终端的数字钥匙服务或身份认证系统生成的。此外，第一终端还需要判断用户身份认证信息中的内容是否符合预设的安全策略。只有这两个条件满足，才能够对业务指令对应的业务操作授权。
以下以用户身份认证信息中包括用户身份认证结果、第一时间戳，以及业务响应消息包括第二验证数据的情况为例，来进一步说明验证用户身份认证信息是否有效的过程。第一终端利用第二密钥对用户身份认证信息，即用户身份认证结果和第一时间戳进行处理，计算得到一个第二校验数据。然后将第二校验数据与第二验证数据比对，如果二者相同，则确定用户身份认证信息有效；如果二者不同，则确定用户身份认证信息无效。通过这样的方法，一方面，可以保证用户身份认证信息在传输过程中没有被篡改，即确保用户身份认证信息的完整性；另一方面，可以保证用户身份认证信息的发送来源是合法的，即确保第二终端上的密钥的合法持有者，从而保证用户身份认证信息具有可验证、不可抵赖的特性。
需要说明的是，业务响应消息中原本就包括有用户身份认证信息，即便不采用第一密钥来验证，第一终端也可以从中获取到用户身份认证信息。但是，如前所述，如果采用第一密钥验证失败，说明第二终端没有持有一把第一终端认可的数字钥匙，此时可以不必再使用用户身份认证信息来执行后续的步骤，直接拒绝对业务操作授权。而如果采用第一密钥验证成 功，则说明第二终端中的数字钥匙是合法的。此时，再利用业务响应消息中的用户身份认证信息来执行后续的步骤，增加对用户身份的验证，从而提高了数字钥匙的安全性。
还需要说明的是，如果第一终端所发送的业务指令不要求进行用户身份认证信息的验证，即，如果在判断是否对该业务指令对应的业务操作授权时不需要用户身份认证信息，则可以不必再使用用户身份认证信息来执行后续的步骤。在一种实现方式中，此时可以直接根据第一密钥的验证结果来判断是否对该业务指令对应的业务操作授权。
S106：验证所述用户身份认证信息。
第一终端中存储有预先设定的安全策略，该安全策略中包括了一个或者多个与用户身份认证信息相关的规则。在验证用户身份认证信息的一种实现方式中，第一终端可以将用户身份认证信息与安全策略中的规则做比对，根据用户身份认证信息是否满足安全策略中的规则，来判断是否可以对业务指令对应的业务操作授权。
需要说明的是，不同的第一终端中的安全策略可以不同，在不同的应用场景中第一终端的安全策略也可以不同，第一终端的制造商，例如车厂等，可以根据自身的风险承受能力，来预设安全策略。
还需要说明的是，此处的用户身份认证信息是从第二终端中的安全单元中获取到的，获取时第二终端处于预设运行状态下。用户身份认证信息包括用户身份认证结果，用户身份认证结果由第二终端的身份认证系统在第二终端进入预设运行状态之前生成。
可选地，用户身份认证信息中可以包括前述的第二信息。通过第二信息，可以使第一终端清楚地了解在第二终端给第一终端发送业务响应消息时第二终端是否处于预设运行状态。在一种实现方式中，第二信息用于指示第二终端在发送业务响应消息时是否处于预设运行状态。那么，如果用户身份认证信息中包括第二信息，第一终端就可以通过第二信息来确定在第二终端发送业务响应消息时所处的状态。当第二终端处于预设运行状态时，第二终端的身份认证系统无法正常使用。此时获取到用户身份认证结果是第二终端进入预设运行状态之前生成并存储的，并不是实时生成的，这表明当前用户使用数字密钥时的风险较大。在这种情况下，第一终端就可以根据预设的安全策略，根据用户身份认证信息来进行风险控制，判断是否对业务操作授权，从而降低风险。
可选地，用户身份认证信息中可以包括前述的第一信息。通过第一信息，可以使第一终端清楚地了解在第二终端在进入预设运行状态之前，是否通过身份认证，或者未完成身份认证。在一种实现方式中，第一信息用于指示身份认证结果为“通过”、“不通过”或者“未完成”。安全策略中包括第一规则，在第一规则中预设认证结果为“通过”。如果业务响应消息中的身份认证结果也为“通过”，则其与预设的认证结果匹配；如果业务响应消息中的身份认证结果也为“不通过”或者“未完成”，则其与预设的认证结果不匹配。
业务指令可以包括一个或者多个不同的指令。当业务指令包括多个不同的指令时，这多个不同的指令可以各自独立发送给第二终端，也可以一起发送给第二终端，本申请对此不作限定。当多个不同的指令各自独立发送给第二终端时，第二终端可以分别响应，分别发送对应的业务响应消息给第一终端，也可以响应一次，发送一个业务响应消息给第一终端。需要说明的是，在第一终端分别发送多个不同的指令给第二终端，第二终端又分别响应的情况下， 第二终端可以先响应先发送的指令，再接收后发送的指令，也可以先接收后发送的指令，再逐个响应接收到的多个指令。即，本申请对于第二终端接收多个指令和响应多个指令的步骤之间的先后顺序不作限定。当多个不同的指令一起发送给第二终端时，第二终端可以响应一次，发送一个业务响应消息给第一终端，也可以分别响应，本申请对此也不作限定。
业务指令对应的业务操作，可以包括一项操作，也可以包括多项操作，本申请对此不作限定。第一终端和第二终端之间可以协议多种不同场景的业务指令，每一种不同场景的业务指令，可以包括一个或者多个业务操作的请求。第一终端当前发送给第二终端的业务指令场景包含哪一种或者几种业务操作的请求，第一终端就针对这些业务操作来判断是否对其授权。
例如，在数字钥匙作为车钥匙的应用场景中，第一终端可以为车辆，第二终端可以为手机。车辆内的通信单元包括了多个通信单元，可以通过不同的通信单元来区分不同的业务指令，以及对应的业务操作。当位于车门关联的通信模块发送业务指令时，对应的业务操作可以是解锁单侧或全部车门。当位于车辆后备箱关联的通信模块发送业务指令时，对应的业务操作可以是解锁后备箱。当位于车辆内部的启动模块关联的通信模块发送业务指令时，对应的业务操作可以是启动发动机。这样，当车辆接收到手机发送来的业务响应消息时，就可以根据业务指令的不同，利用不同的安全策略来判断是否对相应的业务操作授权。
以下将以12种不同的安全策略为例，来进一步介绍，当采用不同的安全策略时，如何根据用户身份认证信息，来判断是否对业务指令对应的业务操作授权的过程。
(1)安全策略1
安全策略1包括了第一规则。
第一规则为关于用户身份认证结果的规则，包括两条子规则。在第一规则中预设认证结果为“通过”。子规则a：如果业务响应消息中的用户身份认证结果也为“通过”，则其与预设的认证结果匹配。子规则b：如果业务响应消息中的身份认证结果为“不通过”或者“未完成”，则其与预设的认证结果不匹配。
当采用安全策略1时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，如果符合，则第一终端直接对业务指令对应的业务操作授权。如果不符合，则第一终端拒绝对业务指令对应的业务操作授权。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令对应的业务操作包括“开锁”或“启动发动机”。当前手机处于关机状态。在车辆验证手机发送过来的业务响应消息成功之后，如果用户身份认证信息中的用户身份认证结果为“通过”，符合子规则a，那么对“开锁”或“启动发动机”这个业务操作授权。
(2)安全策略2
安全策略2包括第一规则和第二规则。第一规则与前述安全策略1中的相同，此处不再赘述。
第二规则为关于第一终端在第二终端处于预设运行状态时对业务操作授权的累计次数的 规则。在第一终端中记录有以往在第二终端处于预设运行状态时对业务操作授权的授权累计次数。在第二规则中预设一个次数阈值，要求授权累计次数处于次数阈值之内。
当采用安全策略2时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，以及，授权累计次数是否符合第二规则。如果同时符合这两个规则，则第一终端对业务指令对应的业务操作授权。如果不符合其中任一项规则，则第一终端拒绝对业务指令对应的业务操作授权。
此外，无论是否对业务操作授权，第一终端或者第二终端都可以给用户显示提示信息，以告知用户当前的授权累计次数、未来即将面临的后果、用户可以采取的措施等。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令对应的业务操作“启动发动机”。第二规则中设定的次数阈值为4。在车辆验证手机发送过来的业务响应消息成功之后，如果用户身份认证信息中的用户身份认证结果为“通过”，则其符合子规则a。如果以往在手机处于关机或者低电量模式下使用数字钥匙，车辆已经授权过4次，本次为第5次，则不符合第二规则。因此，车辆拒绝对“启动发动机”这个业务操作授权。
此外，在第二规则中还可以预设一个时间段，要求在一个时间段内的授权累计次数处于阈值之内。例如，第二规则可以要求在距离当前时间24小时内授权累计次数处于次数阈值之内。
通过这种方式，第一终端可以对在预设运行状态下使用数字钥匙的情况进行一定的限制，从而进一步减少恶意使用处于预设运行状态下的、缺少实时保护的第二终端上的数字钥匙的风险。
(3)安全策略3
安全策略3包括第一规则和第三规则。第一规则与前述安全策略1中的相同，此处不再赘述。
第三规则为关于第一终端在第二终端处于预设运行状态时对业务操作授权的频度的规则。授权的频度可以通过一定时间段内授权的次数来确定。在第一终端中记录有以往在第二终端处于预设运行状态时对业务操作授权的次数，以及每一次授权对应的时间。在第三规则中预设一个频度阈值，预设一个时间段，要求授权的频度(即在一个时间段内授权的次数)处于频度阈值之内。
当采用安全策略3时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，以及，授权的频度是否符合第三规则。如果同时符合这两个规则，则第一终端对业务指令对应的业务操作授权。如果不符合其中任一项规则，则第一终端拒绝对业务指令对应的业务操作授权。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令对应的业务操作包括“启动发动机”。第三规则中设定授权的频度阈值为10次/月。在车辆验证手机发送过来的业务响应消息成功之后，如果用户身份认证信息中的用户身份认证结果为“通过”，则其符合子规则a。如果以往一个月内在手机处于关机或者低电量模式 下使用数字钥匙，车辆已经授权过5次，本次为第6次，则符合第三规则。因此，车辆对“启动发动机”这个业务操作授权。
通过这种方式，第一终端可以对在预设运行状态下使用数字钥匙的情况进行一定的限制，从而进一步减少恶意使用处于预设运行状态下的、缺少实时保护的第二终端上的数字钥匙的风险。
(4)安全策略4
安全策略4包括第一规则和第四规则。第一规则与前述安全策略1中的相同，此处不再赘述。
第四规则为关于使用数字钥匙的时间点与生成用户身份认证结果的时间点之间的间隔时长的规则。第一终端得到的用户身份认证信息中还包括第一时间戳，第一时间戳用于指示身份认证结果在第二终端中生成的时间。在第四规则中预设一个时长阈值，要求当前时间距离第一时间戳的间隔时长处于预设的时长阈值之内。
当采用安全策略4时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，以及，第一时间戳是否符合第四规则。如果同时符合这两个规则，则第一终端对业务指令对应的业务操作授权。如果不符合其中任一项规则，则第一终端拒绝对业务指令对应的业务操作授权。
需要说明的是，第四规则中的当前时间，可以是第一终端判断第一时间戳是否符合第四规则的实时时间，也可以是第一终端接收到业务响应消息的时间，或者第一终端得到用户身份认证信息的时间等。由于这些时间点的距离较近，无论采用哪一个时间点作为当前时间，均能够指示出用户使用数字钥匙的时间点与生成用户身份认证结果的时间点之间的间隔时长，因此本申请对于当前时间具体采用哪一个时间点不作限定。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令对应的业务操作包括“启动发动机”。第四规则中设定间隔时长为24小时。在车辆验证手机发送过来的业务响应消息成功之后，如果用户身份认证信息中的用户身份认证结果为“通过”，则其符合子规则a。如果第一时间戳为3月5号20：00，当前时间是3月6号12：00，二者的间隔时长为16小时，小于时长阈值24小时，符合第四规则。因此，车辆对“启动发动机”这个业务操作授权。
(5)安全策略5
安全策略5包括第一规则和第五规则。其中，第一规则与前述安全策略1中的相同，此处不再赘述。
第五规则为关于第二终端在进入预设运行状态之后是否又重新切换到非预设运行状态的规则。在第五规则的一种实现方式中，需要将第一时间戳与第二时间戳进行比较，要求第二时间戳早于第一时间戳，也就是说，要求在第一时间戳指示的时间之后第二终端没有从预设运行状态重新切换至非预设运行状态。其中，用户身份认证信息中还包括第一时间戳，第一时间戳用于指示身份认证结果在第二终端中生成的时间。第二时间戳用于指示第二终端最近 一次从预设运行状态切换至非预设运行状态的时间。即，第二时间戳用于指示第二终端从预设运行状态切换至非预设运行状态的时间中，距离第二终端发送业务响应消息的时间最近的时间。
在第五规则的另一种实现方式中，需要将第一时间戳与第三时间戳进行比较，要求第三时间戳与第一时间戳之间的间隔小于一个预设阈值。其中，第一时间戳用于指示身份认证结果在第二终端中生成的时间，此时第二终端即将要进入预设运行状态，第三时间戳用于指示第二终端最近一次从非预设运行状态切换至预设运行状态的时间。也就是说，在本实现方式中，第五规则要求第三时间戳与第一时间戳很接近，而不能是第三时间戳远远晚于第一时间戳。
如果第一时间戳不符合第五规则，说明在第一时间戳之后，第二终端进入过非预设运行状态，当前时刻第二终端的身份认证系统能够正常工作，或是第二终端能够提供更新的身份认证信息，本次提供的身份认证信息无法代表最新的用户认证状态。无论是哪一种情况，都证明本次业务中第二终端做出了异常行为，即提供了在正常情况下不应提供的信息，说明当前数字钥匙的使用可能存在一定的安全风险。例如，第二终端在重放已经过时的身份认证信息以企图对当前业务操作进行授权。而如果第二终端在关机的时间点之后没有重新开机过，则说明在对身份认证信息重放滥用的风险较低。因此，可以将第五规则与前述的第一规则结合起来，从而进一步降低数字钥匙使用时的安全风险。
需要说明的是，在使用第五规则时，判断的步骤可以在第一终端本地进行，也可以由第一终端发送给服务器，由服务器进行联机验证。
在一种实现方式中，第二时间戳可以由第一终端从服务器中获取。第一终端首先接收服务器发送的第二时间戳，然后根据第二时间戳是否晚于第一时间戳，来判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态。
在另一种实现方式中，第一终端可以将包括第一时间戳的联机验证请求发送给服务器。然后由服务器基于存储在服务器中的第五规则，根据第一时间戳和第二时间戳，来判断第二终端在第一时间戳指示的时间之后是否从预设运行状态切换至非预设运行状态，得到联机验证结果。服务器再将联机验证结果发送给第一终端。如果联机验证结果为成功，则第一终端可以确定第二终端在第一时间戳指示的时间之后没有从预设运行状态切换至非预设运行状态；如果联机验证结果为失败，则第一终端可以确定第二终端在所述第一时间戳指示的时间之后从预设运行状态切换至非预设运行状态。
上述的服务器可以是直接或者间接与第二终端通信连接的服务器。例如，在数字钥匙作为车钥匙的应用场景中，第二终端为手机，上述的服务器可以是车辆厂商的服务器，其与手机账号服务器通信连接，而手机账号服务器与手机通信连接。在这种情况下，手机间接与车辆厂商的服务器连接。由于手机一开机就会自动连接到手机账号服务器上，故而车辆厂商的服务器可以通过手机账号服务器，来获取手机的开机时间。
当采用安全策略5时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，以及，第一时间戳是否符合第五规则。如果同时符合这两个规则，则第一终端对业务指令对应的业务操作授权。如果不符合其中任一项规则，则第一终端拒绝对业务指令对应的业务操作授权。此外，如果第一时间戳不符合第五规则，第一终端还可以冻结数字钥匙，或 者，指示第二终端冻结数字钥匙，或者，指示用户重新进行身份认证，从而提高数字钥匙的使用安全性。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令对应的业务操作包括“启动发动机”。安全策略采用前述安全策略5。
在车辆验证手机发送过来的业务响应消息成功之后，可以判断用户身份认证结果是否符合第一规则中的子规则a。假设用户身份认证信息中的用户身份认证结果为“通过”，则符合子规则a。车辆获取第二时间戳，判断第一时间戳和第二时间戳是否符合第五规则。假设第一时间戳为3月5号20：00，第二时间戳为3月5号10：00(最近一次开机时间)。第二时间戳早于第一时间戳，这说明手机在3月5号20：00关机之后，没有重新开机，符合第五规则。因此，车辆对以及“启动发动机”这一业务操作授权。
应理解，上述的第五规则，也可以应用到前述的安全策略1-4以及后续的安全策略6-8的任一项中。即，安全策略1-4、安全策略6-8均可以与上述的第五规则结合，在对业务操作授权之后，还可以判断第二终端在第一时间戳指示的时间之后是否从预设运行状态重新进入到非预设运行状态。如果重新进入非预设运行状态，不符合第五规则，说明第二终端虽然提供了符合要求的用户身份验证结果，但是第一终端后续根据第五规则判断出该用户身份认证结果不是最新的，因此当前存在一定的安全风险。此时，第一终端可以冻结数字钥匙，或者，指示第二终端冻结数字钥匙，或者，指示用户重新进行身份认证。通过增加关于第五规则的判断，从而进一步降低数字钥匙的风险，提高使用安全性。
需要说明的是，前述安全策略1-5还可以相互结合，采用不同的安全策略来对应不同的业务操作。为便于理解，以下再以数字钥匙作为车钥匙的应用场景为例，作进一步说明。在一个使用流程中，汽车的开门操作使用安全策略1，启动发动机使用安全策略2-5中的任一项。当使用NFC作为通信技术时，用户首先将手机靠近汽车把手的NFC读卡器。汽车NFC读卡器发送一个业务指令，在接收到手机发送的业务响应后基于安全策略1的条件进行判断，如果验证通过就解锁车门中的门锁。随后，用户进入汽车，将手机放入车内的读卡区域内。汽车发送另一个业务指令，在接收到手机发送的业务响应后基于安全策略2-5中的任一项进行验证，如果验证通过就允许用户启动发动机。
(6)安全策略6-8
安全策略6包括第一规则和第二规则。安全策略7包括第一规则和第三规则。安全策略8包括第一规则和第四规则。其中，第一规则与前述安全策略1中的相同，第二规则与前述安全策略2中的相同，第三规则与前述安全策略3中的相同，第四规则与前述安全策略4中的相同，此处不再赘述。
如前所述，第一终端发送给第二终端的业务指令可以包括多个指令，各个指令分别对应多个不同的业务操作。例如，业务指令可以包含第一指令和第二指令，对应地，业务操作包括与第一指令对应的第一操作，以及与第二指令对应的第二操作。为了提高用户体验，在不同的应用场景中，可以根据不同操作的风险的不同，将其与不同的规则对应起来。当用户身份认证信息满足安全策略中的不同规则时，第一终端对不同的业务操作进行授权。
当采用安全策略6时，第一终端需要依次判断用户身份认证结果是否符合第一规则中的 子规则a，以及，授权累计次数是否符合第二规则。如果用户身份认证结果符合第一规则中的子规则a，则第一终端对第一操作授权；如果不符合，则第一终端拒绝对第一操作授权。在对第一操作授权之后，如果授权累计次数符合第二规则，则第一终端对第二操作授权；如果不符合，则第一终端拒绝对第二操作授权。
与采用安全策略7的情况类似地，当采用安全策略7时，第一终端需要依次判断用户身份认证结果是否符合第一规则中的子规则a，以及，授权的频度是否符合第三规则。如果用户身份认证结果符合第一规则中的子规则a，则第一终端对第一操作授权；如果不符合，则第一终端拒绝对第一操作授权。在对第一操作授权之后，如果授权的频度符合第三规则，则第一终端对第二操作授权；如果不符合，则第一终端拒绝对第二操作授权。
与采用安全策略6或7的情况类似地，当采用安全策略7时，第一终端需要依次判断用户身份认证结果是否符合第一规则中的子规则a，以及，授第一时间戳是否符合第四规则。如果用户身份认证结果符合第一规则中的子规则a，则第一终端对第一操作授权；如果不符合，则第一终端拒绝对第一操作授权。在对第一操作授权之后，如果第一时间戳符合第四规则，则第一终端对第二操作授权；如果不符合，则第一终端拒绝对第二操作授权。
需要说明的是，在前述的安全策略6-8中，如果第一终端拒绝对第一操作授权，则第一终端可以不做后续的判断，直接拒绝对第二操作授权。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令包括第一指令和第二指令，二者被一起发送给手机。第一指令对应的业务操作为第一操作“开锁”，第二指令对应的业务操作为第二操作“启动发动机”。安全策略采用前述安全策略8。其中，第四规则中设定间隔时长为24小时。
手机在接收到第一指令和第二指令之后，发送一个业务响应消息给车辆，其中包含了户身份认证结果和第一时间戳。在车辆验证手机发送过来的业务响应消息成功之后，首先判断用户身份认证结果是否符合第一规则中的子规则a。假设用户身份认证信息中的用户身份认证结果为“通过”，符合子规则a，因此车辆对“开锁”这一业务操作授权。此时车锁打开，使用户可以先行进入车内。再判断第一时间戳是否符合第四规则。假设第一时间戳为3月5号20：00，当前时间是3月6号12：00，二者的间隔时长为16小时，小于时长阈值24小时，符合第四规则。因此，车辆对“启动发动机”这一业务操作授权。此时车辆发动机启动，用户可以驾驶车辆。
需要说明的是，上述的第一指令和第二指令，也可以各自单独被发送给手机。例如，当使用蓝牙作为通信技术时，汽车上的认证模块在不同阶段向手机发送不同的业务指令。在这种情况下，首先，用户靠近汽车时，利用手机与位于车门关联的通信模块交互。汽车给手机发送关于开锁的业务指令，即第一指令。手机在接收到第一指令之后，发送一个业务响应消息给车辆，其中包含了户身份认证结果。在车辆验证手机发送过来的业务响应消息成功之后，判断用户身份认证结果是否符合第一规则中的子规则a。假设用户身份认证信息中的用户身份认证结果为“通过”，符合子规则a，因此车辆对“开锁”这一业务操作授权。此时车锁打开，使用户可以先行进入车内。在利用定位技术(如UWB定位)检测到用户进入汽车后，汽车给手机发送关于启动发动机的业务指令，即第二指令。手机在接收到第二指令之后，发送另一个业务响应消息给车辆，其中包含了户身份认证结果和第一时间戳。在车辆验证手机发送过来的业务响应消息成功，并判断用户身份认证结果符合第一规则中的子规则a之后， 再判断第一时间戳是否符合第四规则。假设如前所述第一时间戳符合第四规则，那么车辆对“启动发动机”这一业务操作授权。此时车辆发动机启动，用户可以驾驶车辆。
可见，当多个指令被单独发送给手机时，手机可能发送多次业务响应消息，并且多次业务响应消息中可能均包括了相同的用户身份认证信息。此外，关于是否符合第一规则的判断过程也可能重复一次或者多次。
(7)安全策略9
安全策略9包括第一规则和第五规则。其中，第一规则与前述安全策略1中的相同，第五规则与前述安全策略5中的相同，此处不再赘述。
如前所述，业务指令可以包含第一指令和第二指令，对应地，业务操作包括与第一指令对应的第一操作，以及与第二指令对应的第二操作。当用户身份认证信息满足安全策略中的不同规则时，第一终端对不同的业务操作进行授权。
当采用安全策略9时，第一终端需要依次判断用户身份认证结果是否符合第一规则中的子规则a，以及，第一时间戳是否符合第五规则。如果用户身份认证结果符合第一规则中的子规则a，则第一终端对第一操作授权；如果不符合，则第一终端拒绝对第一操作授权。在对第一操作授权之后，如果第一时间戳符合第五规则，则第一终端对第二操作授权；如果不符合，则第一终端拒绝对第二操作授权。此外，如果第一时间戳不符合第五规则，第一终端还可以冻结数字钥匙，或者，指示第二终端冻结数字钥匙，或者，指示用户重新进行身份认证，从而提高数字钥匙的使用安全性。
需要说明的是，如果第一终端拒绝对第一操作授权，则第一终端可以无需判断第一时间戳是否符合第五规则，直接拒绝对第二操作授权。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令包括第一指令和第二指令。第一指令对应的业务操作为第一操作“开锁”，第二指令对应的业务操作为第二操作“启动发动机”。安全策略采用前述安全策略9。
在车辆验证手机发送过来的业务响应消息成功之后，首先判断用户身份认证结果是否符合第一规则中的子规则a。假设用户身份认证信息中的用户身份认证结果为“通过”，符合子规则a，因此车辆对“开锁”这一业务操作授权。此时车锁打开，使用户可以先行进入车内。然后，再获取第二时间戳，判断第一时间戳和第二时间戳是否符合第五规则。假设第一时间戳为3月5号20：00，第二时间戳为3月5号10：00，第二时间戳早于第一时间戳，说明手机在3月5号20：00关机之后，没有重新开机，符合第五规则。因此，车辆对以及“启动发动机”这一业务操作授权。此时车辆发动机启动，用户可以驾驶车辆。
(8)安全策略10
安全策略10包括第一规则、第四规则和第五规则。其中，第一规则与前述安全策略1中的相同，第四规则与前述安全策略4中的相同，第五规则与前述安全策略5中的相同，此处不再赘述。
如前所述，业务指令可以包含第一指令和第二指令，对应地，业务操作包括与第一指令对应的第一操作，以及与第二指令对应的第二操作。当用户身份认证信息满足安全策略中的不同规则时，第一终端对不同的业务操作进行授权。
当采用安全策略10时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，以及，第一时间戳是否符合第四规则和第五规则。如果用户身份认证结果符合第一规则中的子规则a，则第一终端对第一操作授权；如果不符合，则第一终端拒绝对第一操作授权。在第一终端对第一操作授权之后，如果第一时间戳符合第四规则，则第一终端对第二操作授权；如果不符合，则判断第一时间戳是否符合第五规则。如果第一时间戳符合第五规则，则第一终端对第二操作授权；如果不符合，则第一终端拒绝对第二操作授权。
与安全策略5中类似地，如果第一时间戳不符合第五规则，第一终端还可以冻结数字钥匙，或者，指示第二终端冻结数字钥匙，或者，指示用户重新进行身份认证，从而提高数字钥匙的使用安全性。如果第一终端拒绝对第一操作授权，则第一终端可以无需判断第一时间戳是否符合第五规则，直接拒绝对第二操作授权。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令包括第一指令和第二指令。第一指令对应的业务操作为第一操作“开锁”，第二指令对应的业务操作为第二操作“启动发动机”。安全策略采用前述安全策略10。
在车辆验证手机发送过来的业务响应消息成功之后，首先判断用户身份认证结果是否符合第一规则中的子规则a。假设用户身份认证信息中的用户身份认证结果为“通过”，符合子规则a。因此车辆对“开锁”这一业务操作授权。此时车锁打开，使用户可以先行进入车内。然后，判断第一时间戳是否符合第四规则。假设第一时间戳为3月5号20：00，当前时间是3月7号12：00，二者的间隔时长为40小时，大于时长阈值24小时，不符合第四规则。那么，再获取第二时间戳，判断第一时间戳和第二时间戳是否符合第五规则。假设第二时间戳为3月5号10：00，第二时间戳早于第一时间戳，说明手机在3月5号20：00关机之后，没有重新开机，符合第五规则。此时，车辆对“启动发动机”这一业务操作授权。此时车辆发动机启动，用户可以驾驶车辆。
(9)安全策略11
安全策略11也包括第一规则、第四规则和第五规则。其中，第一规则与前述安全策略1中的相同，第四规则与前述安全策略4中的相同，第五规则与前述安全策略8中的相同，此处不再赘述。
如前所述，业务指令可以包含第一指令和第二指令，对应地，业务操作包括与第一指令对应的第一操作，以及与第二指令对应的第二操作。当用户身份认证信息满足安全策略中的不同规则时，第一终端对不同的业务操作进行授权。
当采用安全策略11时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则a，以及，第一时间戳是否符合第四规则和第五规则。如果用户身份认证结果符合第一规则中的子规则a，并且，第一时间戳是否符合第四规则，则第一终端对第一操作授权；如果二者中任一项不符合，则第一终端拒绝对第一操作授权。在第一终端对第一操作授权之后，如果第一时间戳符合第五规则，则第一终端对第二操作授权；如果不符合，则第一终端拒绝 对第二操作授权。
与安全策略5中类似地，如果第一时间戳不符合第五规则，第一终端还可以冻结数字钥匙，或者，指示第二终端冻结数字钥匙，或者，指示用户重新进行身份认证，从而提高数字钥匙的使用安全性。如果第一终端拒绝对第一操作授权，则第一终端可以无需判断第一时间戳是否符合第五规则，直接拒绝对第二操作授权。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，业务指令包括第一指令和第二指令。第一指令对应的业务操作为第一操作“开锁”，第二指令对应的业务操作为第二操作“启动发动机”。安全策略采用前述安全策略11。
在车辆验证手机发送过来的业务响应消息成功之后，首先判断用户身份认证结果是否符合第一规则中的子规则a，以及判断第一时间戳是否符合第四规则。假设用户身份认证信息中的用户身份认证结果为“通过”，符合子规则a。假设第一时间戳为3月5号20：00，当前时间是3月6号12：00，二者的间隔时长为16小时，小于时长阈值24小时，符合第四规则。因此车辆对“开锁”这一业务操作授权。此时车锁打开，使用户可以先行进入车内。然后，获取第二时间戳，判断第一时间戳和第二时间戳是否符合第五规则。假设第二时间戳为3月5号10：00，第二时间戳早于第一时间戳，说明手机在3月5号20：00关机之后，没有重新开机，符合第五规则。因此，车辆对“启动发动机”这一业务操作授权。此时车辆发动机启动，用户可以驾驶车辆。
(10)安全策略12
在某些应用场景中，即便用户身份认证结果不符合第一规则a，也可以对部分业务操作进行授权，并拒绝对另外一些业务操作授权，然后再重新发起一轮数字钥匙的业务指令。在接收到新的一轮数字钥匙的业务响应消息后，再来判断是否对另外一些业务操作授权。
基于此，本申请还提供安全策略12。安全策略12包括第一规则，以及第二规则、第三规则、第四规则和第五规则中的任意一项或者几项。其中，第一规则与前述安全策略1中的相同，第二规则与前述安全策略2中的相同，第三规则与前述安全策略3中的相同，第四规则与前述安全策略4中的相同，第五规则与前述安全策略5中的相同，此处不再赘述。
如前所述，业务指令可以包含第一指令和第二指令，对应地，业务操作包括与第一指令对应的第一操作，以及与第二指令对应的第二操作。当用户身份认证信息满足安全策略中的不同规则时，第一终端对不同的业务操作进行授权。
当采用安全策略12时，第一终端需要判断用户身份认证结果是否符合第一规则中的子规则b。如果用户身份认证结果符合第一规则中的子规则b，则第一终端对第一指令对应的第一操作授权，并且，第一终端也可以直接拒绝对所述第二指令对应的第二操作授权，无需再对判断是否符合其他规则。
此后，上述的数字钥匙的身份认证方法，还可以包括以下步骤：第一终端向第二终端发送新的业务指令，其中，新的业务指令包括第二指令。
需要说明的是，第一终端向第二终端发送新的业务指令时，可以循环发送一次或者多次，本申请对此不作限定。
举例来说，在数字钥匙作为车钥匙的应用场景中，第一终端为车辆，第二终端为手机，当前手机处于关机状态。业务指令包括第一指令和第二指令。第一指令对应的业务操作为第一操作“开锁”，第二指令对应的业务操作为第二操作“启动发动机”。安全策略采用前述安全策略12。
在车辆验证手机发送过来的业务响应消息成功之后，首先判断用户身份认证结果是否符合第一规则中的子规则b。假设用户身份认证信息中的用户身份认证结果为“未完成”，符合子规则b，因此车辆对“开锁”这一业务操作授权，并拒绝对“启动发动机”这一业务操作授权。实际上，此处是否对“开锁”这一业务操作授权，不依赖于用户身份认证结果。无论用户身份认证结果是“通过”、“不通过”还是“未完成”，均可以对“开锁”这一业务操作授权。但在用户身份认证结果为“不通过”或者“未完成”时，可以直接拒绝对“启动发动机”这一业务操作授权，无需再考虑“启动发动机”这一业务操作原本对应的安全策略。然后，车辆向手机发送一个新的业务指令，新的业务指令中不再包括关于“开锁”的指令，即第一指令，仅包括关于“启动发动机”指令，即第二指令。由于车锁已经打开，用户可以先行进入车内，为手机充电。待用户重新开启手机进入到正常电量模式，此时用户就可以在开机状态下实时完成用户身份认证。车辆向手机发送一次新的业务指令，在得到满足授权第二操作预设安全策略的业务响应消息后，车辆对“启动发动机”这一业务操作授权之后，车辆发动机启动，用户可以驾驶车辆。
应理解，上述的安全策略1-12仅为本申请中数字钥匙的身份认证方法中能够适用的几个例子，本领域技术人员还可以根据应用场景的不同，对前述的五种规则进行其他组合，或者将这五种规则与其他规则一起组合，形成其他的安全策略。甚至，只要几种安全策略之间不冲突，还可以将几种安全策略进行组合。
应理解，在上述安全策略中，业务指令包括多个指令的情况，为便于理解，仅以包括第一指令和第二指令的情况来说明。在实际应用过程中，业务指令中还可以包括更多的指令。是否对其中某一个业务指令对应的业务操作授权，可以由一个或多个规则来决定。
还应理解，当本申请的第二终端处于非预设运行状态时，如果接收到第一终端发送的业务指令，第二终端也可以响应于该业务指令，生成业务响应消息。此时，业务响应消息中也可以包括前述的用户身份认证结果、第一时间戳等内容。此时的用户身份认证结果，可以是第二终端实时对用户进行身份认证而生成的，也可以是此前存储在安全单元中的。第一终端在接收到业务响应消息之后，可以采用第一密钥对业务响应消息进行验证，并采用前述可能的安全策略，例如安全策略1、安全策略4等，进一步进行风险判断，从而提高数字钥匙的使用安全性。
可选地，在上述的身份认证方法中，第二终端还可以执行以下步骤：
S107：在第二终端从预设运行状态切换至非预设运行状态之后，第二终端对用户身份认证信息做失效处理。
或者，第二终端还可以执行以下步骤：
S108：在将用户身份认证信息存储到安全单元之前，第二终端对存储在安全单元中的原用户身份认证信息做失效处理。
每一次第二终端从非预设运行状态进入到预设运行状态时，都被要求进行一次身份认证。因此，每一次用户使用数字钥匙，无论身份认证结果如何，在安全单元中都会存储一个用户身份认证信息。为了避免以往的旧的用户身份认证信息对后续写入到安全单元中的最新的用户身份认证信息造成干扰，故而可以在下一次第二终端从预设运行状态切换至非预设运行状态时，对存储在安全单元中的这些用户身份认证信息做失效处理。或者，在下一次第二终端从非预设运行状态切换至预设运行状态的过程中，在将最新的用户身份认证信息存储到安全单元之前，将存储在安全单元中的这些旧的用户身份认证信息做失效处理。
在做失效处理的一种实现方式中，可以将存储在安全单元中的数字钥匙小程序或者代理小程序中的用户身份认证信息删除。在做失效处理的另一种实现方式中，可以将此前存储在安全单元中的用户身份认证信息标记为失效。通过做失效处理，可以确保每一次第二终端从非预设运行状态切换至预设运行状态之后，安全单元中都均保存有一个最新的有效的用户身份认证信息。
此外，服务器也可以对原用户身份认证信息做失效处理。服务器还可以向第一终端发送告知信息，例如“手机已重新上线”、“用户身份认证信息失效”等，以告知用户原用户身份认证信息已失效。
在本申请的第二个实施例中，提供一种终端设备，该终端设备可以应用在多种不同的场景中，例如可以应用于车辆、POS机、交通刷卡机、门禁系统等。请参见图8，图8为该终端设备的一种实现方式的结构示意图。该终端设备300包括：第一收发器320以及一个或多个处理器310。
第一收发器320，用于向第二终端发送业务指令；以及，接收所述第二终端发送的业务响应消息。在实际应用时，第一收发器320可以是NFC通信模块，也可以是蓝牙模块、UWB模块等。
处理器310，用于采用第一密钥对所述业务响应消息验证通过后，得到用户身份认证信息；以及，验证所述用户身份认证信息；其中，所述第一密钥为所述第二终端与所述终端设备300预先约定的密钥；所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无法生成身份认证结果的状态。
在实际应用时，处理器310可以利用各种接口和线路连接整个终端设备300的各个部分。所述处理器310可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。所述处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,简称GAL)或其任意组合。
在实际应用时，所述终端设备300中还可以包括存储器，所述存储器存储有一个或多个 计算机程序，所述一个或多个计算机程序包括指令。当所述指令被所述一个或多个处理器310执行时，使得所述终端设备300实现第一个实施例中第一终端所执行的任一种方法的部分或者全部步骤。存储器可以包括易失性存储器(volatile memory)，例如随机存取内存(random access memory，RAM)；还可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器还可以包括上述种类的存储器的组合。
本实施例中还提供另一种终端设备，该终端设备可以应用在多种不同的场景中，例如可以应用于手机、平板电脑、智能穿戴设备等。请参见图9，图9为该终端设备的一种实现方式的结构示意图。该终端设备400包括：安全单元410、第二收发器420以及身份认证系统440。
第二收发器420，用于接收来自第一终端的业务指令；以及，在预设运行状态下，响应于所述业务指令，将采用第一密钥处理过的业务响应消息发送给所述第一终端。其中，所述业务响应消息中包括用户身份认证信息，所述用户身份认证信息包括用户身份认证结果，所述第一密钥为所述终端设备400与所述第一终端预先约定的密钥。在实际应用时，第二收发器420可以是NFC通信模块，也可以是蓝牙模块、UWB模块等。第二收发器420能够单独上电，无论终端设备的主芯片处于正常电量模式下，还是处于关机或者低电量模式下，第二收发器420均能够单独上电工作。
安全单元410，用于存储所述用户身份认证信息以及所述第一密钥。在实际应用中，安全单元可以采用嵌入式安全单元(embedded SE，eSE)、集成到手机主芯片(System on Chip，SoC)之中的inSE安全模块，通用集成电路卡安全单元(Universal Integrated Circuit Cards Secure Element，UICC SE)等。安全单元410中存储有数字钥匙小程序411，前述的第一密钥存储在数字钥匙小程序411中。
用户身份认证系统440，用于在所述终端设备400进入所述预设运行状态之前生成用户身份认证结果，其中，所述预设运行状态是指所述终端设备的身份认证系统无法生成身份认证结果的状态。需要说明的是，在终端设备400处于正常电量模式时，用户身份认证系统440也可以采集用户的密码或者生物特征等，来对用户进行身份认证。
可选地，该终端设备400还可以包括数字钥匙服务430。数字钥匙服务430可以分别与身份认证系统440和安全单元410连接。如第一个实施例中所述，数字钥匙服务为终端设备400提供数字钥匙的管理功能。通过数字钥匙服务430提供的管理界面，用户可以查看数字钥匙小程序411中所保存的一把或者多把数字钥匙，并对这些数字钥匙进行强制身份认证配置。数字钥匙服务430能够在用户配置了至少一个强制身份认证的数字钥匙(例如第一密钥)时，在终端设备400的状态切换流程中增加一次身份认证操作。数字钥匙服务430可以触发终端设备400中的身份认证流程，利用身份认证系统440来生成用户身份认证结果。可选地，数字钥匙服务430还可以生成用户界面，以告知用户本次执行的身份认证的用途。可选地，数字钥匙服务430可以获取用户身份认证结果和第一时间戳，然后将用户身份认证结果和第一时间戳一起作为用户身份认证信息，共同存储到安全单元410中。
此外，本实施例还提供一种计算机可读存储介质，该存储介质中包括指令，当所述指令在计算机上运行时，使得所述计算机执行第一个实施例中第一终端所执行的任一种方法。
本实施例还提供另外一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，使得所述计算机执行第一个实施例中第二终端所执行的任一种方法。
这里的可读存储介质可为磁碟、光盘、DVD、USB、只读存储记忆体(ROM)或随机存储记忆体(RAM)等，本申请对具体的存储介质形式不作限定。
此外，本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行上述第一个实施例中第一终端所执行的任一种方法的步骤，或者执行第一个实施例中第二终端所执行的任一种方法的步骤。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本实施例中的终端设备以及计算机可读存储介质用于执行第一个实施例中的任一种数字钥匙的身份认证方法的部分或全部步骤，相应地具有前述方法所具有的有益效果，此处不再赘述。
应理解，在本申请的各种实施例中，各步骤的执行顺序应以其功能和内在逻辑确定，各步骤序号的大小并不意味着执行顺序的先后，不对实施例的实施过程构成限定。
除非另外说明，本说明书中的“多个”，指的是两个或者两个以上。在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解，“第一”、“第二”等字样并不对数量和执行次序构成限定，并且“第一”、“第二”等字样也并不限定一定不同。
应理解，本说明书中各个实施例之间相同相似的部分互相参见即可。尤其，对于终端设备、计算机可读存储介质的实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例中的说明即可。以上所述的本发明实施方式并不构成对本发明保护范围的限定。

Claims (24)

  1. 一种数字钥匙的身份认证方法，其特征在于，包括：
    第一终端向第二终端发送业务指令；
    所述第一终端接收所述第二终端发送的业务响应消息；
    所述第一终端采用第一密钥对所述业务响应消息验证通过后，得到用户身份认证信息，其中，所述第一密钥为所述第二终端与所述第一终端预先约定的密钥；所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无法生成身份认证结果的状态；
    所述第一终端验证所述用户身份认证信息。
  2. 根据权利要求1所述的方法，其特征在于，所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，则所述第一终端对所述业务指令对应的业务操作授权。
  3. 根据权利要求1所述的方法，其特征在于，所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内，则所述第一终端对所述业务指令对应的业务操作授权；或者，
    如果所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内，则所述第一终端对所述业务指令对应的业务操作授权。
  4. 根据权利要求1所述的方法，其特征在于，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内，则所述第一终端对所述业务指令对应的业务操作授权。
  5. 根据权利要求4所述的方法，其特征在于，还包括：
    如果所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至非预设运行状态，则所述第一终端冻结所述数字钥匙，或者指示所述第二终端冻结所述数字钥匙，或者指示用户重新进行身份认证。
  6. 根据权利要求1所述的方法，其特征在于，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，并且，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态，则所述第一终端对所述业务指令对应的业务操作授权。
  7. 根据权利要求1所述的方法，其特征在于，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，则所述第一终端对所述第一指令对应的第一操作授权；
    在对所述第一操作授权之后，如果在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内，或者，在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内，或者，当前时间距离所述第一时间戳的间隔时长处于预设时长阈值之内，或者，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态，则所述第一终端对所述第二指令对应的第二操作授权。
  8. 根据权利要求1所述的方法，其特征在于，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，则所述第一终端对所述第一指令对应的第一操作授权；
    如果当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之外，则所述第一终端判断所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至非预设运行状态；
    如果没有切换至所述非预设运行状态，则所述第一终端对所述第二指令对应的第二操作授权。
  9. 根据权利要求1所述的方法，其特征在于，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述身份认证结果生成的时间；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内，则所述第一终端对所述第一指令对应的第一操作授权；
    在对所述第一操作授权之后，如果所述第二终端在所述第一时间戳指示的时间之后没有 从所述预设运行状态切换至非预设运行状态，则所述第一终端对所述第二指令对应的第二操作授权。
  10. 根据权利要求6-9任一项所述的方法，其特征在于，所述第一终端验证所述用户身份认证信息的步骤，还包括：
    如果所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态，则所述第一终端冻结所述数字钥匙，或者，指示所述第二终端冻结所述数字钥匙，或者，指示用户重新进行身份认证。
  11. 根据权利要求6-10任一项所述的方法，其特征在于，确定所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至所述非预设运行状态，包括：
    接收服务器发送的第二时间戳，所述第二时间戳用于指示所述第二终端从所述预设运行状态切换至所述非预设运行状态的时间中，距离所述第二终端发送所述业务响应消息的时间最近的时间；
    如果所述第二时间戳早于所述第一时间戳，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至所述非预设运行状态；
    如果所述第二时间戳晚于所述第一时间戳，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态。
  12. 根据权利要求6-10任一项所述的方法，其特征在于，确定所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至非预设运行状态，包括：
    所述第一终端向服务器发送所述第一时间戳；
    所述第一终端获取所述服务器发送的联机验证结果，所述联机验证结果由所述服务器根据所述第二终端在所述第一时间戳指示的时间之后是否从所述预设运行状态切换至所述非预设运行状态而确定；
    如果所述联机验证结果为成功，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至所述非预设运行状态；
    如果所述联机验证结果为失败，则所述第一终端确定所述第二终端在所述第一时间戳指示的时间之后从所述预设运行状态切换至所述非预设运行状态。
  13. 根据权利要求1所述的方法，其特征在于，所述业务指令包含第一指令和第二指令，所述业务操作包括与所述第一指令对应的第一操作，以及与所述第二指令对应的第二操作；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果所述用户身份认证结果与预设的认证结果不匹配，则所述第一终端对所述第一指令对应的第一操作授权；
    如果所述用户身份认证结果与预设的认证结果不匹配，则所述第一终端拒绝对所述第二指令对应的第二操作授权；
    所述方法还包括：
    第一终端向第二终端发送新的业务指令，所述新的业务指令包括第二指令。
  14. 根据权利要求1所述的方法，其特征在于，所述业务响应消息中还包括第二验证数据，所述第二验证数据由所述用户身份认证信息经过第二密钥处理生成；
    所述第一终端验证所述用户身份认证信息的步骤，包括：
    如果利用第二密钥和所述第二验证数据，验证所述用户身份认证信息为有效，并且，所述用户身份认证信息符合预设的安全策略，则所述第一终端对所述业务指令对应的业务操作授权；其中，所述第二密钥为所述第二终端与所述第一终端预先约定的密钥，所述第二密钥与所述第一密钥不相同。
  15. 一种数字钥匙的身份认证方法，其特征在于，包括：
    第二终端接收来自第一终端的业务指令；
    所述第二终端在预设运行状态下，响应于所述业务指令，将采用第一密钥处理过的业务响应消息发送给所述第一终端；其中，所述业务响应消息中包括用户身份认证信息，所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入所述预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无法生成身份认证结果的状态，所述第一密钥为所述第二终端与所述第一终端预先约定的密钥。
  16. 根据权利要求15所述的方法，其特征在于，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述用户身份认证结果生成的时间。
  17. 根据权利要求15或16所述的方法，其特征在于，所述业务响应消息中还包括第二验证数据，所述第二验证数据由所述用户身份认证信息经过所述第二密钥处理生成，所述第二密钥为所述第二终端与所述第一终端预先约定的密钥，所述第二密钥与所述第一密钥不相同。
  18. 根据权利要求15-17任一项所述的方法，其特征在于，在所述第二终端接收来自所述第一终端的业务指令的步骤之前，还包括：
    所述第二终端在进入所述预设运行状态之前，如果存在配置有强制身份认证的数字钥匙，则生成用户身份认证结果；其中，配置有强制身份认证的数字钥匙要求所述第二终端在进入所述预设运行状态之前进行用户身份认证；
    所述第二终端将用户身份认证信息存储到所述第二终端的安全单元中，所述用户身份认证信息包括所述用户身份认证结果。
  19. 一种终端设备，其特征在于，包括：
    第一收发器，用于向第二终端发送业务指令；以及，接收所述第二终端发送的业务响应消息；
    处理器，用于采用第一密钥对所述业务响应消息验证通过后，得到用户身份认证信息；以及，验证所述用户身份认证信息；其中，所述第一密钥为所述第二终端与所述终端设备预先约定的密钥；所述用户身份认证信息存储于第二终端的安全单元中，所述用户身份认证信息包括用户身份认证结果，所述用户身份认证结果由所述第二终端的身份认证系统在所述第二终端进入预设运行状态之前生成，所述预设运行状态是指所述第二终端的身份认证系统无 法生成身份认证结果的状态。
  20. 根据权利要求19所述的终端设备，其特征在于，所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配的情况下，所述业务指令对应的业务操作授权；或者，
    所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的累计次数处于预设的次数阈值之内的情况下，对所述业务指令对应的业务操作授权；或者，
    所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且在所述第二终端处于所述预设运行状态时对业务操作授权的频度处于预设的频度阈值之内的情况下，对所述业务指令对应的业务操作授权；或者，
    所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且当前时间距离所述第一时间戳的间隔时长处于预设的时长阈值之内的情况下，对所述业务指令对应的业务操作授权；或者，
    所述处理器还用于在所述用户身份认证结果与预设的认证结果匹配，并且，所述第二终端在所述第一时间戳指示的时间之后没有从所述预设运行状态切换至非预设运行状态的情况下，则对所述业务指令对应的业务操作授权。
  21. 一种终端设备，其特征在于，包括：
    第二收发器，用于接收来自第一终端的业务指令；以及，在预设运行状态下，响应于所述业务指令，将采用第一密钥处理过的业务响应消息发送给所述第一终端；其中，所述业务响应消息中包括用户身份认证信息，所述用户身份认证信息包括用户身份认证结果，所述第一密钥为所述终端设备与所述第一终端预先约定的密钥；
    安全单元，用于存储所述用户身份认证信息以及所述第一密钥；
    用户身份认证系统，用于在所述终端设备进入所述预设运行状态之前生成用户身份认证结果，其中，所述预设运行状态是指所述终端设备的身份认证系统无法生成身份认证结果的状态。
  22. 根据权利要求21所述的终端设备，其特征在于，所述用户身份认证信息还包括第一时间戳，所述第一时间戳用于指示所述用户身份认证结果生成的时间。
  23. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求1至14中任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求15至18中任一项所述的方法。
PCT/CN2020/085225 2019-04-22 2020-04-17 数字钥匙的身份认证方法、终端设备及介质 WO2020216131A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
KR1020217035330A KR20210145243A (ko) 2019-04-22 2020-04-17 디지털 키의 신원을 인증하는 방법, 단말 장치, 매체
US17/605,110 US20220203933A1 (en) 2019-04-22 2020-04-17 Method for Authenticating Identity of Digital Key, Terminal Device, and Medium
JP2021562902A JP7194847B2 (ja) 2019-04-22 2020-04-17 デジタルキー、端末デバイス、及び媒体の同一性を認証する方法
EP20794615.3A EP3941014B1 (en) 2019-04-22 2020-04-17 Digital key-based identity authentication method, terminal apparatus, and medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910324313.5A CN111835689B (zh) 2019-04-22 2019-04-22 数字钥匙的身份认证方法、终端设备及介质
CN201910324313.5 2019-04-22

Publications (1)

Publication Number Publication Date
WO2020216131A1 true WO2020216131A1 (zh) 2020-10-29

Family

ID=72912318

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/085225 WO2020216131A1 (zh) 2019-04-22 2020-04-17 数字钥匙的身份认证方法、终端设备及介质

Country Status (6)

Country Link
US (1) US20220203933A1 (zh)
EP (1) EP3941014B1 (zh)
JP (1) JP7194847B2 (zh)
KR (1) KR20210145243A (zh)
CN (1) CN111835689B (zh)
WO (1) WO2020216131A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4209398A1 (en) * 2022-01-06 2023-07-12 Beijing Xiaomi Mobile Software Co., Ltd. Method and apparatus for synchronizing information, and storage medium
CN117527238A (zh) * 2024-01-03 2024-02-06 成都新希望金融信息有限公司 密钥生成方法、装置、电子设备及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10529161B2 (en) * 2013-12-31 2020-01-07 Yaowu Ma Keys and locks
EP3614293A1 (en) * 2018-08-24 2020-02-26 Nagravision S.A. Securing data stored in a memory of an iot device during a low power mode
CN112396738B (zh) * 2020-12-01 2022-11-04 深圳市汇顶科技股份有限公司 共享设备的解锁方法及相关设备
CN113645045B (zh) * 2021-10-13 2022-01-04 北京创米智汇物联科技有限公司 Tee中的安全控制方法、装置及设备、存储介质
CN114268461B (zh) * 2021-11-26 2023-06-27 中国联合网络通信集团有限公司 用户身份认证方法、装置、服务器、终端及存储介质
CN116566594A (zh) * 2022-01-30 2023-08-08 华为技术有限公司 一种设备控制方法、设备和分布式数字钥匙系统
CN115021936B (zh) * 2022-06-10 2023-10-27 中国南方电网有限责任公司 一种远端站点的终端设备安全接入认证授权方法及系统
CN115230635A (zh) * 2022-08-25 2022-10-25 阿维塔科技(重庆)有限公司 远程控制车门解锁方法及装置
CN117676468A (zh) * 2022-08-26 2024-03-08 北京京东方技术开发有限公司 车辆安全认证方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103178966A (zh) * 2013-03-19 2013-06-26 北京经纬恒润科技有限公司 车辆与智能钥匙的kpd认证方法、车辆基站及系统
US9405897B1 (en) * 2012-03-30 2016-08-02 Emc Corporation Authenticating an entity
US20160304087A1 (en) * 2015-04-15 2016-10-20 Mando Corporation Remote parking control system and control method thereof
CN109391597A (zh) * 2017-08-10 2019-02-26 中国电信股份有限公司 认证方法、认证系统以及通信系统
CN109586915A (zh) * 2017-09-29 2019-04-05 国民技术股份有限公司 汽车无钥匙控制认证方法、用户终端、车载装置及服务器

Family Cites Families (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7340048B2 (en) * 2000-07-14 2008-03-04 Context Connect Llc System and method for directory services and e-commerce across multi-provider networks
CN1684411B (zh) * 2004-04-13 2010-04-28 华为技术有限公司 一种验证移动终端用户合法性的方法
JP2005273264A (ja) 2004-03-24 2005-10-06 Tokai Rika Co Ltd 作動制御装置及び電子キーシステム
JP2006227747A (ja) 2005-02-15 2006-08-31 Nec Corp 認証システム及び方法並びに認証用プログラム
JP5292862B2 (ja) 2008-03-11 2013-09-18 沖電気工業株式会社 セキュリティシステム、サーバ装置、セキュリティ方法、電子鍵管理方法及びプログラム
CN101593383B (zh) * 2008-05-26 2013-05-15 中国移动通信集团公司 一种电子钱包控制方法、系统以及sim卡
JP2009286343A (ja) 2008-05-30 2009-12-10 Fujitsu Ten Ltd 遠隔車両制御システム、乗員認証装置および遠隔車両制御方法
WO2011150405A2 (en) * 2010-05-28 2011-12-01 Suridx, Inc. Wireless encrypted control of physical access systems
JP2012215047A (ja) 2011-04-01 2012-11-08 Tokai Rika Co Ltd 電子キーシステム
US8768565B2 (en) * 2012-05-23 2014-07-01 Enterprise Holdings, Inc. Rental/car-share vehicle access and management system and method
CN102968864B (zh) * 2012-10-31 2015-05-20 中兴通讯股份有限公司 一种基于nfc的开机控制方法、装置及终端
US20140176301A1 (en) * 2012-12-20 2014-06-26 Lear Corporation Remote Function Fob for Enabling Communication Between a Vehicle and a Device and Method for Same
CN103246839B (zh) 2013-04-27 2015-10-28 飞天诚信科技股份有限公司 一种智能密钥设备的工作方法
CN104378143A (zh) * 2013-08-16 2015-02-25 施耐德电器工业公司 在仪表与移动终端之间传输数据的方法、装置以及仪表
JP6151627B2 (ja) 2013-11-14 2017-06-21 Kddi株式会社 生体認証システム、生体認証方法およびコンピュータプログラム
CN104391712B (zh) * 2014-10-24 2018-10-19 小米科技有限责任公司 关机方法和装置
KR102486275B1 (ko) * 2015-07-24 2023-01-09 엘지전자 주식회사 이동단말기 및 그 제어방법
US10112581B2 (en) * 2016-01-29 2018-10-30 Faraday&Future Inc. Remote control system for a vehicle
JP7027027B2 (ja) * 2016-03-17 2022-03-01 キヤノン株式会社 情報処理装置、制御方法、およびそのプログラム
JP2018071213A (ja) 2016-10-31 2018-05-10 株式会社デンソー 携帯機器、および携帯機器の制御方法
CN109716277B (zh) 2017-02-09 2022-08-02 麦克赛尔株式会社 便携信息终端及其控制方法
JP6922308B2 (ja) 2017-03-23 2021-08-18 日本電気株式会社 ワークフローシステム、処理システム、方法及びプログラム
CN108665337A (zh) * 2017-04-01 2018-10-16 重庆无线绿洲通信技术有限公司 一种车辆系统及其虚拟钥匙认证方法
CN107610278B (zh) * 2017-07-31 2020-09-08 宁波远景汽车零部件有限公司 智能钥匙学习方法及系统
US10725791B2 (en) * 2017-08-16 2020-07-28 Harman International Industries, Incorporated Operating system boot up optimizations
CN107733652B (zh) * 2017-09-13 2021-05-25 捷德(中国)科技有限公司 用于共享交通工具的开锁方法和系统及车锁
CN107909358B (zh) * 2017-11-01 2021-08-17 北京融链科技有限公司 能源的结算方法、装置和系统
CN108725383A (zh) * 2018-05-22 2018-11-02 北京强大机电科技有限公司 一种公共交通车辆的管理方法、系统及公共交通车辆
MX2021010516A (es) * 2019-03-06 2022-01-31 Greet Solutions Llc Identificacion y autenticacion de usuario basado en la proximidad sistema y metodo.
US20230096672A1 (en) * 2021-09-30 2023-03-30 The Toronto-Dominion Bank System and method of processing a data access request

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9405897B1 (en) * 2012-03-30 2016-08-02 Emc Corporation Authenticating an entity
CN103178966A (zh) * 2013-03-19 2013-06-26 北京经纬恒润科技有限公司 车辆与智能钥匙的kpd认证方法、车辆基站及系统
US20160304087A1 (en) * 2015-04-15 2016-10-20 Mando Corporation Remote parking control system and control method thereof
CN109391597A (zh) * 2017-08-10 2019-02-26 中国电信股份有限公司 认证方法、认证系统以及通信系统
CN109586915A (zh) * 2017-09-29 2019-04-05 国民技术股份有限公司 汽车无钥匙控制认证方法、用户终端、车载装置及服务器

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4209398A1 (en) * 2022-01-06 2023-07-12 Beijing Xiaomi Mobile Software Co., Ltd. Method and apparatus for synchronizing information, and storage medium
CN117527238A (zh) * 2024-01-03 2024-02-06 成都新希望金融信息有限公司 密钥生成方法、装置、电子设备及存储介质
CN117527238B (zh) * 2024-01-03 2024-03-19 成都新希望金融信息有限公司 密钥生成方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
JP2022529725A (ja) 2022-06-23
EP3941014B1 (en) 2023-07-26
US20220203933A1 (en) 2022-06-30
EP3941014A4 (en) 2022-04-20
CN111835689B (zh) 2021-06-15
JP7194847B2 (ja) 2022-12-22
CN111835689A (zh) 2020-10-27
KR20210145243A (ko) 2021-12-01
EP3941014A1 (en) 2022-01-19

Similar Documents

Publication Publication Date Title
WO2020216131A1 (zh) 数字钥匙的身份认证方法、终端设备及介质
US10102524B2 (en) Access control and mobile security app
US8689013B2 (en) Dual-interface key management
KR100806477B1 (ko) 리모트 액세스 시스템, 게이트웨이, 클라이언트 기기,프로그램 및 기억 매체
US11537699B2 (en) Authentication techniques in response to attempts to access sensitive information
US7780080B2 (en) Portable device and methods for performing secure transactions
US8782404B2 (en) System and method of providing trusted, secure, and verifiable operating environment
US8375220B2 (en) Methods and systems for secure remote wake, boot, and login to a computer from a mobile device
CN113902446A (zh) 基于安全单元和可信执行环境的人脸支付安全方法
CN107077355A (zh) 用于对平台进行初始化的方法、系统和装置
GB2511054A (en) Protecting multi-factor authentication
WO2018045916A1 (zh) 一种授权方法、系统及卡片
JP2012094146A (ja) 特に資源の利用に関する利用者の認証によって保護された関数の実行を制御する方法及びシステム
CN108122111B (zh) 安全支付方法、装置、存储介质和计算机设备
US11017062B2 (en) Method for the secure interaction of a user with a mobile terminal and a further entity
KR20210005841A (ko) 전자 장치의 무결성 검사
JP2004206258A (ja) 多重認証システム、コンピュータプログラムおよび多重認証方法
US12019717B2 (en) Method for the secure interaction of a user with a mobile terminal and a further entity
JP2008152490A (ja) 個の認証方法及び取引処理装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20794615

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021562902

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2020794615

Country of ref document: EP

Effective date: 20211012

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20217035330

Country of ref document: KR

Kind code of ref document: A