Authentication method and device based on authentication equipment

Abstract

The invention discloses an authentication method and device based on authentication equipment. The method comprises: a client obtaining an application ID according to an obtained uniform resource identifier (URI), and sending an equipment authentication request obtained according to the application ID and the URI to a server; receiving the current authentication data sent by the server; obtaining a client data object according to the challenge value in the current authentication data, hashing the client data object and the application ID in the current authentication data to obtain client parameters, obtaining the key identifier in the current authentication data, and sending current authentication request information composed of the client parameters, the key identifier and a key identifier length to authentication equipment; receiving the authentication response information returned by the authentication equipment, and sending a signature verification request composed of the authentication response information, the client data object and the conversation ID in the current authentication data to the server; and receiving the information returned by the server, authentication being successful if successful information is returned, or else being failed.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a method and equipment for authentication based on authentication equipment. Background technique [0002] In the prior art, the password-based online identity authentication technology has great risks. The user's password can be obtained through technical means such as guessing, network theft of credit certificates, and phishing. If the password used by the user is short or easy to decipher Weak passwords are easy to be attacked, resulting in leakage of personal privacy information and even property loss; traditional identity authentication methods require the client to send a password to the remote server’s password database for comparison, but there is a risk of being intercepted and cracked, and the password Stored on the same remote server, if the super administrator account is stolen, the passwords of all users in the remote server will be leaked. Contents of t...

AI Technical Summary

Problems solved by technology

[0002] In the prior art, the password-based online identity authentication technology has great risks. The user's password can be obtained through technical means such as guessing, network theft of credit certificates, and phishing. If the password used by the user is short or easy to decipher Weak passwords are easy to be attacked, resulting in leakage of personal privacy information and even property loss; traditional identity authentication methods require the client to send a password to the remote server’s password database for comparison, but there is a risk of being intercepted and cracked, and the password Stored on the same remote server, if the super administrator account is stolen, the passwords of all users in the remote server will be leaked

Images