CN111931158A - Bidirectional authentication method, terminal and server - Google Patents

Abstract

Embodiments of the present invention provide a two-way authentication method, a terminal, and a server, including the terminal sending a public key of a signature certificate to the server, wherein the public key of the signature certificate matches the private key of the signature certificate pre-stored by the terminal; the The terminal receives the encryption certificate public key sent by the server, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server; The key pair chaotic sequence is processed to obtain authentication information; the terminal sends the authentication information to the server, and the server verifies the authentication information according to the signature certificate public key and the encryption certificate private key. The application can realize two-way authentication, and adopts the national secret algorithm to replace the international encryption algorithm, and re-implements the process of two-way authentication based on the national secret algorithm, so that the security performance is significantly improved.

Description

A two-way authentication method, terminal and server

technical field

The invention relates to the technical field of authentication, in particular to a bidirectional authentication method, a terminal and a server.

Background technique

POS machines often use sign-in operations in the process of use, the purpose is to update the work key, so that sensitive information such as bank card passwords involved in the transaction process can be protected from being leaked. Before the sign-in operation, the machine terminal needs to perform two-way authentication with the background server to confirm the legality of the identities of both parties.

In the existing technology, a new mode of two-way authentication key negotiation can be realized through 2 rounds of interaction. The first round of identity authentication in this mode is implemented by the national secret algorithm SM2 encryption and decryption and signature verification module, and the second round of identity authentication adopts Implementation of the national secret algorithm SM3 hash operation.

In the two-way authentication implementation commonly used in the POS industry, because the implementation process is relatively simple and the security factor is low, privacy cannot be well protected.

SUMMARY OF THE INVENTION

In view of the above problems, the embodiments of the present invention are proposed to provide a bidirectional authentication method, terminal and server that overcome the above problems or at least partially solve the above problems.

In order to solve the above problem, an embodiment of the present invention discloses a two-way authentication method, including: the method is applied to the two-way authentication of a POS terminal and a background server, and the method includes:

The terminal sends the public key of the signature certificate to the server, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal;

The terminal receives the encryption certificate public key sent by the server, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server;

The terminal processes the chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to obtain authentication information;

The terminal sends the authentication information to the server, and the server verifies the authentication information according to the public key of the signature certificate and the private key of the encryption certificate.

Preferably, before the step of processing the chaotic sequence according to the private key of the signature certificate and the public key of the encrypted certificate to obtain the authentication information, the terminal further includes:

the terminal sends the first random value to the server;

receiving, by the terminal, a second random value from the server, wherein the second random value is generated by the server according to the first random value;

The terminal determines a chaotic sequence based on the second random value and the first random value.

Preferably, the step of the terminal processing a preset chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to determine the authentication information includes:

The terminal signs the chaotic sequence according to the private key of the signature certificate, and generates signature information;

The terminal encrypts the chaotic sequence according to the encryption certificate public key data, and generates an encrypted file;

The authentication information includes signature information and encrypted files.

Preferably, the step of the server verifying the authentication information according to the public key of the signature certificate and the private key of the encrypted certificate includes:

The server decrypts the encrypted file according to the private key of the encryption certificate;

The server verifies the signature information according to the public key of the signature certificate.

In addition, the present application also provides a two-way authentication terminal, and the terminal includes:

Sending module: used to send the public key of the signature certificate, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal;

Receiving module: used to receive an encryption certificate public key, wherein the encryption certificate public key is determined according to the signature certificate public key;

Processing module: used to process the chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to obtain authentication information;

Authentication module: used to send the authentication information.

Preferably, the processing module further includes:

The first module: used to send the first random value;

second module: for receiving a second random value, wherein the second random value is generated according to the first random value;

Chaos module: used to determine a chaotic sequence based on the second random value and the first random value.

Preferably, the processing module includes:

Signature module: used to sign the chaotic sequence according to the private key of the signature certificate, and generate signature information;

Encryption module: used to encrypt the chaotic sequence according to the public key data of the encryption certificate, and generate an encrypted file;

File module: used for the authentication information including signature information and encrypted files.

The application also provides a two-way authentication server, the server includes:

Signature certificate module: used to receive the public key of the signature certificate, wherein the public key of the signature certificate matches the private key of the signed certificate;

Encryption certificate module: used to send an encryption certificate public key, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server;

Information module: used to receive authentication information, wherein the authentication information is obtained according to the private key of the signature certificate and the public key of the encryption certificate;

Verification module: used to verify the authentication information according to the public key of the signature certificate and the private key of the encrypted certificate.

The present invention also provides an electronic device comprising a processor, a memory and a computer program stored on the memory and capable of running on the processor, the computer program implementing the steps of the mutual authentication method when executed by the processor.

The present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by the processor, implements the steps of the two-way authentication method.

The embodiment of the present invention includes: the terminal sends the public key of the signed certificate to the server, wherein the public key of the signed certificate matches the private key of the signed certificate pre-stored by the terminal; the terminal receives the public key of the encrypted certificate sent by the server , wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server; the terminal processes the chaotic sequence according to the signature certificate private key and the encryption certificate public key to obtain authentication information; The terminal sends the authentication information to the server, and the server verifies the authentication information according to the public key of the signature certificate and the private key of the encryption certificate. The application specifically includes the following advantages. The application can realize two-way authentication, and adopts the national secret algorithm to replace the international encryption algorithm. Based on the national secret algorithm, the process of two-way authentication is re-implemented, and the security performance is significantly improved.

Description of drawings

Fig. 1 is a flow chart of steps of a two-way authentication method embodiment of the present invention;

2 is a structural block diagram of a two-way authentication terminal embodiment of the present invention;

Fig. 3 is the electronic device that the present invention realizes the two-way authentication method;

4 is a flow chart of steps of an embodiment of an existing authentication method;

Fig. 5 is the step flow chart based on the national secret algorithm of a kind of two-way authentication of the present invention;

FIG. 6 is a flow chart of steps in an embodiment of a two-way authentication method according to the present invention.

Detailed ways

In order to make the above objects, features and advantages of the present invention more clearly understood, the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

One of the core concepts of the embodiments of the present invention is that the present application can realize two-way authentication, and the national secret algorithm is used instead of the international encryption algorithm to realize the process of realizing the two-way authentication based on the national secret algorithm, so that the security performance is significantly improved.

Referring to FIG. 1, a flow chart of steps of an embodiment of a two-way authentication method of the present invention is shown, which may specifically include the following steps:

Step S100, the terminal sends the public key of the signature certificate to the server, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal.

Step S200, the terminal receives the encryption certificate public key sent by the server, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server.

Step S300, the terminal processes the chaotic sequence according to the private key of the signature certificate and the public key of the encrypted certificate to obtain authentication information.

Step S400, the terminal sends the authentication information to the server, and the server verifies the authentication information according to the public key of the signature certificate and the private key of the encrypted certificate.

Before the step of processing the chaotic sequence according to the private key of the signature certificate and the public key of the encrypted certificate, the terminal further includes:

The terminal sends the first random value to the server.

The terminal receives a second random value from the server, wherein the second random value is generated by the server according to the first random value.

The terminal determines a chaotic sequence based on the second random value and the first random value.

The step that the terminal processes the preset chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to determine authentication information includes: the terminal signs the chaotic sequence according to the private key of the signature certificate , and generate signature information; the terminal encrypts the chaotic sequence according to the public key data of the encryption certificate to generate an encrypted file; the authentication information includes signature information and an encrypted file.

The step that the server verifies the authentication information according to the public key of the signature certificate and the private key of the encrypted certificate, includes:

The server decrypts the encrypted file according to the private key of the encryption certificate; and the server verifies the signature information according to the public key of the signature certificate.

The existing POS machine often needs to perform a sign-in operation in the process of use, the purpose is to update the working key, so that the sensitive information such as the bank card password involved in the transaction process can be protected from being leaked. Before the sign-in operation, the machine terminal needs to perform two-way authentication with the background server to confirm the legality of the identities of both parties.

Cryptographic algorithms are the core technology to ensure information security, especially in the core areas of the banking industry. For a long time, international common cryptographic algorithm systems and related standards such as triple data encryption algorithms and cryptographic hash functions have been used. As financial security has risen to the level of national security, in recent years, relevant state agencies and regulatory agencies have put forward the requirements of promoting the application and implementation of national secret algorithms and strengthening the security and controllability of the industry from the perspective of national security and long-term strategies. In order to get rid of excessive dependence on foreign technologies and products, build an industry network security environment, and enhance the security and controllability of my country's industry information methods.

In the two-way authentication implementation commonly used in the POS industry, the cryptographic algorithms all use international cryptographic algorithms. This application proposes a two-way authentication implementation using a national cryptographic algorithm.

In the two-way authentication implementation commonly used in the POS industry, random numbers and transmission keys are used for mutual authentication between the machine terminal and the background server, but because the implementation process is simple, the degree of security is not high. This paper proposes a method of mutual verification using two-way random numbers, encryption and signature certificates on the basis of using the national secret algorithm to improve the security of two-way authentication.

Referring to FIG. 2, it shows a structural block diagram of a two-way authentication terminal embodiment of the present invention, which may specifically include the following modules:

Sending module 100: used for the terminal to send the public key of the signature certificate, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal.

Receiving module 200: used for the terminal to receive an encryption certificate public key, wherein the encryption certificate public key is determined according to the signature certificate public key.

Processing module 300: used by the terminal to process the chaotic sequence according to the private key of the signature certificate and the public key of the encrypted certificate to obtain authentication information.

Authentication module 400: used for the terminal to send the authentication information.

The processing module 300 further includes:

The first module: used for the terminal to send the first random value.

The second module: for the terminal to receive a second random value, wherein the second random value is generated according to the first random value.

Chaos module: used for the terminal to determine a chaotic sequence based on the second random value and the first random value.

The processing module 300 includes:

Signature module: the terminal signs the chaotic sequence according to the private key of the signature certificate, and generates signature information.

Encryption module: the terminal encrypts the chaotic sequence according to the public key data of the encryption certificate, and generates an encrypted file;

File module: the authentication information includes signature information and encrypted files.

As for the terminal embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the partial description of the method embodiment.

The present application also includes a two-way authentication server, and the server includes:

Signature certificate module: the server receives the public key of the signature certificate, wherein the public key of the signature certificate matches the private key of the signed certificate;

Encryption certificate module: the server sends an encryption certificate public key, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server;

Information module: the server receives authentication information, wherein the authentication information is obtained according to the private key of the signature certificate and the public key of the encryption certificate;

Verification module: the server verifies the authentication information according to the public key of the signature certificate and the private key of the encryption certificate.

Before the information module, it also includes:

The first random value module: used for the server to receive the first random value;

Second random value module: the server generates and sends a second random value according to the first random value.

The verification module includes:

Decomposition module: used to decompose the authentication information into encrypted files and signature information;

Decryption module: used for the server to decrypt the encrypted file according to the private key of the encryption certificate;

Signature verification module: used for the server to perform signature verification on the signature information according to the public key of the signature certificate.

Referring to FIG. 4 , a flow chart of steps of an embodiment of an existing authentication method is shown, as follows: the machine terminal generates a random number and encrypts it with a transmission key, and the server has a private key corresponding to the transmission key in the background, which can be decrypted. The decrypted data is calculated by triple data encryption algorithm on 16 bytes to obtain the check value, and the check value is compared to see if the check value is consistent. If they are consistent, the two-way authentication succeeds. However, the implementation process of the prior art is relatively simple, and the degree of security is not high.

Referring to Fig. 5, a flow chart of steps based on the national secret algorithm of a two-way authentication of the present invention is shown, and the details are as follows: the national secret algorithm is implemented by the hardware of the chip, the chip manufacturer provides the software interface of the national secret algorithm, and we repackage , to enhance the readability of the software interface, its Chinese encryption algorithm includes the following algorithms: SM2 encryption algorithm, SM2 decryption algorithm, SM2 signature algorithm, SM2 signature verification algorithm, SM3 hash value calculation algorithm, SM4 algorithm.

Referring to FIG. 6, a flow chart of steps of an embodiment of a two-way authentication method of the present invention is shown, and the specific steps are as follows:

In a specific embodiment, it includes:

The terminal sends the public key of the signature certificate to the server, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal;

The terminal receives the encryption certificate public key sent by the server, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server;

In one embodiment, the terminal generates a first chaotic sequence, and uses part of the values in the first chaotic sequence as a first random number, and sends it to the server;

generating, by the server, a second random number according to the first random number;

The terminal receives the second random number, and combines the second random number with the first chaotic sequence and the first random number to generate a chaotic sequence.

In one embodiment, the terminal generates a random number of 48 bytes, preferably the first 16 bytes of the 48 random bytes generated by the terminal can be sent to the server as the first random number;

The server generates the second random number according to the first random number, that is, 16 bytes, and sends the 16 bytes regenerated by the server to the terminal as the second random number;

The terminal replaces the middle 16 bytes of the 48-byte random number generated by the terminal with the second random number, and uses the recombined 48 bytes as the chaotic sequence;

The terminal reads the public key data of the encryption certificate, and encrypts a 48-byte random number with the national secret SM2 algorithm;

The terminal reads the private key data of the signature certificate again, and signs the hash result of the 48-byte random number with the national secret SM2 algorithm, and the hash result is obtained by calculating with the national secret SM3 algorithm;

The terminal sends the encrypted and signed data to generate authentication information to the server;

The server uses the private key of the decryption certificate and the public key of the verification certificate to decrypt and verify the signature respectively. Specifically, the national secret SM2 and SM4 algorithms are used to decrypt and verify the signature respectively;

If the signature verification succeeds, the two-way authentication succeeds, and if the signature verification fails, the two-way authentication fails.

It should be noted that, for the sake of simple description, the method embodiments are described as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not limited by the described action sequences, because According to embodiments of the present invention, certain steps may be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

Referring to Fig. 3, a computer device of the XX method of the present invention is shown, which may specifically include the following:

In an embodiment of the present invention, the present invention also provides a computer device, the above-mentioned computer device 12 is represented in the form of a general-purpose computing device, and the components of the computer device 12 may include but are not limited to: one or more processors or processing units 16, System memory 28, a bus 18 that connects various system components, including system memory 28 and processing unit 16.

The bus 18 represents one or more of several types of bus 18 structures, including a memory bus 18 or a memory controller, a peripheral bus 18, a graphics acceleration port, a processor, or an office using any of a variety of bus 18 structures. Domain bus 18. By way of example, these architectures include, but are not limited to, Industry Standard Architecture (ISA) bus 18, Micro Channel Architecture (MAC) bus 18, Enhanced ISA bus 18, Audio Video Electronics Standards Association (VESA) local bus 18, and Peripheral Component Interconnect (PCI) bus 18 .

Computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 12, including both volatile and nonvolatile media, removable and non-removable media.

System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 31 and/or cache memory 32 . Computer device 12 may further include other removable/non-removable, volatile/non-volatile computer system storage media. For example only, storage system 34 may be used to read and write to non-removable, non-volatile magnetic media (commonly referred to as "hard drives"). Although not shown in Figure 3, a magnetic disk drive may be provided for reading and writing to removable non-volatile magnetic disks (eg "floppy disks"), and removable non-volatile optical disks (eg CD-ROM, DVD-ROM) or other optical media) to read and write optical drives. In these cases, each drive may be connected to bus 18 through one or more data media interfaces. The memory may include at least one program product having a set (eg, at least one) of program modules 42 configured to perform the functions of various embodiments of the present invention.

A program/utility 41 having a set (at least one) of program modules 42, which may be stored, for example, in memory, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules 42 and program data, each or some combination of these examples may include an implementation of a network environment. Program modules 42 generally perform the functions and/or methods of the described embodiments of the present invention.

The computer device 12 may also communicate with one or more external devices 14 (eg, a keyboard, pointing device, display 24, camera, etc.), may also communicate with one or more devices that enable a user to interact with the computer device 12, and/or Or with any device (eg, network card, modem, etc.) that enables the computer device 12 to communicate with one or more other computing devices. Such communication may take place through input/output (I/O) interface 22 . Also, the computer device 12 may communicate with one or more networks (eg, a local area network (LAN)), a wide area network (WAN), and/or a public network (eg, the Internet) through a network adapter 20 . As shown, network adapter 21 communicates with other modules of computer device 12 via bus 18 . It should be understood that, although not shown, other hardware and/or software modules may be used in conjunction with computer device 12, including but not limited to: microcode, device drivers, redundant processing units 16, external disk drive arrays, RAID systems, magnetic tapes drives and data backup storage systems 34 and the like.

The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, to implement the two-way authentication method provided by the embodiment of the present invention.

That is, when the above-mentioned processing unit 16 executes the above-mentioned program, it realizes: the terminal sends the public key of the signature certificate to the server, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal;

The terminal receives the encryption certificate public key sent by the server, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server;

The terminal processes the chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to obtain authentication information;

The terminal sends the authentication information to the server, and the server verifies the authentication information according to the public key of the signature certificate and the private key of the encryption certificate.

In an embodiment of the present invention, the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, implements the method for mutual authentication provided by all the embodiments of the present application.

That is, when the program is executed by the processor, the terminal sends the public key of the signature certificate to the server, wherein the public key of the signature certificate matches the private key of the signature certificate stored in advance by the terminal;

The terminal receives the encryption certificate public key sent by the server, wherein the encryption certificate public key matches the encryption certificate private key pre-stored by the server;

The terminal processes the chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to obtain authentication information;

The terminal sends the authentication information to the server, and the server verifies the authentication information according to the public key of the signature certificate and the private key of the encryption certificate.

Any combination of one or more computer-readable media may be employed. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor method, apparatus or device, or a combination of any of the above. More specific examples (a non-exhaustive list) of computer readable storage media include: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), Erasable Programmable Read Only Memory (EPOM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution method, apparatus, or device.

A computer-readable signal medium may include a propagated data signal in baseband or as part of a carrier wave, with computer-readable program code embodied thereon. Such propagated data signals may take a variety of forms including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can transmit, propagate, or transmit a program for use by or in conjunction with an instruction execution method, apparatus, or device. .

Computer program code for carrying out operations of the present invention may be written in one or more programming languages, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional Procedural programming language - such as the "C" language or similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (eg, using an Internet service provider to via Internet connection).

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments may be referred to each other.

It should be understood by those skilled in the art that the embodiments of the embodiments of the present invention may be provided as a method, an apparatus, or a computer program product. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, CD-ROM, optical storage, and the like.

Embodiments of the present invention are described with reference to flowcharts and/or block diagrams of methods, terminal devices (methods), and computer program products according to embodiments of the present invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal equipment to produce a machine that causes the instructions to be executed by the processor of the computer or other programmable data processing terminal equipment Means are created for implementing the functions specified in the flow or flows of the flowcharts and/or the blocks or blocks of the block diagrams.

These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal equipment to operate in a particular manner, such that the instructions stored in the computer readable memory result in an article of manufacture comprising instruction means, the The instruction means implement the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing terminal equipment, so that a series of operational steps are performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby executing on the computer or other programmable terminal equipment The instructions executed on the above provide steps for implementing the functions specified in the flowchart or blocks and/or the block or blocks of the block diagrams.

Although preferred embodiments of the embodiments of the present invention have been described, additional changes and modifications to these embodiments may be made by those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be construed to include the preferred embodiments as well as all changes and modifications that fall within the scope of the embodiments of the present invention.

Finally, it should also be noted that in this document, relational terms such as first and second are used only to distinguish one entity or operation from another, and do not necessarily require or imply these entities or that there is any such actual relationship or sequence between operations. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or terminal device comprising a list of elements includes not only those elements, but also a non-exclusive list of elements. other elements, or also include elements inherent to such a process, method, article or terminal equipment. Without further limitation, an element defined by the phrase "comprises a..." does not preclude the presence of additional identical elements in the process, method, article or terminal device comprising said element.

A two-way authentication method provided by the present invention has been introduced in detail above. The principles and implementations of the present invention are described with specific examples in this paper. Its core idea; at the same time, for those skilled in the art, according to the idea of the present invention, there will be changes in the specific implementation and application scope. limit.

Claims (10)

1. A bidirectional authentication method is applied to bidirectional authentication of a POS machine terminal and a background server, and is characterized by comprising the following steps:

the terminal sends a public key of a signature certificate to the server, wherein the public key of the signature certificate is matched with a private key of the signature certificate stored in the terminal in advance;

the terminal receives an encrypted certificate public key sent by the server, wherein the encrypted certificate public key is matched with an encrypted certificate private key stored in the server in advance;

the terminal processes the chaotic sequence according to the signature certificate private key and the encryption certificate public key to obtain authentication information;

and the terminal sends the authentication information to a server, and the server verifies the authentication information according to the public key of the signature certificate and the private key of the encryption certificate.

2. The mutual authentication method according to claim 1, wherein before the step of processing the chaotic sequence by the terminal according to the private key of the signature certificate and the public key of the encryption certificate to obtain the authentication information, the method further comprises:

the terminal sends a first random value to a server;

the terminal receives a second random value of the server, wherein the second random value is generated by the server according to the first random value;

the terminal determines a chaotic sequence based on the second random value and the first random value.

3. The mutual authentication method according to claim 2, wherein the step of the terminal processing the chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to obtain the authentication information comprises:

the terminal signs the chaotic sequence according to the private key of the signature certificate to generate signature information;

the terminal encrypts the chaotic sequence according to the public key data of the encryption certificate to generate an encrypted file;

the authentication information includes the signature information and the encrypted file.

4. The mutual authentication method according to claim 3, wherein the step of verifying the authentication information by the server according to the public key of the signature certificate and the private key of the encryption certificate comprises:

the server decrypts the encrypted file according to the private key of the encrypted certificate;

and the server checks the signature information according to the public key of the signature certificate.

5. A bi-directional authentication terminal, characterized in that the terminal comprises:

a sending module: the terminal is used for sending a public key of a signature certificate, wherein the public key of the signature certificate is matched with a private key of the signature certificate stored in the terminal in advance;

a receiving module: the system comprises a public key module, a public key module and a public key module, wherein the public key module is used for receiving an encrypted certificate public key, and the encrypted certificate public key is determined according to the signature certificate public key;

a processing module: the system is used for processing the chaotic sequence according to the private key of the signature certificate and the public key of the encryption certificate to obtain authentication information;

an authentication module: for sending the authentication information.

6. The mutual authentication terminal as claimed in claim 5, wherein the processing module further comprises:

a first module: for transmitting a first random value;

a second module: for receiving a second random value, wherein the second random value is generated according to the first random value;

a chaotic module: and the chaotic sequence is determined according to the second random value and the first random value.

7. The mutual authentication terminal as claimed in claim 5, wherein the processing module comprises:

a signature module: the private key is used for signing the chaotic sequence according to the private key of the signature certificate to generate signature information;

an encryption module: the encryption device is used for encrypting the chaotic sequence according to the public key data of the encryption certificate to generate an encrypted file;

a file module: the authentication information comprises signature information and an encrypted file.

8. A mutual authentication server, wherein the server comprises:

a signature certificate module: the system comprises a public key module, a public key module and a private key module, wherein the public key module is used for receiving a signature certificate public key, and the signature certificate public key is matched with a signature certificate private key;

an encryption certificate module: the system comprises a public key module, a public key module and a public key module, wherein the public key module is used for sending an encrypted certificate public key, and the encrypted certificate public key is matched with a prestored encrypted certificate private key;

an information module: the system is used for receiving authentication information, wherein the authentication information is obtained according to the private key of the signature certificate and the public key of the encryption certificate;

a verification module: and the authentication information is verified according to the public key of the signature certificate and the private key of the encryption certificate.

9. Electronic device, characterized in that it comprises a processor, a memory and a computer program stored on said memory and capable of running on said processor, said computer program, when executed by said processor, implementing the steps of the mutual authentication method according to any one of claims 1 to 4.

10. Computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, carries out the steps of the mutual authentication method according to any one of claims 1 to 4.

Images