CN101841814B - Terminal authentication method and system - Google Patents

Abstract

The invention discloses a terminal authentication method and terminal authentication system. In the method, an authentication server performs primary authentication of a terminal according to first authentication data sent by the terminal, wherein the first authentication data is generated according to the user characteristic information of the terminal; the authentication server performs secondary authentication of the terminal according to second authentication data sent by the terminal, wherein the second authentication data is generated according to an authentication secret key, a terminal parameter and a network parameter; and when both the primary authentication and the secondary authentication are successful, the authentication server determines that the terminal authentication is successful. When the technical scheme of the invention is adopted, the safety of the use of the network of the user is improved, the protection of the individual privacy of the user is improved, and the legal right and interests of an operator are protected.

Description

Terminal authentication method and system

technical field

The present invention relates to the field of mobile communication, in particular to a terminal authentication method and system.

Background technique

With the rapid development and popularization of mobile communication technology, the security of communication technology has increasingly become a hot topic of concern. The security of communication is very important to protect the personal privacy and interests of end users from infringement. At present, the following methods are mainly used to enhance the security of end users:

1. The signaling and data (voice, short message, etc.) exchanged between the terminal and the mobile communication system are encrypted by a specific security algorithm to prevent plaintext transmission from being monitored.

2. Use IMSI (International Mobile Station Identity) or ESN (Electronic Serial Number) as the identification of the mobile station.

3. The terminal authentication mechanism is introduced. The usual process of authentication is that the base station sends a random number to the mobile station on the forward channel. Specific prefabricated network parameters (such as Key in the CDAM system, or Ki in the GSM system) calculate an authentication result through the authentication algorithm, and send the authentication result to the base station through the reverse channel. The authentication center AC (Authentication Center) uses the same method to calculate the authentication result based on the stored mobile station confidential data, and compares the above two authentication results to determine whether the terminal authentication is successful. Authentication is actually an algorithm based on confidential data. As long as the confidential data is not leaked, even if the pirate obtains the identity of the mobile station, he cannot calculate the correct authentication result and cannot access the network.

For the convenience of users, operators usually use the machine-card separation scheme to fix some specific network parameters into the user identification card (such as SIM card) or into the non-volatile storage unit of the terminal before the terminal is sold, so that the user can When using the network, as long as the parameters in the user identification card are valid, the terminal can use the system services normally. The security of the user identification card is also protected by a specific encryption algorithm, and the security algorithm of the card itself is constantly being updated.

However, many tools for duplicating stolen cards have appeared on the market at present. Through such tools, it can be easily realized to crack the SIM card and completely copy the data in the card to another card. All parameters will be copied, including authentication algorithms and all important parameters required for voice encryption. If the user's SIM card is accidentally lost or stolen, personal privacy and interests (illegally stealing the user's phone bill) may be violated. If the user obtains this tool, he can copy the card at will, such as the function of one card with multiple numbers (currently mobile cards with this function, but an additional fee will be charged), or copy a card into multiple cards, and also give Harm to the management and interests of the operator.

To sum up, the existing terminal authentication mechanism is not enough to guarantee the security of terminal users using the network and the legitimate rights and interests of operators.

Contents of the invention

The main purpose of the present invention is to provide a terminal authentication method and system to at least solve the problem that the existing terminal authentication mechanism is not enough to ensure the security of the terminal user using the network and the legal rights and interests of the operator.

According to one aspect of the present invention, a terminal authentication method is provided, including: the authentication server performs first authentication on the terminal according to the first authentication data sent by the terminal, wherein the first authentication data is based on the user characteristics of the terminal information generation; the authentication server performs second authentication according to the second authentication data sent by the terminal, wherein the second authentication data is generated according to the authentication key, terminal parameters and network parameters; If all authorizations are successful, the authentication server determines that the terminal authentication is successful.

According to another aspect of the present invention, a terminal authentication system is provided, including: a terminal and an authentication server, wherein, the terminal includes: a first authentication data module, configured to generate first authentication data, and send to the authentication The authorization server sends the first authentication data, wherein the first authentication data is generated according to the user characteristic information of the terminal; the second authentication data module is used to generate the second authentication data, and send the second authentication data to the authentication server data, wherein the second authentication data is generated according to the authentication key, terminal parameters, and network parameters; the authentication server includes a first authentication module, configured to perform first authentication on the terminal according to the first authentication data, and Output the first authentication result; the second authentication module is used to perform the second authentication according to the second authentication data when the first authentication is successful, and output the second authentication result; the authentication success judging module , respectively connected to the first authentication module and the second authentication module, for judging the input first authentication result and the second authentication result, in the case that both the first authentication result and the second authentication result are successful , to determine that the authentication of the terminal is successful.

Through the technical solution provided by the present invention, when the mobile terminal normally uses network services, such as registering, calling, short messages, data services and other operations, a user characteristic information authentication is added to the existing authentication mechanism, and the terminal Only when authentication is performed twice, and both authentications are successful, the authentication server can determine that the authentication of the terminal is successful, thereby enhancing the security of the user's use of the network and also enhancing the protection of the user's personal privacy. And can protect the legitimate rights and interests of operators.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

FIG. 1 is a schematic structural diagram of a mobile communication network system for terminal authentication according to an embodiment of the present invention;

FIG. 2 is a flow chart of a terminal authentication method according to an embodiment of the present invention;

Fig. 3 is a first authentication flowchart according to an embodiment of the present invention;

FIG. 4 is a flow chart of performing first authentication on the terminal using encrypted first authentication data according to an embodiment of the present invention;

FIG. 5 is a flow chart of terminal authentication according to Embodiment 1 of the present invention;

FIG. 6 is a flow chart of terminal authentication according to Embodiment 2 of the present invention;

FIG. 7 is a schematic structural diagram of a terminal authentication system according to an embodiment of the present invention;

Fig. 8 is a schematic structural diagram of a first authentication data module according to an embodiment of the present invention;

Fig. 9A is a schematic structural diagram of a first authentication module according to an embodiment of the present invention;

Fig. 9B is a schematic structural diagram of a preferred first authentication module according to an embodiment of the present invention.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

FIG. 1 is a schematic structural diagram of a mobile communication network system for terminal authentication according to an embodiment of the present invention. As shown in FIG. 1 , the network system includes a terminal 10, a base station 20, and an authentication server 30. During the authentication process, the terminal 10 sends the first authentication data and the second authentication data to the authentication server through the base station 20. After the authentication server receives the above two authentication data, it performs two authentications respectively. If the authentication is successful, the user is allowed to use the current service. It should be noted that the mobile communication network mentioned above can be any current mobile communication network, such as GSM, CDMA, WCDMA or TD-SCDMA.

According to an embodiment of the present invention, a terminal authentication method is provided. FIG. 2 is a flow chart of a terminal authentication method according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

Step S202, the authentication server performs first authentication on the terminal according to the first authentication data sent by the terminal, wherein the first authentication data is generated according to the user characteristic information of the terminal;

Step S204, the authentication server performs second authentication according to the second authentication data sent by the terminal, wherein the second authentication data is generated according to the authentication key, terminal parameters and network parameters;

Step S206, in the case that both the first authentication and the second authentication are successful, the authentication server determines that the terminal authentication is successful.

As mentioned above, in the existing terminal authentication mechanism, important parameters for terminal authentication are fixed in the user ID card by the operator, or fixed in the terminal before the terminal sales, once the user accidentally loses the user ID card or terminal, illegal users can crack the authentication data in the user identification card or terminal, and embezzle the user's card or terminal.

The invention emphatically considers possible security problems caused by cracking authentication data of a user identification card or a terminal, and improves the terminal authentication mechanism. Increase the verification of user characteristic information preset by the user. That is, the authentication server uses the first authentication data to authenticate the user characteristic information of the terminal, and the authentication server uses the second authentication data to authenticate the key of the terminal using an existing authentication mechanism. With the above two authentications, even if an illegal user obtains and cracks a user identification card or a terminal, he cannot use the duplicated user identification card or the cracked terminal to perform normal network services.

In the specific implementation process, there is no sequence of execution between the above step S202 and step S204, as long as the above first authentication and the second authentication are guaranteed to be executed, it can be determined whether the terminal is authenticated according to the two authentication results If any one of the above two authentications fails, the authentication of the terminal fails. Operators can choose to perform the first authentication first, and then trigger the second authentication after the first authentication is successful according to the characteristics or needs of the service; they can also choose to perform the second authentication first, and then trigger the first authentication after the second authentication is successful. Authorization; You can also choose to execute the first authentication and the second authentication concurrently.

Similarly, there is no order in which the terminal sends the first authentication data and the second authentication data. According to the service characteristics or agreement of the operator, the terminal can send the first authentication data first, or the second authentication data first. , the first authentication data and the second authentication data may also be sent simultaneously in the same data packet.

In the specific implementation process, terminal authentication may be involved in network registration, calls, short messages, and data services. The above-mentioned first authentication can be performed but not limited to the following situations: 1. It needs to be executed; 2. According to the setting of the communication network, optimization control can be carried out, and it can be carried out randomly or according to the specified requirements when verification is required, which can reduce the system overhead caused by too many verification times.

Using the above-mentioned terminal authentication method provided by the embodiment of the present invention, on the basis of integrating the existing authentication mechanism, adding the authentication of the user characteristic information preset by the user, so that the terminal user also becomes the terminal authentication A decisive factor, thereby protecting the legitimate rights and interests of users and enhancing the security of user terminals.

Preferably, the user characteristic information includes: personal information preset by the user and identification information of the user.

In the specific implementation process, users can preset personal information according to personal preferences, for example, personal information can be set as certificate number, name, birthday or other character sequences. The user's identification information can be selected from the identification information of the identification card on the terminal (such as ICCID, UMID, or the user's phone number), or the terminal's identification information (such as IMSI or ESN) or, for greater security, the user's identification information. The identification information of the identification card includes the identification information of the terminal, and the identification information of the identification card or the identification information of the terminal can conveniently use existing resources to set the identification information of the user.

By setting the personal information and the user's identification information in the user characteristic information, it is equivalent to setting the binding relationship between the user's identification information and personal information, so that after receiving the first authentication data, the authentication server can The information is stored in the database to obtain the pre-stored authentication data corresponding to the user identification information, and the legitimacy of the user characteristic information is determined by comparing the above two authentication data.

Fig. 3 is a flow chart of the first authentication according to an embodiment of the present invention. Preferably, as shown in Fig. 3, the authentication server performing the first authentication on the terminal according to the first authentication data sent by the terminal includes:

Step S302, receiving first authentication data from the terminal;

Step S304, obtaining the identification information of the user, obtaining personal information as the first personal information;

Step S306, acquiring second personal information corresponding to the identification information in the database of the authentication server;

Step S308, comparing the first personal information and the second personal information, if they are the same, the first authentication is successful; otherwise, the first authentication fails.

The first authentication is carried out by using the above process, and it is judged whether the first personal information sent by the terminal is the same as the second personal information corresponding to the same user ID saved by the authentication server, so as to determine whether the current terminal user is legal. If the illegal user has copied the user identification card, but due to the lack of correct personal information, the first authentication cannot be passed, thereby ensuring the personal rights and interests of the legal user.

Preferably, the first authentication data may be generated in the following manner: using a predetermined encryption rule, encrypting the personal information preset by the user and the user's identification information to generate the first authentication data.

Since the first authentication data may also be obtained by illegal users during the transmission process, if the first authentication data is transmitted in plain text, there will be a great security risk. Therefore, in the specific implementation process, users can pre-authorize The set personal information and the user's identification information are encrypted to generate the first authentication data. Operators and terminal manufacturers can agree on specific encryption rules, or in a more secure method, the terminal negotiates specific encryption rules with the authentication server during a specific business process. Therefore, by obtaining the first authentication data in an encrypted manner, the security of the user using the terminal is further ensured.

If the first authentication data is generated in an encrypted manner, the flow of the authentication server performing the first authentication will be different. FIG. A flowchart of authentication, preferably, as shown in Figure 4, the process includes:

Step S402, receiving first authentication data from the terminal;

Step S404, analyzing the first authentication data according to a predetermined decryption rule, obtaining the identification information and personal information of the user, and using the obtained personal information as the first personal information;

Step S406, acquiring second personal information corresponding to the user's identification information from the database of the authentication server;

Step S408, comparing the first personal information with the second personal information, if they are the same, the first authentication is successful; otherwise, the first authentication fails.

In a specific implementation process, the decryption rules correspond to the above encryption rules, and are agreed upon by the operator and the terminal manufacturer, or negotiated between the terminal and the authentication server. By encrypting and decrypting the transmission of user characteristic information, the security of the user's terminal is further ensured.

Preferably, before the authentication server performs the first authentication, the method further includes: the authentication server acquires and stores user personal information and user identification information of the above-mentioned terminal.

In order to realize the above-mentioned first authentication, the authentication server must pre-establish a user characteristic information database before performing terminal authentication, store the personal information of the registered user in the database, and bind the stored user personal information with the user ID one by one.

In the specific implementation process, the user needs to report the user characteristic information to the operator. There are many ways to report, for example, but not limited to submitting the user characteristic information when the terminal is connected to the network. Or log in to the operator's website and enter user characteristic information. Once the information is entered into the network side system, the user's personal information will be bound one-to-one with the user identification card or terminal used by the user. As long as it is judged that the user identification information and user information are not bound If there is no certain relationship, the user is considered illegal.

In the specific implementation process, the user can also update the user characteristic information in a specific way, for example, by text message, logging in to the operator's website, or directly changing it through the operator's business outlet.

The authentication server obtains and maintains the user characteristic information provided by the user before the terminal authentication, which is the premise of the first authentication. Only the authentication server saves the correct binding relationship between personal information and user identification information, and the first authentication to be successfully implemented.

Preferably, the identification information of the user includes at least one of the following: identification information of the smart card of the terminal, and identification information of the terminal.

The user's identification information can be selected from the identification information of the identification card on the terminal (such as ICCID, UMID, or the user's phone number), or the terminal's identification information (such as IMSI or ESN) or, for greater security, the user's identification information. The identification information of the identification card includes the identification information of the terminal, and the identification information of the identification card or the identification information of the terminal can conveniently use existing resources to set the identification information of the user.

Preferably, the personal information preset by the user can be stored in the internal memory of the terminal or on other storage media connected to the terminal. Since the user's personal information is not stored on the identification card (such as the SIM card) of the terminal, even if the identification card is lost, the user's personal information will not be leaked.

Preferably, the terminal can send the first authentication data to the authentication server through a short message or communication signaling.

In a specific implementation process, no matter which method is used to send the first authentication data, the authentication server can receive and perform the first authentication operation. Various sending methods make terminal authentication more flexible and convenient for operators to implement.

The above terminal authentication method will be described in detail below in combination with other embodiments.

Embodiment one

In this embodiment, the authentication server is selected to first perform the first authentication, and if the first authentication succeeds, the second authentication is triggered. FIG. 5 is a flow chart of terminal authentication according to Embodiment 1 of the present invention. As shown in FIG. 5, the process includes:

Step S501, the terminal is turned on.

Step S502, the terminal uses communication network services (network registration, voice, short message, data, etc.).

Step S503, according to the returned system message, the terminal determines whether to perform the first authentication.

Step S504, if the network requires the terminal to perform the first authentication, the terminal generates the first authentication data according to the personal information preset by the user including terminal information and card information combined with a specific encryption algorithm, and executes step S505; otherwise, Execute step S510.

Step S505, the terminal sends the first authentication data to the authentication server.

Step S506, the authentication server receives the first authentication data fed back by the terminal, parses out the user's personal information and user identification information, and compares the user's personal information reported by the terminal with the personal information stored in the database to generate a first authentication result .

Step S507, the authentication server delivers the first authentication result to the terminal.

Step S508, the terminal judges the first authentication result, if it fails, executes step S509, otherwise, executes step 510.

In step S509, the terminal prompts the user to prohibit the use of network services, and ends this operation process.

Step S510, the terminal sends the second authentication data, and the authentication server executes the second authentication operation. If the second authentication is successful, the user uses the network service normally, otherwise, prompts the user to prohibit the use of the network service.

Embodiment two

In this embodiment, the authentication server is selected to perform the second authentication first, and if the second authentication succeeds, the first authentication is triggered. FIG. 6 is a flow chart of terminal authentication according to Embodiment 2 of the present invention. As shown in FIG. 6, the process includes:

Step S601, the terminal is turned on.

Step S602, the terminal uses communication network services (network registration, voice, short message, data, etc.).

Step S603, the terminal sends the second authentication data, and the authentication server executes the second authentication operation, if the second authentication is successful, executes the step S604, otherwise, prompts the user to prohibit using the network service.

Step S604, according to the returned system message, the terminal determines whether to perform the first authentication.

Step S605, if the network requires the terminal to perform the first authentication, the terminal generates the first authentication data according to the personal information preset by the user including terminal information, card information and a specific encryption algorithm; if the first authentication is not required authorization, the terminal authentication is successful, and the user can use the network service normally.

Step S606, the terminal sends the first authentication data to the authentication server.

Step S607, the authentication server receives the first authentication data fed back by the terminal, parses out the user's personal information and user identification information, and compares the user's personal information reported by the terminal with the personal information stored in the database to generate a first authentication result .

Step S608, the authentication server delivers the first authentication result to the terminal.

Step S609, the terminal judges the result of the first authentication, if it fails, the terminal prompts the user to prohibit using the network service, and ends this operation process; otherwise, the terminal passes the authentication, and the user normally uses the network service.

According to an embodiment of the present invention, a terminal authentication system is also provided. FIG. 7 is a schematic structural diagram of a terminal authentication system according to an embodiment of the present invention. As shown in FIG. 7, the system includes: a terminal 71, an authentication server 72 .

Wherein, the terminal 71 includes: a first authentication data module 711 and a second authentication data module 712 . The first authentication data module 711 is configured to generate first authentication data and send the first authentication data to the authentication server 72, wherein the first authentication data is generated according to the user characteristic information of the terminal. The second authentication data module 711 is configured to generate second authentication data and send the second authentication data to the authentication server 72, wherein the second authentication data is generated according to the authentication key, terminal parameters and network parameters.

The authentication server 72 includes: a first authentication module 721 , a second authentication module 722 , and an authentication success judging module 723 . The first authentication module 721 is configured to perform a first authentication on the terminal according to the first authentication data, and output a first authentication result; the second authentication module 722 is configured to, when the first authentication is successful, Carry out the second authentication according to the second authentication data, and output the second authentication result; the authentication success judging module 723 is connected with the first authentication module 721 and the second authentication module 722 respectively, and is used to judge the inputted first authentication module 723 An authentication result and a second authentication result. If both the first authentication result and the second authentication result are successful, it is determined that the authentication of the terminal 71 is successful.

Fig. 8 is a schematic structural diagram of the first authentication data module according to an embodiment of the present invention. Preferably, as shown in Fig. 8, the first authentication data module 711 includes: a storage submodule 801, a generation submodule 802 and a sending submodule 803, wherein the storage sub-module 801 is used to store the personal information preset by the user and the user's identification information; the generation sub-module 802 is connected to the storage sub-module 801 and is used to obtain the personal information and the user's identification information to generate the first authentication authorization data; the sending sub-module 803 is connected with the generating sub-module 802 for obtaining the first authentication data and sending it to the authentication server 72.

9A is a schematic structural diagram of the first authentication module according to an embodiment of the present invention. Preferably, as shown in FIG. 9A, the first authentication module 721 includes: a data storage submodule 901, a receiving submodule 902, a first acquisition submodule module 903 , a second acquisition submodule 904 and a comparison submodule 905 . The data storage module 901 is used to store the personal information provided by the user; the receiving submodule 902 is used to receive the first authentication data; the first obtaining submodule 903 is connected to the receiving submodule 902 and is used to obtain the first authentication data The identification information of the user, and output to the second acquisition sub-module 904, and the personal information obtained from the first authentication data is output to the comparison sub-module 905 as the first personal information; the second acquisition sub-module 904, respectively, with the data storage The module 901, the first acquisition submodule 903 and the comparison submodule 905 are connected to acquire the personal information corresponding to the input user identification information in the data storage module 901 as the second personal information, and output it to the comparison submodule 905; The comparison submodule 905 is connected to the first acquisition submodule 903 and the second acquisition submodule 904 respectively, and is used to compare the input first personal information and second personal information, and generate a first authentication result.

Preferably, as shown in FIG. 9B, if the first authentication data is encrypted and generated using a predetermined encryption rule, the first authentication module 721 further includes: a parsing submodule 906, and a receiving submodule 902 and a first obtaining submodule 903 The connection is used for parsing the first authentication data received by the receiving submodule 902 and outputting the parsed first authentication data to the first obtaining submodule 903 .

In summary, the technical solution provided by the present invention adopts a double authentication mechanism, and on the basis of inheriting the existing authentication method, adds an authentication operation to the user characteristic information set by the user himself, which not only enhances the The security of using the network also enhances the protection of users' personal privacy, and can protect the legitimate rights and interests of operators.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (14)

1. A terminal authentication method, characterized in that, comprising: The authentication server performs first authentication on the terminal according to the first authentication data sent by the terminal, where the first authentication data is generated according to the user characteristic information of the terminal; The authentication server performs second authentication according to the second authentication data sent by the terminal, wherein the second authentication data is generated according to an authentication key, terminal parameters, and network parameters; If both the first authentication and the second authentication are successful, the authentication server determines that the authentication of the terminal is successful. 2. The method according to claim 1, wherein the user characteristic information includes: personal information preset by the user and identification information of the user. 3. The method according to claim 2, wherein the authentication server performing the first authentication on the terminal according to the first authentication data sent by the terminal comprises: receiving first authentication data from the terminal; Obtain the identification information of the user, and obtain the personal information as the first personal information; Obtain second personal information corresponding to the identification information from the database of the authentication server; Comparing the first personal information and the second personal information, if they are the same, the first authentication is successful; otherwise, the first authentication fails. 4. The method according to claim 2, characterized in that the first authentication data is generated in the following manner: using a predetermined encryption rule, encrypting the personal information preset by the user and the user's identification information The first authentication data. 5. The method according to claim 4, wherein the authentication server performing the first authentication on the terminal according to the first authentication data sent by the terminal comprises: receiving first authentication data from the terminal; Analyzing the first authentication data according to a predetermined decryption rule, obtaining the identification information of the user and the personal information, and using the obtained personal information as the first personal information; Obtain second personal information corresponding to the user's identification information in the authentication server; Comparing the first personal information and the second personal information, if they are the same, the first authentication is successful; otherwise, the first authentication fails. 6. The method according to claim 3 or 5, wherein before the authentication server performs the first authentication, the method further comprises: the authentication server acquires and stores the terminal's User personal information and user identification information. 7. The method according to any one of claims 2 to 5, wherein the identification information of the user includes at least one of the following: identification information of an identification card of the terminal, and identification information of the terminal. 8. The method according to any one of claims 2 to 5, wherein the personal information preset by the user is stored in the internal memory of the terminal or on other storage media connected to the terminal. 9. The method according to any one of claims 1 to 5, wherein the terminal sends the first authentication data to the authentication server through a short message or communication signaling. 10. A terminal authentication system, comprising: terminal, including: A first authentication data module, configured to generate first authentication data, and send the first authentication data to an authentication server, where the first authentication data is generated according to user characteristic information of the terminal; The second authentication data module is configured to generate second authentication data and send the second authentication data to the authentication server, wherein the second authentication data is based on the authentication key, terminal parameters and network parameters generate; The authentication server includes A first authentication module, configured to perform a first authentication on the terminal according to the first authentication data, and output a first authentication result; A second authentication module, configured to perform a second authentication according to the second authentication data and output a second authentication result if the first authentication is successful; The authentication success judging module is connected to the first authentication module and the second authentication module respectively, and is used to judge the input first authentication result and the second authentication result, in the second If both the first authentication result and the second authentication result are successful, it is determined that the authentication of the terminal is successful. 11. The system according to claim 10, wherein the first authentication data module comprises: The storage sub-module is used to store the personal information preset by the user and the identification information of the user; A generating submodule, connected to the storage submodule, is used to obtain the personal information and the user's identification information to generate first authentication data; The sending submodule is connected with the generating submodule, and is used to obtain the first authentication data and send it to the authentication server. 12. The system according to claim 10, wherein the first authentication module comprises: The data storage sub-module is used to store the personal information provided by the user; a receiving submodule, configured to receive the first authentication data; The first acquisition submodule is connected with the receiving submodule, and is used to acquire the identification information of the user of the first authentication data, and output it to the second acquisition submodule, and the individual who acquires the first authentication data The information is output to the comparison sub-module as the first personal information; The second acquisition submodule is respectively connected to the data storage submodule, the first acquisition submodule, and the comparison submodule, and is used to acquire and input the user's information in the data storage submodule. The personal information corresponding to the identification information is used as the second personal information, and is output to the comparison sub-module; The comparison submodule is connected to the first acquisition submodule and the second acquisition submodule respectively, and is used to compare the input first personal information and the second personal information, and generate the first personal information. 1. Authentication result. 13. The system according to claim 12, wherein if the first authentication data is encrypted and generated using a predetermined encryption rule, the first authentication module further includes: a parsing submodule, which is connected with the receiving The sub-module is connected to the first obtaining sub-module, and is used for analyzing the first authentication data received by the receiving sub-module, and outputting the parsed first authentication data to the first obtaining sub-module. 14. The system according to any one of claims 11 to 13, wherein the identification information of the user includes at least one of the following: identification information of the smart card of the terminal, and identification information of the terminal.

Images