[go: up one dir, main page]

WO2016155281A1 - 一种管理应用标识的方法及装置 - Google Patents

一种管理应用标识的方法及装置 Download PDF

Info

Publication number
WO2016155281A1
WO2016155281A1 PCT/CN2015/091766 CN2015091766W WO2016155281A1 WO 2016155281 A1 WO2016155281 A1 WO 2016155281A1 CN 2015091766 W CN2015091766 W CN 2015091766W WO 2016155281 A1 WO2016155281 A1 WO 2016155281A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
user
application
identification certificate
management device
Prior art date
Application number
PCT/CN2015/091766
Other languages
English (en)
French (fr)
Inventor
李英涛
魏何
马金博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2016155281A1 publication Critical patent/WO2016155281A1/zh
Priority to US15/498,310 priority Critical patent/US10630488B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1073—Registration or de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the present invention relates to the field of the Internet, and in particular, to a method and an apparatus for managing an application identifier.
  • the embodiment of the invention provides a method and a device for managing an application identifier, which can reduce the leakage of the user's private information while proving the identity of the user.
  • a first aspect of an embodiment of the present invention discloses a method for managing an application identifier, the method comprising:
  • the identifier management device receives an application identification certificate application request sent by the user;
  • the identifier management device acquires a user identifier and an application identifier of the user according to the application identifier certificate application request;
  • the identifier management device acquires the feature identifier of the user according to the user identifier
  • the identifier management apparatus generates an application target according to the application identifier and the feature identifier of the user Certificate of knowledge;
  • the identifier management device sends the application identification certificate to the user.
  • the identifier management device generates an application identifier certificate according to the application identifier and the feature identifier of the user, including:
  • the identifier management device combines the first randomization factor with the feature identifier of the user to obtain a first character string
  • the identifier management device hashes the first character string according to a preset hash function to obtain a first hash value
  • the identifier management device obtains a second character string according to the application identifier and the first hash value
  • the identifier management device digitally signs the second character string by using a private key to obtain a third character string
  • the identifier management apparatus assembles the application identifier and the third character string into the application identification certificate according to a preset order.
  • the application identification certificate application request further includes a type of the application identifier
  • the identifier management device generates an application identifier certificate according to the application identifier and the feature identifier of the user, which specifically includes:
  • the identifier management device generates an application identification certificate according to the application identifier, the type of the application identifier, and the feature identifier of the user.
  • the identifier management device generates an application identifier certificate according to the application identifier, the type of the application identifier, and the feature identifier of the user, and specifically includes:
  • the identifier management device combines the second randomization factor with the feature identifier of the user to obtain a fourth character string
  • the identifier management device hashes the fourth character string according to a preset hash function to obtain a second hash value
  • the identifier management device obtains a fifth character string according to the type of the application identifier, the application identifier, and the second hash value;
  • the identifier management device digitally signs the fifth character string by using a private key to obtain a sixth character string
  • the identifier management apparatus assembles the type of the application identifier, the application identifier, and the sixth character string into the application identification certificate according to a preset order.
  • the application identifier certificate request request further includes the The user's digital signature
  • the method further includes:
  • the identifier management device acquires a public key of the user according to the user identifier
  • the identifier management device verifies the digital signature of the user according to the public key of the user;
  • the identifier management apparatus When the digital signature of the user is verified, the identifier management apparatus generates an application identification certificate according to the application identifier and the feature identifier of the user.
  • the identifier management device before the sending the application identification certificate to the user, the identifier management device further includes:
  • the identifier management device encrypts the application identification certificate according to the public key of the user
  • the sending, by the identifier management device, the application identifier to the user specifically includes:
  • the identity management device sends the encrypted application identifier to the user.
  • the identifier management apparatus obtains according to the user identifier Before the feature identifier of the user, the method further includes:
  • the identifier management device receives a user identifier and a biometric feature sent by the user;
  • the identifier management apparatus generates a feature identifier of the user according to the first preset algorithm and the biometric feature;
  • the identifier management device saves a correspondence between the user identifier and the feature identifier of the user;
  • the obtaining, by the identifier management device, the feature identifier of the user according to the user identifier includes:
  • the identifier management device acquires the feature identifier of the user corresponding to the user identifier according to the corresponding relationship.
  • the identifier management apparatus obtains the identifier according to the user identifier
  • the feature identifier of the user specifically includes:
  • the identifier management device acquires biometrics of the user from the user identifier
  • the identifier management device generates a feature identifier of the user according to the second preset algorithm and the biometric feature of the user.
  • a second aspect of the embodiments of the present invention discloses a method for managing an application identifier, where the method includes:
  • the terminal decrypts the application identification certificate according to the private key of the user, and obtains a first character string and a digital signature of the first character string from the application identification certificate, where the first character string is based on And generating, by the application identifier and the feature identifier, the digital signature is generated by the identifier management device according to the first character string and a private key of the identifier management device;
  • the terminal decrypts the digital signature according to the public key of the identifier management device to obtain a second character string
  • the terminal verifies the legality of the application identification certificate according to the first character string and the second character string.
  • the method further includes:
  • the terminal determines the destination server according to the application requirement of the user;
  • the terminal sends a registration request to the destination server, where the registration request includes a user identifier, the application identification certificate, and a digital signature of the application identification certificate, so that the destination server verifies the validity of the application identifier and completes registration.
  • the digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user.
  • the terminal according to the first character string and the second character string verification After the validity of the application identification certificate, it also includes:
  • the terminal sends a communication request to another terminal, where the communication request includes the application identification certificate and a digital signature of the application identification certificate to enable the another terminal to verify the application.
  • the validity of the certificate is identified, wherein the digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user.
  • the digital signature includes a type of the application identifier, One or more of a timestamp and a random value.
  • a third aspect of the embodiments of the present invention discloses an identifier management apparatus, where the apparatus includes:
  • a receiving unit configured to receive an application identification certificate application request sent by the user
  • An obtaining unit configured to acquire a user identifier and an application identifier of the user according to the application identifier certificate application request;
  • the obtaining unit is further configured to acquire the feature identifier of the user according to the user identifier;
  • a generating unit configured to generate an application identification certificate according to the application identifier and the feature identifier of the user
  • a sending unit configured to send the application identification certificate to the user.
  • the generating unit includes a first combining subunit, a first hash subunit, a first joining subunit, and a first signature subunit;
  • the generating unit includes a first combining subunit, a first hash subunit, a first joining subunit, and a first signature subunit;
  • the first combination subunit is configured to combine the first randomization factor with the feature identifier of the user to obtain a first character string
  • the first hash subunit is configured to hash the first string according to a preset hash function to obtain a first hash value
  • the first connection subunit is configured to obtain a second character string according to the application identifier and the first hash value
  • the first signature subunit is configured to digitally sign the second character string by using a private key to obtain a third character string
  • the first combination subunit is further configured to assemble the application identifier and the third character string into the application identification certificate according to a preset order.
  • the application identifier certificate request request further includes a type of the application identifier
  • the generating unit is further configured to generate an application identification certificate according to the application identifier, the type of the application identifier, and the feature identifier of the user.
  • the generating unit includes a second combining subunit, a second hash subunit, and a second joining subunit, and Second signature subunit;
  • the second combination subunit is configured to combine the second randomization factor with the feature identifier of the user to obtain a fourth character string
  • the second hash subunit is configured to hash the fourth character string according to a preset hash function to obtain a second hash value
  • the second connection subunit is configured to obtain a fifth character string according to the type of the application identifier, the application identifier, and the second hash value;
  • the second signature subunit is configured to digitally sign the fifth character string by using the private key to obtain a sixth character string
  • the second combination sub-unit is further configured to assemble the type of the application identifier, the application identifier, and the sixth character string into the application identification certificate according to a preset order.
  • the application identifier certificate request request further includes the a digital signature of the user; the device further comprising a verification unit;
  • the obtaining unit is configured to acquire the public key of the user according to the user identifier
  • the verification unit is configured to verify the digital signature of the user according to the public key of the user
  • the generating unit is configured to generate an application identification certificate according to the application identifier and the feature identifier of the user when the digital signature of the user is verified to pass.
  • the device further includes an encryption unit;
  • the encryption unit is configured to encrypt the application identification certificate according to the public key of the user
  • the sending unit is specifically configured to send the encrypted application identifier to the user.
  • the device further includes a saving unit
  • the receiving unit is configured to receive a user identifier and a biometric feature sent by the user;
  • the generating unit is further configured to generate a feature identifier of the user according to the first preset algorithm and the biometric feature;
  • the saving unit is configured to save a correspondence between the user identifier and the feature identifier of the user;
  • the acquiring unit is specifically configured to acquire, according to the corresponding relationship, a location corresponding to the user identifier The feature identifier of the user.
  • the acquiring unit includes: acquiring the subunit and generating the subunit ;
  • the obtaining subunit is configured to obtain the biometric of the user from the user identifier
  • the generating subunit is configured to generate the feature identifier of the user according to the second preset algorithm and the biometric feature of the user.
  • a fourth aspect of the embodiments of the present invention discloses a terminal, where the terminal includes:
  • a receiving unit configured to receive an application identifier certificate sent by the identifier management device, where the application identifier certificate is in an encrypted state
  • a decryption unit configured to decrypt the application identification certificate according to a private key of the user, and obtain a first character string and a digital signature of the first character string from the application identification certificate, where the first string is Is generated according to the application identifier and the feature identifier, wherein the digital signature is generated by the identifier management device according to the first character string and a private key of the identifier management device;
  • the decrypting unit is further configured to decrypt the digital signature according to the public key of the identifier management device to obtain a second character string;
  • the verification unit the terminal verifies the legality of the application identification certificate according to the first character string and the second character string.
  • the terminal further includes: a determining unit and a first sending unit:
  • the determining unit is configured to: if the verification unit verifies that the application identification certificate is legal, determine the destination server according to the application requirement of the user;
  • the first sending unit sends a registration request to the destination server, where the registration request includes a user identifier, the application identification certificate, and a digital signature of the application identification certificate, so that the destination server verifies the application identification certificate.
  • Legitimate and complete registration wherein the digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user. of.
  • the terminal further includes a second sending unit;
  • the second sending unit is configured to: if the application identifier certificate is legal, the terminal sends a communication request to another terminal, where the communication request includes the application identifier certificate and a digital signature of the application identifier certificate to enable The another terminal verifies the validity of the application identification certificate, where the digital signature of the application identification certificate is made by the terminal according to the application identification certificate and the private key of the user.
  • the digital signature includes one or more of a type of an application identifier, a timestamp, and a random value.
  • the identifier management device generates an application identifier certificate according to the application identifier and the feature identifier of the user, where the application identifier certificate can prove that the corresponding application identifier is Legitimate users are authenticated and generated by trusted organizations.
  • the application identification certificate maps the relationship between the application identifier and the user.
  • the application identification certificate can verify the identity of the user, and the user identification cannot be used to infer the secret information of the user, and the risk of revealing the privacy of the user is also reduced.
  • the terminal according to the first character string and the second character string, verifying the validity of the application identification certificate, if the application identification certificate is legal Then, when the terminal communicates with the server or other terminal, the application identification certificate can prove that the application identifier is authenticated by the trusted authority, and the application identifier is trusted, and the leaked private information is also reduced. The possibility.
  • FIG. 1 is a flowchart of a method for managing an application identifier according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for managing an application identifier according to another embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for managing an application identifier according to another embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for managing an application identifier according to another embodiment of the present invention.
  • FIG. 5 is a structural diagram of an identifier management apparatus according to an embodiment of the present invention.
  • FIG. 6 is a structural diagram of an identifier management apparatus according to another embodiment of the present invention.
  • FIG. 7 is a structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 8 is a structural diagram of an identifier management apparatus according to another embodiment of the present invention.
  • FIG. 9 is a structural diagram of a terminal node according to another embodiment of the present invention.
  • an application identifier certificate may be generated according to an application identifier and a feature identifier of a user.
  • the application identifier certificate is convenient to manage and easy to verify. While proving the identity of the user, the possibility of revealing the user's private information is reduced, and the method specifically includes steps 101 to 105.
  • the identifier management device receives an application identifier certificate application request sent by the user.
  • the identifier management device is a center for application identification certificate generation and application identification certificate management in the Internet.
  • the identifier management apparatus acquires a user identifier and an application identifier of the user according to the application identifier certificate application request.
  • the application identification certificate is a certificate generated according to the application identifier.
  • the application identification certificate is used to prove that the application identifier is recognized by the identification management device, and can prove the relationship between the application identifier and the user.
  • the user identifier refers to an identifier used to uniquely identify the identity of the user.
  • the user ID can be It is the ID number of the user, and it can also be an identifier generated based on physiological characteristics. This is not an example.
  • the application identifier certificate request may include a user identifier and an application identifier, where the application identifier may be a string set by the user.
  • the application identifier certificate request may include a user identifier, and the identifier management device obtains the application identifier of the user according to the user identifier.
  • the application identifier may be pre-assigned to the user by the identifier management device. For example, when the user registers on the identity management device, the identity management device assigns an application identity to the user.
  • the identifier management device acquires a feature identifier of the user according to the user identifier.
  • the feature identification is obtained according to the physiological characteristics of the user.
  • physiological characteristics include genes, irises, fingerprints, palm prints, voice prints, and the like.
  • the identifier management device saves a correspondence between the user identifier and the feature identifier of the user.
  • the identifier management device may acquire a physiological feature of the user from the user identifier, and then generate a feature identifier according to the preset algorithm and the physiological feature of the user.
  • the identifier management apparatus generates an application identifier certificate according to the application identifier and the feature identifier of the user.
  • the application identifier since the application identifier is authenticated by the identity management center, the application identifier may be equated with the user's identity card, but the user's private information is not exposed. Therefore, when the user registers on another website or application, the application identifier can be associated. Moreover, the application logo can also be associated with a bank card or a credit card.
  • the identifier management device sends the application identification certificate to the user.
  • the identity management device may encrypt the application identity certificate and then send the encrypted application identity certificate to the user to improve the security of the application identity certificate transmission process.
  • the identifier management device generates an application identifier certificate according to the application identifier and the feature identifier of the user, and the application identifier certificate can be proved.
  • the corresponding application identifier is generated by a legitimate user through a trusted organization.
  • the application identification certificate maps the relationship between the application identifier and the user.
  • the application identification certificate can verify the identity of the user, and the user identification cannot be used to infer the secret information of the user, and the risk of revealing the privacy of the user is also reduced.
  • the user's feature identification belongs to the user's private information and cannot be used directly for transmission or use in a non-secure environment or channel.
  • the user's app ID is publicly available and can be used directly for public use.
  • the application identification certificate is generated according to the application identifier and the feature identifier, and can prove that the corresponding application identifier is generated by a legitimate user through a trusted organization.
  • the application identification certificate maps the relationship between the application identifier and the user.
  • the application identification certificate can verify the identity of the user, and the user identification cannot be used to infer the secret information of the user, and the risk of revealing the privacy of the user is also reduced.
  • the user's genetic information may be private information
  • the user's phone number is public information.
  • An application identification certificate is generated based on the user's genetic information and the user's phone number.
  • the application identification certificate maps the relationship between the application identifier and the user.
  • the application identification certificate can verify the identity of the user, and the user identification cannot be used to infer the secret information of the user, and the risk of revealing the privacy of the user is also reduced.
  • the iris information, the fingerprint information, the palm print information, and the like of the user may be private information.
  • the user's mailbox number and license plate number can both be application identifiers.
  • step 104 specifically includes steps 1041 to 1045:
  • the identifier management device combines a first randomization factor with a feature identifier of the user to obtain a first character string.
  • the first randomization factor may be a string of characters set in advance, and the length of the string is not limited herein.
  • the first randomization factor may be inserted into a certain fixed position in the user feature identifier to enhance the security of the feature identifier; for example, the first randomization factor may be inserted in front of the feature identifier, or may be inserted. Behind the feature ID.
  • the first randomization factor may also be dispersed to some fixed bits in the user feature identifier. Set.
  • the feature identifier of the user is a string.
  • the identifier management device hashes the first string according to a preset hash function to obtain a first hash value.
  • the default hash function can be a common string hash function such as BKDRHash, APHash, DJBHash, JSHash.
  • hash functions There are many kinds of hash functions, which are not mentioned here, and are not limited.
  • the identifier management device obtains a second character string according to the application identifier and the first hash value.
  • the identifier management device may associate the application identifier in front of the first hash value; the identifier management device may also place the application identifier in the first hash value. Connect later. This is not an example.
  • the identifier management device digitally signs the second character string by using a private key to obtain a third character string.
  • the private key is a private key of the identity management device.
  • the user When the user registers on the identity management device, the user obtains the public key of the identity management device, and the public key can decrypt the content encrypted by the identity management device private key.
  • the identifier management device assembles the application identifier and the third string into the application identifier certificate according to a preset sequence.
  • the preset order may be from the order of going to the back, or from the back to the front. There is no limit here.
  • the application identifier certificate request request further includes a type of the application identifier
  • the step 104 specifically includes:
  • the identifier management device generates an application identification certificate according to the application identifier, the type of the application identifier, and the feature identifier of the user.
  • the type of the application identifier is related to the application scenario.
  • the type of application identification can be divided into many large categories, and each large category can also include many small categories.
  • the application identifier may be a social account registration account, which may be a serial number of a refrigerator in the home appliance category; The license plate number of the car in the middle; the serial number of the wearable device in the electronic device category. This is not an example.
  • the user may fill in the type of the application identifier or select the type of the application identifier from the type of the application identifier provided by the identifier management device.
  • the identifier management device can determine the length and format of the application identification certificate according to the type of the application identifier.
  • the specific details of the identifier management device generating an application identifier certificate according to the type of the application identifier, the application identifier, and the feature identifier of the user include:
  • the identifier management device combines the second randomization factor with the feature identifier of the user to obtain a fourth character string.
  • the second randomization factor may be inserted into a certain fixed position in the user feature identifier to enhance the security of the feature identifier; for example, the second randomization factor may be inserted in front of the feature identifier, or may be inserted. Behind the feature identifier, it can also be distributed to some fixed positions in the user feature identifier.
  • the feature identifier of the user is a string.
  • the second randomization factor is also a pre-set string.
  • the identifier management device hashes the fourth string according to a preset hash function to obtain a second hash value.
  • the default hash function can be a common string hash function such as BKDRHash, APHash, DJBHash, JSHash.
  • hash functions There are many kinds of hash functions, which are not mentioned here, and are not limited.
  • the identifier management device obtains a fifth character string according to the type of the application identifier, the application identifier, and the second hash value.
  • the identifier management device may sequentially connect the type of the application identifier, the application identifier, and the second hash value in a sequence from front to back to obtain a fifth character string; or connect in a sequence from the back to the front.
  • the connection order is not limited here.
  • the identifier management apparatus digitally signs the fifth character string by using a private key to obtain a sixth character string.
  • the user can obtain the public key of the identity management device when registering on the identity management device.
  • the identifier management apparatus assembles the type of the application identifier, the application identifier, and the sixth string into the application identifier certificate according to a preset sequence.
  • the method further includes:
  • the identifier management device encrypts the application identification certificate according to the public key of the user.
  • the public key of the user may be saved on the identifier management device.
  • the identification management device encrypts the application identification certificate with the public key of the user.
  • Step 105 The identifier management device sends the application identifier to the user, including:
  • the identity management device sends the encrypted application identifier to the user.
  • the application identification certificate request request further includes a digital signature of the user.
  • Step 104 Before the identifier management device generates the application identifier certificate according to the application identifier and the feature identifier of the user, the method further includes:
  • the identifier management device acquires the public key of the user according to the user identifier
  • the identity management device verifies the digital signature of the user according to the public key of the user
  • Step 103 specifically includes: when the digital signature of the user is verified, the identifier management device generates an application identification certificate according to the application identifier and the feature identifier of the user.
  • the method further includes:
  • the identity management device receives the user identifier and the biometric feature sent by the user.
  • the user identifier can be used to uniquely identify the identity of the user. For example, the ID number.
  • the identifier management device generates the feature of the user according to the first preset algorithm and the biometric feature. Identification
  • the first preset algorithm may be an encryption algorithm.
  • Common encryption algorithms include the MD5 algorithm, the RSA algorithm, and the like.
  • the biological characteristics may be based on fingerprints, irises, genes, and the like.
  • fingerprints irises, genes, and the like.
  • the biometric is a fingerprint
  • the fingerprint can be sampled and the sampled result is identified by a string.
  • the identifier management device saves a correspondence between the user identifier and the feature identifier of the user.
  • Step 103 specifically includes: the identifier management device acquires, according to the correspondence, the feature identifier of the user corresponding to the user identifier.
  • step 103 specifically includes:
  • the identifier management device acquires biometrics of the user from the user identifier.
  • the user identifier may include biometrics of the user, such as fingerprint features, genetic features, or iris features.
  • the identification management device may extract the biometric of the user from the identifier of the user and identify it in the form of a character string. There are many ways to extract biometrics, which is not mentioned here.
  • the identifier management apparatus generates a feature identifier of the user according to the second preset algorithm and the biometric feature of the user.
  • the second preset algorithm may be a common encryption algorithm, such as an MD5 algorithm, an RSA algorithm, etc., which is not mentioned here.
  • FIG. 4 is a method for managing an application identifier according to the present invention, where the method includes:
  • the terminal receives an application identifier certificate sent by the identifier management device, where the application identifier certificate is in an encrypted state.
  • the identifier management device encrypts the application identification certificate by using the public key of the user, and sends the encrypted application identification certificate to the terminal.
  • the terminal decrypts the application identification certificate according to the private key of the user, from the application identifier. Obtaining a first character string and a digital signature of the first character string, wherein the first character string is generated according to an application identifier and a feature identifier, where the digital signature is based on the first character string and the identifier
  • the private key of the identification management device is made;
  • the first character string may be a string of the application identifier and the feature identifier, wherein the feature identifier may be hashed.
  • the feature identifier is connected to the preset random code to obtain a first connection string; the first connection string is further subjected to hash processing to obtain a second connection string; The second connection string is connected to the application identifier to obtain the first string.
  • the terminal decrypts the digital signature according to the public key of the identifier management device to obtain a second character string.
  • the terminal verifies the legality of the application identification certificate according to the first character string and the second character string.
  • the terminal can compare whether the first string is consistent with the second string. If they are consistent, the application identification certificate is legal.
  • the terminal verifies the legality of the application identification certificate according to the first character string and the second character string, and if the application identification certificate is legal, then the terminal and the terminal are subsequently
  • the application identification certificate can prove that the application identifier is verified by the trusted authority, and the application identifier is trustworthy, and the possibility of revealing the private information is also reduced.
  • the method further includes:
  • the terminal determines the destination server according to the application requirement of the user;
  • the terminal may prompt the user to input information, and determine the user's needs according to the information input by the user.
  • the terminal sends a registration request to the destination server, where the registration request includes a user identifier, the application identification certificate, and a digital signature of the application identification certificate, so that the destination server verifies the validity of the application identification certificate and completes registration.
  • the digital signature of the application identification certificate is The terminal is made according to the application identification certificate and the private key of the user.
  • the digital signature includes one or more of a timestamp, a random value, and a type of the application identifier.
  • the time stamp proves the validity period of the digital signature. Random values are used to enhance the security of the digital signature.
  • the type of the application identifier is used to indicate the application scope of the application identification certificate.
  • the digital signature of the user identification certificate further includes an identifier and a time stamp of the destination server, which can prove the object of the communication and the expiration date of the communication, thereby improving the security of the communication.
  • the method further includes:
  • the terminal sends a communication request to another terminal, where the communication request includes the application identification certificate and the digital signature of the application identification certificate, so that the another terminal verifies the application identification certificate.
  • the digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user.
  • the digital signature of the user identification certificate further includes an identifier and a time stamp of the other terminal, which can prove the validity period and the object of the communication, thereby improving the security of the communication.
  • the identifier management device 40 is a center for application identification certificate generation and application identification certificate management in the Internet.
  • the identification management device 40 is configured to perform the methods described in steps 101 to 104.
  • the identification management device 40 includes a receiving unit 401, a generating unit 402, an obtaining unit 403, and a transmitting unit 404.
  • the receiving unit 401 is configured to receive an application identifier certificate application request sent by the user.
  • the identifier management device is a center for application identification certificate generation and application identification certificate management in the Internet.
  • the obtaining unit 402 is configured to acquire a user identifier and an application identifier of the user according to the application identifier certificate requesting request;
  • the application identification certificate is a certificate generated according to the application identifier.
  • the application identification certificate is used for the certificate It is clear that the application identifier is recognized by the identification management device. Moreover, the relationship between the application identifier and the user can be proved.
  • the user identifier refers to an identifier used to uniquely identify the identity of the user.
  • the user identifier may be the ID number of the user, or may be an identifier generated according to physiological characteristics. This is not an example.
  • the application identifier certificate request may include a user identifier and an application identifier, and the obtaining unit 402 may directly obtain the user identifier and the application identifier from the application identifier certificate request request, where the application identifier may be a string set by the user.
  • the application identifier certificate request may include the user identifier, and the obtaining unit 402 obtains the user identifier from the application identifier certificate request, and obtains the application identifier of the user according to the user identifier.
  • the application identifier may be pre-assigned to the user by the identifier management device. For example, when the user registers on the identity management device, the identity management device assigns an application identity to the user.
  • the obtaining unit 402 is further configured to acquire the feature identifier of the user according to the user identifier.
  • the feature identification is obtained according to the physiological characteristics of the user.
  • physiological characteristics include genes, irises, fingerprints, palm prints, voice prints, and the like.
  • the identifier management device saves a correspondence between the user identifier and the feature identifier of the user.
  • a generating unit 403 configured to generate an application identification certificate according to the application identifier and the feature identifier of the user;
  • the application identifier since the application identifier is authenticated by the identity management center, the application identifier may be equated with the user's identity card, but the user's private information is not exposed. Therefore, when the user registers on another website or application, the application identifier can be associated. Moreover, the application logo can also be associated with a bank card or a credit card.
  • the sending unit 404 is configured to send the application identification certificate to the user.
  • the identifier management device may encrypt the application identification certificate, and then send the encrypted application identification certificate to the user, so as to improve the security of the application identification certificate transmission process.
  • an application identifier certificate can be generated according to the application identifier and the feature identifier of the user, and the application identifier certificate can prove that the corresponding application identifier is a legitimate user authenticated by a trusted institution. ,Generated.
  • the application identification certificate maps the relationship between the application identifier and the user.
  • the application identification certificate can verify the identity of the user, and the user identification cannot be used to infer the secret information of the user, and the risk of revealing the privacy of the user is also reduced.
  • the generating unit 403 includes a first combining subunit 4031, a first hash subunit 4032, a first linking subunit 4033, and a first signature.
  • a first combination sub-unit 4031 configured to combine the first randomization factor with the feature identifier of the user to obtain a first character string
  • the first randomization factor may be a string of characters set in advance, and the length of the string is not limited herein.
  • the first randomization factor may be inserted into a certain fixed position in the user feature identifier to enhance the security of the feature identifier; for example, the first randomization factor may be inserted in front of the feature identifier, or may be inserted. Behind the feature identifier; it can also be scattered to some fixed positions in the user feature identifier.
  • the feature identifier of the user is a string.
  • a first hash sub-unit 4032 configured to hash the first character string according to a preset hash function, to obtain a first hash value
  • the default hash function can be a common string hash function such as BKDRHash, APHash, DJBHash, JSHash.
  • hash functions There are many kinds of hash functions, which are not mentioned here, and are not limited.
  • a first connection sub-unit 4033 configured to obtain a second character string according to the application identifier and the hash value
  • the first connection sub-unit 4033 may associate the application identifier in front of the hash value; the first connection sub-unit 4033 may also place the application identifier on the hash value. Connect later. This is not an example.
  • a first signature sub-unit 4034 configured to digitally sign the second character string by using a private key to obtain a third character string
  • the user when the user registers on the identity management device, the user obtains the identity management device A public key that decrypts the content encrypted by the identity management device private key.
  • the first combination sub-unit 4031 is further configured to assemble the application identifier and the third character string into the application identification certificate according to a preset sequence.
  • the preset order may be from the order of going to the back, or from the back to the front. There is no limit here.
  • the application identifier certificate request request further includes an application identifier
  • the generating unit 403 is further configured to generate an application identification certificate according to the application identifier, the type of the application identifier, and the feature identifier of the user.
  • the type of the application identifier is related to the application scenario.
  • the type of application identification can be divided into many large categories, and each large category can also include many small categories.
  • the application identifier may be a social account registration account, may be a serial number of a refrigerator in the home appliance category; may be a license plate number of a car in a mechanical category; or may be a serial number of a wearable device in an electronic device class. This is not an example.
  • the user may fill in the type of the application identifier or select the type of the application identifier from the type of the application identifier provided by the identifier management device.
  • the generating unit 403 includes a second combining subunit 4035, a second hash subunit 4036, a second linking subunit 4037, and a second signature.
  • Unit 4038 the generating unit 403 includes a second combining subunit 4035, a second hash subunit 4036, a second linking subunit 4037, and a second signature.
  • a second combination sub-unit 4035 configured to combine the second randomization factor with the feature identifier of the user to obtain a fourth character string
  • the second randomization factor may be inserted into a certain fixed position in the user feature identifier to enhance the security of the feature identifier; for example, the second randomization factor may be inserted in front of the feature identifier, or may be inserted. Behind the feature identifier, it can also be distributed to some fixed positions in the user feature identifier.
  • the feature identifier of the user is a string.
  • the second randomization factor is also a preset word String.
  • a second hash sub-unit 4036 configured to hash the fourth character string according to a preset hash function, to obtain a second hash value
  • the default hash function can be a common string hash function such as BKDRHash, APHash, DJBHash, JSHash.
  • hash functions There are many kinds of hash functions, which are not mentioned here, and are not limited.
  • a second connection sub-unit 4037 configured to obtain a fifth character string according to the type of the application identifier, the application identifier, and the second hash value;
  • the identifier management device may sequentially connect the type of the application identifier, the application identifier, and the hash value in a sequence from front to back to obtain a fifth character string; or connect in a sequence from the back to the front, and connect The order is not limited here.
  • a second signature sub-unit 4038 configured to digitally sign the fifth character string by using a private key to obtain a sixth character string
  • the user can obtain the public key of the identity management device when registering on the identity management device.
  • the second combination sub-unit 4035 is further configured to assemble the type of the application identifier, the application identifier, and the sixth character string into the application identification certificate according to a preset sequence.
  • the application identification certificate request request further includes the digital signature of the user; the device further includes a verification unit 501;
  • the obtaining unit 402 is configured to acquire the public key of the user according to the user identifier
  • the verification unit 501 is configured to verify the digital signature of the user according to the public key of the user;
  • the generating unit 403 is specifically configured to generate an application identification certificate according to the application identifier and the feature identifier of the user when the digital signature of the user is verified.
  • the apparatus further includes an encryption unit 502;
  • the encryption unit 502 is configured to encrypt the application identification certificate according to the public key of the user;
  • the sending unit 404 is specifically configured to send the encrypted application identifier to the user.
  • the device further includes a saving unit 503;
  • the receiving unit 401 is configured to receive, by the user, the user identifier and the biometric feature
  • the generating unit 403 is further configured to generate a feature identifier of the user according to the first preset algorithm and the biometric feature;
  • the first preset algorithm may be an encryption algorithm.
  • Common encryption algorithms include the MD5 algorithm, the RSA algorithm, and the like.
  • the saving unit 407 is configured to save a correspondence between the user identifier and the feature identifier of the user.
  • the obtaining unit 402 is configured to acquire, according to the correspondence, the feature identifier of the user corresponding to the user identifier.
  • the obtaining unit 402 includes an obtaining subunit 4021 and a generating subunit 4022;
  • the obtaining subunit 4021 is configured to obtain the biometric of the user from the user identifier
  • the generating sub-unit 4022 is configured to generate the feature identifier of the user according to the second preset algorithm and the biometric feature of the user.
  • the second preset algorithm may be a common encryption algorithm, such as an MD5 algorithm, an RSA algorithm, etc., which is not mentioned here.
  • the terminal 60 is configured to perform the method described in steps 301 to 304.
  • the terminal 60 includes a receiving unit 601, a decrypting unit 602, and a verifying unit 603.
  • the receiving unit 601 is configured to receive an application identifier certificate sent by the identifier management device, where the application identifier certificate is in an encrypted state;
  • the identifier management device encrypts the application identification certificate by using the public key of the user, and sends the encrypted application identification certificate to the terminal.
  • the decryption unit 602 is configured to decrypt the application identification certificate according to the private key of the user, and obtain a first character string and a digital signature of the first character string from the application identification certificate, where the first The character string is generated according to the application identifier and the feature identifier, and the digital signature is generated by the identifier management device according to the first character string and the private key of the identifier management device;
  • the first character string may be a string of the application identifier and the feature identifier, wherein the feature identifier may be hashed.
  • the feature identifier is connected to the preset random code to obtain a first connection string; the first connection string is further subjected to hash processing to obtain a second connection string; The second connection string is connected to the application identifier to obtain the first string.
  • the decrypting unit 602 is further configured to decrypt the digital signature according to the public key of the identifier management device to obtain a second character string;
  • the verification unit 603 is configured to verify the validity of the application identification certificate according to the first character string and the second character string.
  • the verification unit 603 compares the content included in the second character string with the content included in the first character string, and determines whether the tampering has been performed. If the tampering thief has not been verified, the application identification certificate is legal.
  • the terminal verifies the legality of the application identification certificate according to the first character string and the second character string. If the application identification certificate is legal, the terminal subsequently communicates with the server or other terminal.
  • the application identification certificate can be used to prove that the application identifier is authenticated by a trusted authority, and the application identifier is trustworthy, and the possibility of revealing private information is also reduced.
  • the terminal 60 further includes a determining unit 604 and a first sending unit 605:
  • the determining unit 604 is configured to: if the verification unit verifies that the application identification certificate is legal, determine the destination server according to the user's needs;
  • the terminal can receive information input by the user, and determine the user's needs according to the information input by the user.
  • a first sending unit 605 configured to send a registration request to the destination server, where the registration request includes a user identifier, the application identification certificate, and a digital signature of the application identification certificate to enable the destination
  • the server verifies the validity of the application identification certificate and completes the registration, wherein the digital signature of the application identification certificate is made by the terminal according to the application identification certificate and the private key of the user.
  • the digital signature of the user identification certificate further includes an identifier and a time stamp of the destination server, which can prove the time and object of the communication. Thereby improving the security of communication.
  • the terminal 60 further includes a second sending unit 606;
  • the second sending unit 606 is configured to: if the application identification certificate is legal, the terminal sends a communication request to another terminal, where the communication request includes the application identification certificate and the digital signature of the application identification certificate to enable the other terminal to verify The application identifies the validity of the certificate, wherein the digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user.
  • the digital signature of the user identification certificate further includes an identifier and a time stamp of the other terminal, which can prove the object of the communication and the expiration date of the communication, thereby improving the security of the communication. Sex.
  • the digital signature includes one or more of a timestamp, a random value, and a type of the application identifier.
  • the time stamp proves the validity period of the digital signature. Random values are used to enhance the security of the digital signature.
  • the type of the application identifier is used to indicate the application scope of the application identification certificate.
  • FIG. 7 illustrates a structure of an identity management apparatus according to another embodiment of the present invention, including at least one processor 701 (eg, a CPU), a memory 702, at least one network interface 703, at least one communication bus 704, and at least one receiver 705. Used to implement connection communication between these devices.
  • the processor 701 is configured to execute executable modules, such as computer programs, stored in the memory 702.
  • the memory 702 may include a high speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory, such as at least an eMMC (Embedded Multi Media Card) memory.
  • the communication connection between the network device and at least one other network element is implemented by at least one network interface 303 (which may be wired or wireless), and may use an Internet, a wide area network, a local network, a metropolitan area network, or the like.
  • the memory 702 stores a program 7021, and the program 7021 can be executed by the processor 701.
  • the program includes:
  • the generating the application identification certificate according to the application identifier and the feature identifier of the user includes:
  • the first string is hashed according to a preset hash function to obtain a first hash value
  • the application identifier and the third string are assembled into the application identification certificate according to a preset order.
  • the application identifier certificate request request further includes a type of the application identifier
  • the generating an application identification certificate according to the application identifier and the feature identifier of the user includes:
  • the application identification certificate is generated according to the application identifier, the type of the application identifier, and the feature identifier of the user.
  • the generating the application identification certificate according to the application identifier, the type of the application identifier, and the feature identifier of the user specifically:
  • the fourth string is hashed according to a preset hash function to obtain a second hash value
  • the type of the application identifier, the application identifier, and the sixth string are assembled into the application identification certificate according to a preset order.
  • the application identifier certificate request request further includes a digital signature of the user
  • the method Before generating the application identification certificate according to the application identifier and the feature identifier of the user, the method further includes:
  • Verifying the digital signature of the user based on the public key of the user Verifying the digital signature of the user based on the public key of the user
  • an application identification certificate is generated according to the application identifier and the feature identifier of the user.
  • the method further includes:
  • the identifier management device encrypts the application identification certificate according to the public key of the user
  • the sending the application identifier to the user specifically includes:
  • the method before the acquiring the feature identifier of the user according to the user identifier, the method further includes:
  • Obtaining the feature identifier of the user according to the user identifier specifically includes:
  • the acquiring the feature identifier of the user according to the user identifier specifically includes:
  • the identifier management device generates an application identifier certificate according to the application identifier and the feature identifier of the user, where the application identifier certificate can prove that the corresponding application identifier is a trusted user. Agency certification, generated.
  • the application identification certificate maps the relationship between the application identifier and the user.
  • the application identification certificate can verify the identity of the user, and the user identification cannot be used to infer the secret information of the user, and the risk of revealing the privacy of the user is also reduced.
  • FIG. 8 illustrates a structure of a terminal according to another embodiment of the present invention, including at least one processor 801 (eg, a CPU), a memory 802, at least one network interface 803, at least one communication bus 804, and at least one receiver 805 for Achieve connection communication between these devices.
  • the processor 801 is configured to execute executable modules, such as computer programs, stored in the memory 802.
  • the memory 802 may include a high speed random access memory (RAM: Random Access Memory), and may also include a non-volatile memory such as at least an eMMC (Embedded Multi Media Card) memory.
  • the communication connection between the network device and at least one other network element is implemented by at least one network interface 303 (which may be wired or wireless), and may use an Internet, a wide area network, a local network, a metropolitan area network, or the like.
  • the memory 802 stores a program 8021, and the program 8021 can be executed by the processor 801.
  • the program includes:
  • the digital signature is created by the identifier management device according to the first character string and the private key of the identifier management device;
  • the validity of the application identification certificate is verified according to the first character string and the second character string.
  • verifying the response according to the first string and the second string After identifying the legality of the certificate, it also includes:
  • the terminal determines the destination server according to the application requirement of the user;
  • the terminal sends a registration request to the destination server, where the registration request includes a user identifier, the application identification certificate, and a digital signature of the application identification certificate, so that the destination server verifies the validity of the application identification certificate and completes registration, where the The digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user.
  • the method further includes:
  • the terminal sends a communication request to another terminal, where the communication request includes the application identification certificate and the digital signature of the application identification certificate, so that the other terminal verifies the legality of the application identification certificate.
  • the digital signature of the application identification certificate is that the terminal is made according to the application identification certificate and the private key of the user.
  • the digital signature includes one or more of a type, a timestamp, and a random value of the application identifier.
  • the validity of the application identification certificate is verified according to the first character string and the second character string. If the application identification certificate is legal, then the terminal communicates with the server or other terminal.
  • the application identification certificate can prove that the application identifier is authenticated by a trusted authority, and the application identifier is trustworthy, and the possibility of revealing private information is also reduced.
  • the content is based on the same concept as the method embodiment of the present invention.
  • the description in the method embodiment of the present invention and details are not described herein again.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Power Engineering (AREA)
  • Theoretical Computer Science (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Multimedia (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Storage Device Security (AREA)

Abstract

本发明涉及互联网领域，具体涉及一种管理应用标识的方法及装置。其中，标识管理装置接收用户发送的应用标识证书申请请求；该标识管理装置根据该应用标识证书申请请求获取该用户的用户标识和应用标识；该标识管理装置根据该用户标识获取该用户的特征标识；该标识管理装置根据该应用标识和该用户的特征标识生成应用标识证书；该标识管理装置向该用户发送该应用标识证书。本发明的实施例提供的应用标识证书可证明对应的应用标识是合法用户通过可信任的机构认证、生成的，且无法由应用标识推测出用户的秘密信息，降低了泄露用户私密的风险。

Description

一种管理应用标识的方法及装置 技术领域
本发明涉及互联网领域，具体涉及一种管理应用标识的方法及装置。
背景技术
互联网经过二十多年的快速发展，目前已渗入到人们日常生活的方方面面，人们离开互联网就会变得寸步难行。
日常生活中，人们可以通过互联网进行办公、娱乐以及交流。例如，人们在互联网上注册邮箱帐号、社交帐号进行交流；人们在互联网上注册购物平台帐号、网络银行帐号进行购物；人们在互联网上注册游戏平台帐号进行娱乐。同时，随着移动互联网、穿戴式设备和物联网的迅速兴起，用户关联或持有的电子设备也迅速增加，用户也需要通过验证标识的合法性来识别、管理这些设备。
从上可知，人们在互联网上拥有大量帐号，帐号的存在是为了证明人们的身份。那么，人们在注册大量帐号的过程中会提交很多私密信息，这些私密信息就有可能被黑客获取，私密信息的泄露有可能造成用户的财产损失。因此，如何能够在证明用户身份的同时减少该用户私密信息的泄露显得至关重要。
发明内容
本发明实施例提供了一种管理应用标识的方法及装置，能够在证明用户身份的同时减少该用户私密信息的泄露。
本发明实施例的第一方面公开了管理应用标识的方法，所述方法包括：
标识管理装置接收用户发送的应用标识证书申请请求；
所述标识管理装置根据所述应用标识证书申请请求获取所述用户的用户标识和应用标识；
所述标识管理装置根据所述用户标识获取所述用户的特征标识；
所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标 识证书；
所述标识管理装置向所述用户发送所述应用标识证书。
结合第一方面，在第一方面的第一种可能的实现方式中，所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书包括：
所述标识管理装置将第一随机化因子与所述用户的特征标识进行组合，获得第一字符串；
所述标识管理装置根据预设的哈希函数对所述第一字符串进行哈希，获得第一哈希值；
所述标识管理装置根据所述应用标识和所述第一哈希值获得第二字符串；
所述标识管理装置利用私钥对所述第二字符串进行数字签名，获得第三字符串；
所述标识管理装置根据预设顺序将所述应用标识和所述第三字符串组装成所述应用标识证书。
结合第一方面，在第一方面的第二种可能的实现方式中，
所述应用标识证书申请请求还包括应用标识的类型；
所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书，具体包括：
所述标识管理装置根据所述应用标识、所述应用标识的类型和所述用户的特征标识生成应用标识证书。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，
所述标识管理装置根据所述应用标识、所述应用标识的类型和所述用户的特征标识生成应用标识证书，具体包括：
所述标识管理装置将第二随机化因子与所述用户的特征标识进行组合，获得第四字符串；
所述标识管理装置根据预设的哈希函数对所述第四字符串进行哈希，获得第二哈希值；
所述标识管理装置根据所述应用标识的类型、所述应用标识以及所述第二哈希值获得第五字符串；
所述标识管理装置利用私钥对所述第五字符串进行数字签名，获得第六字符串；
所述标识管理装置根据预设顺序将所述应用标识的类型、所述应用标识以及所述第六字符串组装成所述应用标识证书。
结合第一方面或第一方面的第一种至第三种的任意可能的实现方式，，在第一方面的第四种可能的实现方式中，所述应用标识证书申请请求中还包括所述用户的数字签名；
所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书之前，还包括：
所述标识管理装置根据所述用户标识获取所述用户的公钥；
所述标识管理装置根据所述用户的公钥验证所述用户的数字签名；
当所述用户的数字签名被验证通过时，所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书。
结合第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述标识管理装置向所述用户发送所述应用标识证书之前，还包括：
所述标识管理装置根据所述用户的公钥对所述应用标识证书进行加密；
所述标识管理装置向所述用户发送所述应用标识具体包括：
所述标识管理装置向所述用户发送加密后的应用标识。
结合第一方面或第一方面的第一种至第五种的任意一种可能的实现方式，在第一方面的第六种可能的实现方式中，所述标识管理装置根据所述用户标识获取所述用户的特征标识之前，还包括：
所述标识管理装置接收所述用户发送的用户标识和生物特征；
所述标识管理装置根据第一预设算法和所述生物特征生成所述用户的特征标识；
所述标识管理装置保存所述用户标识与所述用户的特征标识之间的对应关系；
所述标识管理装置根据所述用户标识获取所述用户的特征标识具体包括：
所述标识管理装置根据所述对应关系获取与所述用户标识对应的所述用户的特征标识。
结合第一方面或第一方面的第一种至第五种的任意一种可能的实现方式，在第一方面的第七种可能的实现方式中，所述标识管理装置根据所述用户标识获取所述用户的特征标识具体包括：
所述标识管理装置从所述用户标识中获取所述用户的生物特征；
所述标识管理装置根据第二预设算法和所述用户的生物特征生成所述用户的特征标识。
本发明实施例的第二方面公开了管理应用标识的方法，所述方法包括：
终端接收标识管理装置发送的应用标识证书，所述应用标识证书处于加密状态；
所述终端根据用户的私钥对所述应用标识证书进行解密，从所述应用标识证书中获取第一字符串以及所述第一字符串的数字签名，其中，所述第一字符串是根据应用标识和特征标识生成的，所述数字签名是所述标识管理装置根据所述第一字符串和所述标识管理装置的私钥制作的；
所述终端根据所述标识管理装置的公钥对所述数字签名进行解密，获得第二字符串；
所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证书的合法性。
结合第二方面，在第二方面的第一种可能的实现方式中，所述终端根据所 述第一字符串以及所述第二字符串验证所述应用标识证书的合法性之后，还包括：
若所述应用标识证书合法，所述终端根据用户的应用需求确定目的服务器；
所述终端向所述目的服务器发出注册请求，所述注册请求中包括用户标识、所述应用标识证书以及所述应用标识证书的数字签名以使得所述目的服务器验证应用标识合法性并完成注册，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证书的合法性之后，还包括：
若所述应用标识证书合法，所述终端向另一终端发送通信请求，所述通信请求中包括所述应用标识证书以及所述应用标识证书的数字签名以使得所述另一终端验证所述应用标识证书的合法性，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。
结合第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述数字签名中包括应用标识的类型、时间戳和随机值中的一个或多个。
本发明实施例的第三方面公开了一种标识管理装置，所述装置包括：
接收单元，用于接收用户发送的应用标识证书申请请求；
获取单元，用于根据所述应用标识证书申请请求获取所述用户的用户标识和应用标识；
所述获取单元，还用于根据所述用户标识获取所述用户的特征标识；
生成单元，用于根据所述应用标识和所述用户的特征标生成应用标识证书；
发送单元，用于向所述用户发送所述应用标识证书。
结合第三方面，在第三方面第一种可能的实现方式中，所述生成单元包括第一组合子单元、第一哈希子单元、第一联结子单元以及第一签名子单元；
所述生成单元包括第一组合子单元、第一哈希子单元、第一联结子单元以及第一签名子单元；
所述第一组合子单元，用于将第一随机化因子与所述用户的特征标识进行组合，获得第一字符串；
所述第一哈希子单元，用于根据预设的哈希函数对所述第一字符串进行哈希，获得第一哈希值；
所述第一联结子单元，用于根据所述应用标识和所述第一哈希值获得第二字符串；
所述第一签名子单元，用于利用私钥对所述第二字符串进行数字签名，获得第三字符串；
所述第一组合子单元，还用于根据预设顺序将所述应用标识和所述第三字符串组装成所述应用标识证书。
结合第三方面，在第三方面的第二种可能的实现方式中，所述应用标识证书申请请求中还包括应用标识的类型；
所述生成单元，还用于根据所述应用标识、所述应用标识的类型和所述用户的特征标识生成应用标识证书。
结合第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，所述生成单元包括第二组合子单元、第二哈希子单元、第二联结子单元以及第二签名子单元；
所述第二组合子单元，用于将第二随机化因子与所述用户的特征标识进行组合，获得第四字符串；
所述第二哈希子单元，用于根据预设的哈希函数对所述第四字符串进行哈希，获得第二哈希值；
所述第二联结子单元，用于根据所述应用标识的类型、所述应用标识以及所述第二哈希值获得第五字符串；
所述第二签名子单元，用于利用所述私钥对所述第五字符串进行数字签名，获得第六字符串；
所述第二组合子单元，还用于根据预设顺序将所述应用标识的类型、所述应用标识以及所述第六字符串组装成所述应用标识证书。
结合第三方面或第三方面的第一种至第三种任意一种可能的实现方式，在第三方面的第四种可能的实现方式中，所述应用标识证书申请请求中还包括所述用户的数字签名；所述装置还包括验证单元；
所述获取单元，用于根据所述用户标识获取所述用户的公钥；
所述验证单元，用于根据所述用户的公钥验证所述用户的数字签名；
所述生成单元，具体用于当所述用户的数字签名被验证通过时，根据所述应用标识和所述用户的特征标识生成应用标识证书。
结合第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，所述装置还包括加密单元；
所述加密单元，用于根据所述用户的公钥对所述应用标识证书进行加密；
所述发送单元，具体用于向所述用户发送加密后的应用标识。
结合第三方面或第三方面的第一种至第五种任意一种可能的实现方式，在第三方面的第六种可能的实现方式中，其特征在于，所述装置还包括保存单元；
所述接收单元，用于接收所述用户发送的用户标识和生物特征；
所述生成单元，还用于根据第一预设算法和所述生物特征生成所述用户的特征标识；
所述保存单元，用于保存所述用户标识与所述用户的特征标识之间的对应关系；
所述获取单元，具体用于根据所述对应关系获取与所述用户标识对应的所 述用户的特征标识。
结合第三方面或第三方面的第一种至第五种任意一种可能的实现方式，在第三方面的第七种可能的实现方式中，所述获取单元包括获取子单元和生成子单元；
所述获取子单元，用于从所述用户标识中获取所述用户的生物特征；
所述生成子单元，用于根据第二预设算法和所述用户的生物特征生成所述用户的特征标识。
本发明实施例的第四方面公开了一种终端，所述终端包括：
接收单元，用于接收标识管理装置发送的应用标识证书，所述应用标识证书处于加密状态；
解密单元，用于根据用户的私钥对所述应用标识证书进行解密，从所述应用标识证书中获取第一字符串以及所述第一字符串的数字签名，其中，所述第一字符串是根据应用标识和特征标识生成的，所述数字签名是所述标识管理装置根据所述第一字符串和所述标识管理装置的私钥制作的；
所述解密单元，还用于根据所述标识管理装置的公钥对所述数字签名进行解密，获得第二字符串；
所述验证单元，所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证书的合法性。
结合第四方面，在第四方面的第一种可能的实现方式中，所述终端还包括确定单元和第一发送单元：
所述确定单元，用于若所述验证单元验证所述应用标识证书合法，根据所述根据用户的应用需求确定目的服务器；
所述第一发送单元，向所述目的服务器发出注册请求，所述注册请求中包括用户标识、所述应用标识证书以及所述应用标识证书的数字签名以使得所述目的服务器验证应用标识证书的合法性并完成注册，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作 的。结合第四方面或第四方面的第一种可能的实现方式，在第四方面的第二种可能的实现方式中，终端还包括第二发送单元；
所述第二发送单元，用于若所述应用标识证书合法，所述终端向另一终端发送通信请求，所述通信请求中包括所述应用标识证书以及所述应用标识证书的数字签名以使得所述另一终端验证所述应用标识证书的合法性，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。结合第四方面的第一种可能的实现方式或第四方面的第二种可能的实现方式，在第四方面的第三种可能的实现方式中，
所述数字签名中包括应用标识的类型、时间戳和随机值中的一个或多个。
结合第一方面和第三方面可知，使用本发明实施例提供的管理应用标识的方法，标识管理装置根据应用标识和用户的特征标识生成应用标识证书，该应用标识证书可证明对应的应用标识是合法用户通过可信任的机构认证、生成的。该应用标识证书映射了该应用标识和用户的关系。通过该应用标识证书可以对用户的身份进行验证，且无法由应用标识推测出用户的秘密信息，也降低了泄露用户私密的风险。
结合第二方面和第四方面可知，用本发明实施例提供的管理应用标识的方法，所述终端根据第一字符串和第二字符串验证所述应用标识证书合法性，如果应用标识证书合法，那么，后续该终端与服务器或其他终端通信过程时，利用该应用标识证书就可以证明该应用标识是通过可信机构认证过的，该应用标识是可信赖的，同时也降低了泄露私密信息的可能性。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一实施例提供的管理应用标识的方法流程图；
图2为本发明另一实施例提供的管理应用标识的方法流程图；
图3为本发明另一实施例提供的管理应用标识的方法流程图；
图4为本发明另一实施例提供的管理应用标识的方法流程图；
图5为本发明一实施例提供的标识管理装置的结构图；
图6为本发明另一实施例提供的标识管理装置的结构图；
图7为本发明一实施例提供的终端的结构图；
图8为本发明另一实施例提供的标识管理装置的结构图；
图9为本发明另一实施例提供的终端结的构图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
下面根据图1，描述本发明实施例的一种管理应用标识的方法，根据本实施例提供的方法可以根据应用标识和用户的特征标识生成应用标识证书，该应用标识证书管理方便，易于验证，在证明用户的身份的同时，降低了泄露用户私密信息的可能性，该方法具体包括步骤101至105。
101、标识管理装置接收用户发送的应用标识证书申请请求；
其中，标识管理装置是互联网中应用标识证书生成和应用标识证书管理的中心。
102、该标识管理装置根据该应用标识证书申请请求获取该用户的用户标识和应用标识；
其中，应用标识证书是根据应用标识生成的证书。该应用标识证书用于证明该应用标识是被标识管理装置认可的，而且可以证明该应用标识与用户的关系。
其中，该用户标识是指用于唯一标识用户身份的标识。例如，用户标识可 以是用户的身份证号，也可以是根据生理特征生成的标识。在此不一一例举。
其中，该应用标识证书申请请求中可以包括用户标识和应用标识，该应用标识可以是用户自己设置的字符串。
其中，该应用标识证书申请请求中可以包括用户标识，标识管理装置再根据用户标识获取该用户的应用标识。其中，该应用标识可以是标识管理装置预先分配给该用户的。例如，当该用户在该标识管理装置上注册时，该标识管理装置分配应用标识给该用户。
103、该标识管理装置根据该用户标识获取该用户的特征标识；
其中，特征标识是根据用户的生理特征获得的。常见的生理特征包括基因、虹膜、指纹、掌纹、声纹等。
在本发明的一个实施例中，该标识管理装置保存了用户标识与该用户的特征标识之间的对应关系。
在本发明的另一个实施例中，该标识管理装置可以从用户标识中获取用户的生理特征，再根据预设算法和该用户的生理特征生成特征标识。
104、该标识管理装置根据该应用标识和该用户的特征标识生成应用标识证书；
在本发明的一个实施例中，由于该应用标识得到了标识管理中心的认证，那么可以将该应用标识等同于用户的身份证，但是并不暴露用户的私密信息。因此当该用户去其他网站或应用上注册时，可以关联该应用标识即可。而且该应用标识也可以关联银行卡或者信用卡等。
105、该标识管理装置向该用户发送该应用标识证书。
在本发明的一个实施例中，标识管理装置可以将应用标识证书进行加密，然后向用户发送加密后的应用标识证书，以提高应用标识证书传输过程的安全性。
从上可知，使用本发明实施例提供的管理应用标识的方法，标识管理装置根据应用标识和用户的特征标识生成应用标识证书，该应用标识证书可证明 对应的应用标识是合法用户通过可信任的机构认证、生成的。该应用标识证书映射了该应用标识和用户的关系。通过该应用标识证书可以对用户的身份进行验证，且无法由应用标识推测出用户的秘密信息，也降低了泄露用户私密的风险。
在本发明的一个实施例中，用户的特征标识属于用户的私密信息，不能拿来直接使用在非安全的环境或信道中发送或使用。用户的应用标识是公开信息，可以拿来直接使用公开使用。应用标识证书是根据应用标识和特征标识生成的，可证明对应的应用标识是合法用户通过可信任的机构认证、生成的。该应用标识证书映射了该应用标识和用户的关系。通过该应用标识证书可以对用户的身份进行验证，且无法由应用标识推测出用户的秘密信息，也降低了泄露用户私密的风险。
例如，用户的基因信息可以是私密信息，而用户的电话号码是公开信息。根据用户的基因信息和用户的电话号码生成应用标识证书。
该应用标识证书映射了该应用标识和用户的关系。通过该应用标识证书可以对用户的身份进行验证，且无法由应用标识推测出用户的秘密信息，也降低了泄露用户私密的风险。其中，用户的虹膜信息、指纹信息、掌纹信息等均可以是私密信息。而用户的邮箱号、车牌号均可以是应用标识。
可选的，上述管理应用标识的方法中，步骤104具体包括步骤1041至步骤1045：
1041、该标识管理装置将第一随机化因子与该用户的特征标识进行组合，获得第一字符串；
其中，该第一随机化因子可以是预先设置的一串字符串，该字符串的长度在此不做限定。
其中，该第一随机化因子可以插入到该用户特征标识中的某一固定位置从而增强该特征标识的安全性；例如，该第一随机化因子可以插入到该特征标识的前面，也可以插入到该特征标识的后面。
其中，该第一随机化因子也可以分散到该用户特征标识中的某几个固定位 置。
其中，该用户的特征标识为字符串。
1042、该标识管理装置根据预设的哈希函数对该第一字符串进行哈希，获得第一哈希值；
其中，预设的哈希函数可以是BKDRHash，APHash，DJBHash，JSHash等常见的字符串哈希函数。哈希函数有很多种，在此不一一例举，不做限制。
1043、该标识管理装置根据该应用标识和该第一哈希值获得第二字符串；
在本发明的一个实施例中，该标识管理装置可以将该应用标识放在该第一哈希值的前面进行联结；该标识管理装置也可以将该应用标识放在该第一哈希值的后面进行连接。在此不一一例举。
1044、该标识管理装置利用私钥对该第二字符串进行数字签名，获得第三字符串；
其中，该私钥为该标识管理装置的私钥。
其中，用户在该标识管理装置上注册时，该用户会获得该标识管理装置的公钥，该公钥可以解密该标识管理装置私钥加密的内容。
1045、该标识管理装置根据预设顺序将该应用标识和该第三字符串组装成该应用标识证书。
其中，预设顺序可以是从前往后的顺序，也可以是从后往前的顺序。在此不做限定。
可选的，上述管理应用标识的方法中，该应用标识证书申请请求中还包括应用标识的类型；步骤104具体包括：
该标识管理装置根据该应用标识、该应用标识的类型和该用户的特征标识生成应用标识证书。
其中，应用标识的类型是与应用场景相关的。可以将应用标识的类型分成很多大的类别，每个大的类别还可以包括很多小的类别。例如，该应用标识可以是社交类的注册帐号，可以是家电类中的冰箱的序列号；可以是机械类 中的汽车的车牌号；也可以电子设备类中的穿戴式设备的序列号。在此不一一例举。
其中，用户在向标识管理装置发送应用标识证书申请请求时，可以在自己填写应用标识的类型，也可以从该标识管理装置提供的应用标识的类型中选择自己需要的类型。
其中，标识管理装置根据应用标识的类型可以确定该应用标识证书的长度和格式。
如图2所示，在本发明的一个实施例中，该标识管理装置根据该应用标识的类型、该应用标识和该用户的特征标识生成应用标识证书的具体细节包括：
201、该标识管理装置将第二随机化因子与该用户的特征标识进行组合，获得第四字符串；
其中，该第二随机化因子可以插入到该用户特征标识中的某一固定位置从而增强该特征标识的安全性；例如，该第二随机化因子可以插入到该特征标识的前面，也可以插入到该特征标识的后面，也可以分散到该用户特征标识中的某几个固定位置。
其中，该用户的特征标识为字符串。该第二随机化因子也是预先设置的字符串。
202、该标识管理装置根据预设的哈希函数对该第四字符串进行哈希，获得第二哈希值；
其中，预设的哈希函数可以是BKDRHash，APHash，DJBHash，JSHash等常见的字符串哈希函数。哈希函数有很多种，在此不一一例举，不做限制。
203、该标识管理装置根据该应用标识的类型、该应用标识以及该第二哈希值获得第五字符串；
其中，该标识管理装置可以按照从前到后的顺序将该应用标识的类型、该应用标识以及该第二哈希值依次进行联结获得第五字符串；也可以按照从后往前的顺序进行联结，联结顺序在此不做限制。
204、该标识管理装置利用私钥对该第五字符串进行数字签名，获得第六字符串；
其中，用户可以在该标识管理装置上注册时获得该标识管理装置的公钥。
205、该标识管理装置根据预设顺序将该应用标识的类型、该应用标识以及该第六字符串组装成该应用标识证书。
如图3所示，可选的，在本发明的另一实施例中，步骤105之前还包括：
106、该标识管理装置根据该用户的公钥对该应用标识证书进行加密；
其中，用户在该标识管理装置上注册时，可以将该用户的公钥保存在该标识管理装置上。以便该标识管理装置利用用户的公钥对应用标识证书进行加密。
步骤105：该标识管理装置向该用户发送该应用标识具体包括：
该标识管理装置向该用户发送加密后的应用标识。
如图3所示，可选的，在本发明的另一个实施例中，该应用标识证书申请请求中还包括该用户的数字签名；
步骤104：该标识管理装置根据该应用标识和该用户的特征标识生成应用标识证书之前，还包括：
该标识管理装置根据该用户标识获取该用户的公钥；
该标识管理装置根据该用户的公钥验证该用户的数字签名；
步骤103具体包括：当该用户的数字签名被验证通过时，该标识管理装置根据该应用标识和该用户的特征标识生成应用标识证书。
如图3所示，可选的，在本发明的另一个实施例中，步骤102之前，该方法还包括：
107、该标识管理装置接收该用户发送用户标识和生物特征；
其中，该用户标识可以用于唯一标识用户的身份。例如身份证号。
108、该标识管理装置根据第一预设算法和该生物特征生成该用户的特征 标识；
其中，第一预设算法可以是加密算法。常见的加密算法包括MD5算法、RSA算法等。
其中，生物特征可以是根据指纹、虹膜、基因等。例如，如果生物特征是指纹，那么可以将指纹进行采样，并将采样结果用字符串标识。
109、该标识管理装置保存该用户标识与该用户的特征标识之间的对应关系。
步骤103具体包括：该标识管理装置根据该对应关系获取与该用户标识对应的该用户的特征标识。
可选的，在本发明的另一个实施例中，步骤103具体包括：
1031、该标识管理装置从该用户标识中获取该用户的生物特征；
其中，该用户标识中可以包含该用户的生物特征，例如指纹特征，基因特征或虹膜特征。该标识管理装置可以从该用户的标识中提取该用户的生物特征，并用字符串的形式进行标识。其中提取生物特征的方法很多，在此不一一例举。
1032、该标识管理装置根据第二预设算法和该用户的生物特征生成该用户的特征标识。
其中，该第二预设算法可以是常见的加密算法，例如MD5算法、RSA算法等，在此不一一例举。
如图4所示，该图4为本发明提供的一种管理应用标识的方法，该方法包括：
301、终端接收标识管理装置发送的应用标识证书，该应用标识证书处于加密状态；
其中，标识管理装置利用该用户的公钥对应用标识证书进行加密，并将加密后的应用标识证书发送给该终端。
302、该终端根据用户的私钥对该应用标识证书进行解密，从该应用标识 证书中获取第一字符串以及该第一字符串的数字签名，其中，该第一字符串是根据应用标识和特征标识生成的，该数字签名是该标识管理装置根据该第一字符串和该标识管理装置的私钥制作的；
在本发明的一个实施例中，第一字符串可以是应用标识与特征标识连接而成的字符串，其中，特征标识可以是经过哈希处理的。
在本发明的另一个实施例中，特征标识与预设的随机码进行连接，得到第一连接字符串；该第一连接字符串再经过哈希处理，得到第二连接字符串；再将第二连接字符串与应用标识进行连接，从而获得第一字符串。
303、该终端根据该标识管理装置的公钥对该数字签名进行解密，获得第二字符串；
304、该终端根据该第一字符串以及该第二字符串验证该应用标识证书的合法性。
其中，该终端可以对比第一字符串与第二字符串是否一致。如果一致，则证明该应用标识证书合法。
从上可知，使用本发明实施例提供的管理应用标识的方法，该终端根据该第一字符串和第二字符串验证该应用标识证书合法性，如果应用标识证书合法，那么，后续该终端与服务器或其他终端通信过程时，利用该应用标识证书就可以证明该应用标识是可信任机构验证过的，该应用标识是可信赖的，同时也降低了泄露私密信息的可能性。
可选的，在本发明的另一个实施例中，步骤303之后，该方法还包括：
304、若该应用标识证书合法，该终端根据用户的应用需求确定目的服务器；
其中，若该应用标识证书合法时，该终端可以提示用户输入信息，根据用户输入的信息确定用户的需求。
305、该终端向该目的服务器发出注册请求，该注册请求中包括用户标识、该应用标识证书以及该该应用标识证书的数字签名以使得该目的服务器验证应用标识证书的合法性并完成注册，其中，该应用标识证书的数字签名是该 终端根据该应用标识证书和该用户的私钥制作的。
其中，该数字签名中包括时间戳、随机值和该应用标识的类型中的一个或多个。其中，该时间戳证明该数字签名的有效期限。随机值用于增强该数字签名的安全性。该应用标识的类型用于表明该应用标识证书的应用范围。
在本发明的一个实施例中，该用户标识证书的数字签名中还包含该目的服务器的标识和时间戳，可以证明这次通信的对象和这次通信的有效期限，从而提高了通信的安全性。
可选的，在本发明的另一个实施例中，步骤303之后，该方法还包括：
306、若该应用标识证书合法，该终端向另一终端发送通信请求，该通信请求中包括该应用标识证书以及该该应用标识证书的数字签名以使得该另一终端验证该应用标识证书的合法性，其中，该应用标识证书的数字签名是该终端根据该应用标识证书和该用户的私钥制作的。
在本发明的一个实施例中，该用户标识证书的数字签名中还包含该另一终端的标识和时间戳，可以证明这次通信的有效期限和对象，从而提高了通信的安全性。
下面根据图5描述本发明实施例的一种管理应用标识的标识管理装置40。其中，标识管理装置40是互联网中应用标识证书生成和应用标识证书管理的中心。
该标识管理装置40用于执行步骤101至步骤104所描述的方法。标识管理装置40包括：接收单元401，生成单元402，获取单元403，发送单元404。
接收单元401，用于接收用户发送的应用标识证书申请请求；
其中，标识管理装置是互联网中应用标识证书生成和应用标识证书管理的中心。
获取单元402，用于根据该应用标识证书申请请求获取该用户的用户标识和应用标识；
其中，应用标识证书是根据应用标识生成的证书。该应用标识证书用于证 明该应用标识是被标识管理装置认可的。而且可以证明该应用标识与用户的关系。
其中，该用户标识是指用于唯一标识用户身份的标识。例如，用户标识可以是用户的身份证号，也可以是根据生理特征生成的标识。在此不一一例举。
其中，该应用标识证书申请请求中可以包括用户标识和应用标识，获取单元402从该应用标识证书申请请求中直接获取用户标识和应用标识，其中，该应用标识可以是用户自己设置的字符串。
其中，该应用标识证书申请请求中可以包括用户标识，获取单元402从应用标识证书申请请求中获取该用户标识，再根据用户标识获取该用户的应用标识。其中，该应用标识可以是标识管理装置预先分配给该用户的。例如，当该用户在该标识管理装置上注册时，该标识管理装置分配应用标识给该用户。
获取单元402，还用于根据该用户标识获取该用户的特征标识；
其中，特征标识是根据用户的生理特征获得的。常见的生理特征包括基因、虹膜、指纹、掌纹、声纹等。
在本发明的一个实施例中，该标识管理装置保存了用户标识与该用户的特征标识之间的对应关系。
生成单元403，用于根据该应用标识和该用户的特征标识生成应用标识证书；
在本发明的一个实施例中，由于该应用标识得到了标识管理中心的认证，那么可以将该应用标识等同于用户的身份证，但是并不暴露用户的私密信息。因此当该用户去其他网站或应用上注册时，可以关联该应用标识即可。而且该应用标识也可以关联银行卡或者信用卡等。
发送单元404，用于向该用户发送该应用标识证书。
其中，标识管理装置可以将应用标识证书进行加密，然后向用户发送加密后的应用标识证书，以提高应用标识证书传输过程的安全性。
从上可知，使用本发明实施例提供的管理应用标识的装置，能够根据应用标识和用户的特征标识生成应用标识证书，该应用标识证书可证明对应的应用标识是合法用户通过可信任的机构认证、生成的。该应用标识证书映射了该应用标识和用户的关系。通过该应用标识证书可以对用户的身份进行验证，且无法由应用标识推测出用户的秘密信息，也降低了泄露用户私密的风险。
可选的，基于上述装置实施例，在本发明的另一装置实施例中，生成单元403包括第一组合子单元4031、第一哈希子单元4032、第一联结子单元4033以及第一签名子单元4034；
第一组合子单元4031，用于将第一随机化因子与该用户的特征标识进行组合，获得第一字符串；
其中，该第一随机化因子可以是预先设置的一串字符串，该字符串的长度在此不做限定。
其中，该第一随机化因子可以插入到该用户特征标识中的某一固定位置从而增强该特征标识的安全性；例如，该第一随机化因子可以插入到该特征标识的前面，也可以插入到该特征标识的后面；也可以分散到该用户特征标识中的某几个固定位置。其中，该用户的特征标识为字符串。
第一哈希子单元4032，用于根据预设的哈希函数对该第一字符串进行哈希，获得第一哈希值；
其中，预设的哈希函数可以是BKDRHash，APHash，DJBHash，JSHash等常见的字符串哈希函数。哈希函数有很多种，在此不一一例举，不做限制。
第一联结子单元4033，用于根据该应用标识和该哈希值获得第二字符串；
在本发明的一个实施例中，第一联结子单元4033可以将该应用标识放在该哈希值的前面进行联结；第一联结子单元4033也可以将该应用标识放在该哈希值的后面进行连接。在此不一一例举。
第一签名子单元4034，用于利用私钥对该第二字符串进行数字签名，获得第三字符串；
其中，用户在该标识管理装置上注册时，该用户会获得该标识管理装置的 公钥，该公钥可以解密该标识管理装置私钥加密的内容。
第一组合子单元4031，还用于根据预设顺序将该应用标识和该第三字符串组装成该应用标识证书。
其中，预设顺序可以是从前往后的顺序，也可以是从后往前的顺序。在此不做限定。
可选的，基于上述装置实施例，在本发明的另一装置实施例中，该应用标识证书申请请求中还包括应用标识；
生成单元403，还用于根据该应用标识、该应用标识的类型和该用户的特征标识生成应用标识证书。
其中，应用标识的类型是与应用场景相关的。可以将应用标识的类型分成很多大的类别，每个大的类别还可以包括很多小的类别。例如，该应用标识可以是社交类的注册帐号，可以是家电类中的冰箱的序列号；可以是机械类中的汽车的车牌号；也可以电子设备类中的穿戴式设备的序列号。在此不一一例举。
其中，用户在向标识管理装置发送应用标识证书申请请求时，可以在自己填写应用标识的类型，也可以从该标识管理装置提供的应用标识的类型中选择自己需要的类型。
可选的，基于上述装置实施例，在本发明的另一装置实施例中，生成单元403包括第二组合子单元4035、第二哈希子单元4036、第二联结子单元4037以及第二签名子单元4038；
第二组合子单元4035，用于将第二随机化因子与该用户的特征标识进行组合，获得第四字符串；
其中，该第二随机化因子可以插入到该用户特征标识中的某一固定位置从而增强该特征标识的安全性；例如，该第二随机化因子可以插入到该特征标识的前面，也可以插入到该特征标识的后面，也可以分散到该用户特征标识中的某几个固定位置。
其中，该用户的特征标识为字符串。该第二随机化因子也是预先设置的字 符串。
第二哈希子单元4036，用于根据预设的哈希函数对该第四字符串进行哈希，获得第二哈希值；
其中，预设的哈希函数可以是BKDRHash，APHash，DJBHash，JSHash等常见的字符串哈希函数。哈希函数有很多种，在此不一一例举，不做限制。
第二联结子单元4037，用于根据该应用标识的类型、该应用标识以及该第二哈希值获得第五字符串；
其中，该标识管理装置可以按照从前到后的顺序将该应用标识的类型、该应用标识以及该哈希值依次进行联结获得第五字符串；也可以按照从后往前的顺序进行联结，联结顺序在此不做限制。
第二签名子单元4038，用于利用私钥对该第五字符串进行数字签名，获得第六字符串；
其中，用户可以在该标识管理装置上注册时获得该标识管理装置的公钥。
第二组合子单元4035，还用于根据预设顺序将该应用标识的类型、该应用标识以及该第六字符串组装成该应用标识证书。
如图6所示，可选的，基于上述装置实施例，在本发明的另一装置实施例中，该应用标识证书申请请求中还包括该用户的数字签名；该装置还包括验证单元501；
获取单元402，用于根据该用户标识获取该用户的公钥；
验证单元501，用于根据该用户的公钥验证该用户的数字签名；
生成单元403，具体用于当该用户的数字签名被验证通过时，根据该应用标识和该用户的特征标识生成应用标识证书。
可选的，基于上述装置实施例，在本发明的另一装置实施例中，该装置还包括加密单元502；
加密单元502，用于根据该用户的公钥对该应用标识证书进行加密；
发送单元404，具体用于向该用户发送加密后的应用标识。
可选的，基于上述装置实施例，在本发明的另一装置实施例中，该装置还包括保存单元503；
接收单元401，用于接收该用户发送用户标识和生物特征；
生成单元403，还用于根据第一预设算法和该生物特征生成该用户的特征标识；
其中，第一预设算法可以是加密算法。常见的加密算法包括MD5算法、RSA算法等。
保存单元407，用于保存该用户标识与该用户的特征标识之间的对应关系；
获取单元402，具体用于根据该对应关系获取与该用户标识对应的该用户的特征标识。
可选的，基于上述装置实施例，在本发明的另一装置实施例中，获取单元402包括获取子单元4021和生成子单元4022；
获取子单元4021，用于从该用户标识中获取该用户的生物特征；
生成子单元4022，用于根据第二预设算法和该用户的生物特征生成该用户的特征标识。
其中，该第二预设算法可以是常见的加密算法，例如MD5算法、RSA算法等，在此不一一例举。
下面根据图7描述本发明实施例的一种终端60。该终端60用于执行步骤301至步骤304所描述的方法。终端60包括：接收单元601，解密单元602，验证单元603。
接收单元601，用于接收标识管理装置发送的应用标识证书，该应用标识证书处于加密状态；
其中，该标识管理装置利用该用户的公钥对应用标识证书进行加密，并将加密后的应用标识证书发送给该终端。
解密单元602，用于根据用户的私钥对该应用标识证书进行解密，从该应用标识证书中获取第一字符串以及该第一字符串的数字签名，其中，该第一 字符串是根据应用标识和特征标识生成的，该数字签名是该标识管理装置根据该第一字符串和该标识管理装置的私钥制作的；
在本发明的一个实施例中，第一字符串可以是应用标识与特征标识连接而成的字符串，其中，特征标识可以是经过哈希处理的。
在本发明的另一个实施例中，特征标识与预设的随机码进行连接，得到第一连接字符串；该第一连接字符串再经过哈希处理，得到第二连接字符串；再将第二连接字符串与应用标识进行连接，从而获得第一字符串。
解密单元602，还用于根据该标识管理装置的公钥对该数字签名进行解密，获得第二字符串；
验证单元603，用于根据该第一字符串以及该第二字符串验证该应用标识证书合法性。
其中，验证单元603将第二字符串中包含内容与第一字符串包含的内容进行对比，判断是否是否经过篡改，如果没有经过篡改贼证明该应用标识证书合法。
从上可知，使用本发明实施例提供的终端，该终端根据第一字符串和第二字符串验证该应用标识证书合法性，如果应用标识证书合法，那么，后续该终端与服务器或其他终端通信过程时，利用该应用标识证书就可以证明该应用标识是通过可信机构认证过的，该应用标识是可信赖的，同时也降低了泄露私密信息的可能性。
可选的，基于上述终端的实施例，在本发明的另一终端的实施例中，该终端60还包括确定单元604和第一发送单元605：
确定单元604，用于若该验证单元验证该应用标识证书合法，根据用户的需求确定目的服务器；
其中，该终端可以接收用户输入的信息，根据用户输入的信息确定用户的需求。
第一发送单元605，用于向该目的服务器发出注册请求，该注册请求中包括用户标识、该应用标识证书以及该该应用标识证书的数字签名以使得该目 的服务器验证应用标识证书的合法性并完成注册，其中，该应用标识证书的数字签名是该终端根据该应用标识证书和该用户的私钥制作的。
在本发明的一个实施例中，该用户标识证书的数字签名中还包含该目的服务器的标识和时间戳，可以证明这次通信的时间和对象。从而提高了通信的安全性。
可选的，基于上述终端的实施例，在本发明的另一终端的实施例中，终端60还包括第二发送单元606；
第二发送单元606，用于若该应用标识证书合法，该终端向另一终端发送通信请求，该通信请求中包括该应用标识证书以及该该应用标识证书的数字签名以使得该另一终端验证该应用标识证书的合法性，其中，该应用标识证书的数字签名是该终端根据该应用标识证书和该用户的私钥制作的。
在本发明的一个实施例中，该用户标识证书的数字签名中还包含该另一终端的标识和时间戳，可以证明这次通信的对象和这次通信的有效期限，从而提高了通信的安全性。
可选的，基于上述终端的实施例，在本发明的另一终端的实施例中，该数字签名中包括时间戳、随机值和该应用标识的类型中的一个或多个。其中，该时间戳证明该数字签名的有效期限。随机值用于增强该数字签名的安全性。该应用标识的类型用于表明该应用标识证书的应用范围。
图7描述了本发明另一个实施例提供的标识管理装置的结构，包括至少一个处理器701(例如CPU)，存储器702，至少一个网络接口703，至少一个通信总线704以及至少一个接收器705，用于实现这些装置之间的连接通信。处理器701用于执行存储器702中存储的可执行模块，例如计算机程序。存储器702可能包含高速随机存取存储器(RAM：Random Access Memory)，也可能还包括非易失性存储器(non-volatile memory)，例如至少eMMC(Embedded Multi Media Card，嵌入式多媒体卡)存储器。通过至少一个网络接口303(可以是有线或者无线)实现该网络设备与至少一个其他网元之间的通信连接，可以使用互联网，广域网、本地网、城域网等。
在一些实施方式中，存储器702存储了程序7021，程序7021可以被处理器701执行，这个程序包括：
接收用户发送的应用标识证书申请请求；
根据所述应用标识证书申请请求获取所述用户的用户标识和应用标识；
根据该用户标识获取该用户的特征标识；
根据该应用标识和该用户的特征标识生成应用标识证书；
向该用户发送该应用标识证书。
可选的，基于上述程序，该根据该应用标识和该用户的特征标识生成应用标识证书具体包括：
将第一随机化因子与该用户的特征标识进行组合，获得第一字符串；
根据预设的哈希函数对该第一字符串进行哈希，获得第一哈希值；
根据该应用标识和该第一哈希值获得第二字符串；
利用私钥对该第二字符串进行数字签名，获得第三字符串；
根据预设顺序将该应用标识和该第三字符串组装成该应用标识证书。
可选的，基于上述程序，该应用标识证书申请请求中还包括应用标识的类型；
该根据该应用标识和该用户的特征标识生成应用标识证书，具体包括：
该根据该应用标识、该应用标识的类型和该用户的特征标识生成应用标识证书。
可选的，基于上述程序，该根据该应用标识、该应用标识的类型和该用户的特征标识生成应用标识证书具体包括：
将第二随机化因子与该用户的特征标识进行组合，获得第四字符串；
根据预设的哈希函数对该第四字符串进行哈希，获得第二哈希值；
根据该应用标识的类型、该应用标识以及该第二哈希值获得第五字符串；
利用私钥对该第五字符串进行数字签名，获得第六字符串；
根据预设顺序将该应用标识的类型、该应用标识以及该第六字符串组装成该应用标识证书。
可选的，基于上述程序，该应用标识证书申请请求中还包括该用户的数字签名；
该根据该应用标识和该用户的特征标识生成应用标识证书之前，还包括：
根据该用户标识获取该用户的公钥；
根据该用户的公钥验证该用户的数字签名；
当该用户的数字签名被验证通过时，根据该应用标识和该用户的特征标识生成应用标识证书。
可选的，基于上述程序，该标识管理装置向该用户发送该应用标识证书之前，还包括：
该标识管理装置根据该用户的公钥对该应用标识证书进行加密；
该向该用户发送该应用标识具体包括：
向该用户发送加密后的应用标识。
可选的，基于上述程序，该根据该用户标识获取该用户的特征标识之前，还包括：
接收该用户发送用户标识和生物特征；
根据第一预设算法和该生物特征生成该用户的特征标识；
保存该用户标识与该用户的特征标识之间的对应关系；
根据该用户标识获取该用户的特征标识具体包括：
根据该对应关系获取与该用户标识对应的该用户的特征标识。
可选的，基于上述程序，该根据该用户标识获取该用户的特征标识具体包括：
从该用户标识中获取该用户的生物特征；
根据第二预设算法和该用户的生物特征生成该用户的特征标识。
具体的实施步骤与图1所示的实施例相同，此处不再赘述。
从上可知，使用本发明实施例提供的管理应用标识的方法，标识管理装置根据应用标识和用户的特征标识生成应用标识证书，该应用标识证书可证明对应的应用标识是合法用户通过可信任的机构认证、生成的。该应用标识证书映射了该应用标识和用户的关系。通过该应用标识证书可以对用户的身份进行验证，且无法由应用标识推测出用户的秘密信息，也降低了泄露用户私密的风险。
图8描述了本发明另一个实施例提供的终端的结构，包括至少一个处理器801(例如CPU)，存储器802，至少一个网络接口803，至少一个通信总线804以及至少一个接收器805，用于实现这些装置之间的连接通信。处理器801用于执行存储器802中存储的可执行模块，例如计算机程序。存储器802可能包含高速随机存取存储器(RAM：Random Access Memory)，也可能还包括非易失性存储器(non-volatile memory)，例如至少eMMC(Embedded Multi Media Card，嵌入式多媒体卡)存储器。通过至少一个网络接口303(可以是有线或者无线)实现该网络设备与至少一个其他网元之间的通信连接，可以使用互联网，广域网、本地网、城域网等。
在一些实施方式中，存储器802存储了程序8021，程序8021可以被处理器801执行，这个程序包括：
接收标识管理装置发送的应用标识证书，该应用标识证书处于加密状态；
根据用户的私钥对该应用标识证书进行解密，从该应用标识证书中获取第一字符串以及该第一字符串的数字签名，其中，该第一字符串是根据应用标识和特征标识生成的，该数字签名是该标识管理装置根据该第一字符串和该标识管理装置的私钥制作的；
根据该标识管理装置的公钥对该数字签名进行解密，获得第二字符串；
根据该第一字符串以及该第二字符串验证该应用标识证书的合法性。
可选的，基于上述程序，该根据该第一字符串以及该第二字符串验证该应 用标识证书的合法性之后，还包括：
若该应用标识证书合法，该终端根据该用户的应用需求确定目的服务器；
该终端向该目的服务器发出注册请求，该注册请求中包括用户标识、该应用标识证书以及该该应用标识证书的数字签名以使得该目的服务器验证应用标识证书的合法性并完成注册，其中，该应用标识证书的数字签名是该终端根据该应用标识证书和该用户的私钥制作的。可选的，基于上述程序，该该终端根据该第一字符串以及该第二字符串验证该应用标识证书的合法性之后，还包括：
若该应用标识证书合法，该终端向另一终端发送通信请求，该通信请求中包括该应用标识证书以及该该应用标识证书的数字签名以使得该另一终端验证该应用标识证书的合法性，其中，该应用标识证书的数字签名是该终端根据该应用标识证书和该用户的私钥制作的。
可选的，基于上述程序，该数字签名中包括应用标识的类型、时间戳和随机值中的一个或多个。
从上可知，使用本发明实施例提供的终端，根据第一字符串和第二字符串验证该应用标识证书合法性，如果应用标识证书合法，那么，后续该终端与服务器或其他终端通信过程时，利用该应用标识证书就可以证明该应用标识是通过可信机构认证过的，该应用标识是可信赖的，同时也降低了泄露私密信息的可能性。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
上述装置和系统内的各模块之间的信息交互、执行过程等内容，由于与本发明方法实施例基于同一构思，具体内容可参见本发明方法实施例中的叙述，此处不再赘述。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，上述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，上述的存储介质可为磁碟、光盘、只读存储记忆体(ROM：Read-Only Memory)或随机存储记忆体(RAM：Random Access Memory)等。
本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上该，本说明书内容不应理解为对本发明的限制。

Claims (24)

  1. 一种管理应用标识的方法，其特征在于，所述方法包括：
    标识管理装置接收用户发送的应用标识证书申请请求；
    所述标识管理装置根据所述应用标识证书申请请求获取所述用户的用户标识和应用标识；
    所述标识管理装置根据所述用户标识获取所述用户的特征标识；
    所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书；
    所述标识管理装置向所述用户发送所述应用标识证书。
  2. 如权利要求1所述的方法，其特征在于，所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书包括：
    所述标识管理装置将第一随机化因子与所述用户的特征标识进行组合，获得第一字符串；
    所述标识管理装置根据预设的哈希函数对所述第一字符串进行哈希，获得第一哈希值；
    所述标识管理装置根据所述应用标识和所述第一哈希值获得第二字符串；
    所述标识管理装置利用私钥对所述第二字符串进行数字签名，获得第三字符串；
    所述标识管理装置根据预设顺序将所述应用标识和所述第三字符串组装成所述应用标识证书。
  3. 如权利要求1所述的方法，其特征在于，所述应用标识证书申请请求还包括应用标识的类型；
    所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书，具体包括：
    所述标识管理装置根据所述应用标识、所述应用标识的类型和所述用户的 特征标识生成应用标识证书。
  4. 如权利要求3所述的方法，其特征在于，所述标识管理装置根据所述应用标识、所述应用标识的类型和所述用户的特征标识生成应用标识证书，具体包括：
    所述标识管理装置将第二随机化因子与所述用户的特征标识进行组合，获得第四字符串；
    所述标识管理装置根据预设的哈希函数对所述第四字符串进行哈希，获得第二哈希值；
    所述标识管理装置根据所述应用标识的类型、所述应用标识以及所述第二哈希值获得第五字符串；
    所述标识管理装置利用私钥对所述第五字符串进行数字签名，获得第六字符串；
    所述标识管理装置根据预设顺序将所述应用标识的类型、所述应用标识以及所述第六字符串组装成所述应用标识证书。
  5. 如权利要求1至4任一所述的方法，其特征在于，所述应用标识证书申请请求中还包括所述用户的数字签名；
    所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书之前，还包括：
    所述标识管理装置根据所述用户标识获取所述用户的公钥；
    所述标识管理装置根据所述用户的公钥验证所述用户的数字签名；
    当所述用户的数字签名被验证通过时，所述标识管理装置根据所述应用标识和所述用户的特征标识生成应用标识证书。
  6. 如权利要求5所述的方法，其特征在于，所述标识管理装置向所述用户发送所述应用标识证书之前，还包括：
    所述标识管理装置根据所述用户的公钥对所述应用标识证书进行加密；
    所述标识管理装置向所述用户发送所述应用标识具体包括：
    所述标识管理装置向所述用户发送加密后的应用标识。
  7. 如权利要求1至6任一所述的方法，其特征在于，所述标识管理装置根据所述用户标识获取所述用户的特征标识之前，还包括：
    所述标识管理装置接收所述用户发送的用户标识和生物特征；
    所述标识管理装置根据第一预设算法和所述生物特征生成所述用户的特征标识；
    所述标识管理装置保存所述用户标识与所述用户的特征标识之间的对应关系；
    所述标识管理装置根据所述用户标识获取所述用户的特征标识具体包括：
    所述标识管理装置根据所述对应关系获取与所述用户标识对应的所述用户的特征标识。
  8. 如权利要求1至6任一所述的方法，其特征在于，所述标识管理装置根据所述用户标识获取所述用户的特征标识具体包括：
    所述标识管理装置从所述用户标识中获取所述用户的生物特征；
    所述标识管理装置根据第二预设算法和所述用户的生物特征生成所述用户的特征标识。
  9. 一种管理应用标识的方法，其特征在于，所述方法包括：
    终端接收标识管理装置发送的应用标识证书，所述应用标识证书处于加密状态；
    所述终端根据用户的私钥对所述应用标识证书进行解密，从所述应用标识证书中获取第一字符串以及所述第一字符串的数字签名，其中，所述第一字符串是根据应用标识和特征标识生成的，所述数字签名是所述标识管理装置根据所述第一字符串和所述标识管理装置的私钥制作的；
    所述终端根据所述标识管理装置的公钥对所述数字签名进行解密，获得第二字符串；
    所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证 书的合法性。
  10. 如权利要求9所述的方法，其特征在于，所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证书的合法性之后，还包括：
    若所述应用标识证书合法，所述终端根据所述用户的应用需求确定目的服务器；
    所述终端向所述目的服务器发出注册请求，所述注册请求中包括用户标识、所述应用标识证书以及所述应用标识证书的数字签名以使得所述目的服务器验证应用标识证书的合法性并完成注册，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。
  11. 如权利要求9或10所述的方法，其特征在于，所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证书的合法性之后，还包括：
    若所述应用标识证书合法，所述终端向另一终端发送通信请求，所述通信请求中包括所述应用标识证书以及所述应用标识证书的数字签名以使得所述另一终端验证所述应用标识证书的合法性，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。
  12. 如权利要求10或11所述的方法，其特征在于，所述数字签名中包括应用标识的类型、时间戳和随机值中的一个或多个。
  13. 一种管理应用标识的装置，其特征在于，所述装置包括：
    接收单元，用于接收用户发送的应用标识证书申请请求；
    获取单元，用于根据所述应用标识证书申请请求获取所述用户的用户标识和应用标识；
    所述获取单元，还用于根据所述用户标识获取所述用户的特征标识；
    生成单元，用于根据所述应用标识和所述用户的特征标生成应用标识证书；
    发送单元，用于向所述用户发送所述应用标识证书。
  14. 如权利要求13所述的装置，其特征在于，所述生成单元包括第一组 合子单元、第一哈希子单元、第一联结子单元以及第一签名子单元；
    所述第一组合子单元，用于将第一随机化因子与所述用户的特征标识进行组合，获得第一字符串；
    所述第一哈希子单元，用于根据预设的哈希函数对所述第一字符串进行哈希，获得第一哈希值；
    所述第一联结子单元，用于根据所述应用标识和所述第一哈希值获得第二字符串；
    所述第一签名子单元，用于利用私钥对所述第二字符串进行数字签名，获得第三字符串；
    所述第一组合子单元，还用于根据预设顺序将所述应用标识和所述第三字符串组装成所述应用标识证书。
  15. 如权利要求13所述的装置，其特征在于，所述应用标识证书申请请求中还包括应用标识的类型；
    所述生成单元，还用于根据所述应用标识、所述应用标识的类型和所述用户的特征标识生成应用标识证书。
  16. 如权利要求15所述的装置，其特征在于，所述生成单元包括第二组合子单元、第二哈希子单元、第二联结子单元以及第二签名子单元；
    所述第二组合子单元，用于将第二随机化因子与所述用户的特征标识进行组合，获得第四字符串；
    所述第二哈希子单元，用于根据预设的哈希函数对所述第四字符串进行哈希，获得第二哈希值；
    所述第二联结子单元，用于根据所述应用标识的类型、所述应用标识以及所述第二哈希值获得第五字符串；
    所述第二签名子单元，用于利用私钥对所述第五字符串进行数字签名，获得第六字符串；
    所述第二组合子单元，还用于根据预设顺序将所述应用标识的类型、所述 应用标识以及所述第六字符串组装成所述应用标识证书。
  17. 如权利要求13至16任一所述的装置，其特征在于，所述应用标识证书申请请求中还包括所述用户的数字签名；所述装置还包括验证单元；
    所述获取单元，用于根据所述用户标识获取所述用户的公钥；
    所述验证单元，用于根据所述用户的公钥验证所述用户的数字签名；
    所述生成单元，具体用于当所述用户的数字签名被验证通过时，根据所述应用标识和所述用户的特征标识生成应用标识证书。
  18. 如权利要求17所述的装置，其特征在于，所述装置还包括加密单元；
    所述加密单元，用于根据所述用户的公钥对所述应用标识证书进行加密；
    所述发送单元，具体用于向所述用户发送加密后的应用标识。
  19. 如权利要求13至18任一所述的装置，其特征在于，所述装置还包括保存单元；
    所述接收单元，用于接收所述用户发送的用户标识和生物特征；
    所述生成单元，还用于根据第一预设算法和所述生物特征生成所述用户的特征标识；
    所述保存单元，用于保存所述用户标识与所述用户的特征标识之间的对应关系；
    所述获取单元，具体用于根据所述对应关系获取与所述用户标识对应的所述用户的特征标识。
  20. 如权利要求13至18任一所述的方法，其特征在于，所述获取单元包括获取子单元和生成子单元；
    所述获取子单元，用于从所述用户标识中获取所述用户的生物特征；
    所述生成子单元，用于根据第二预设算法和所述用户的生物特征生成所述用户的特征标识。
  21. 一种终端，其特征在于，所述终端包括：
    接收单元，用于接收标识管理装置发送的应用标识证书，所述应用标识证书处于加密状态；
    解密单元，用于根据用户的私钥对所述应用标识证书进行解密，从所述应用标识证书中获取第一字符串以及所述第一字符串的数字签名，其中，所述第一字符串是根据应用标识和特征标识生成的，所述数字签名是所述标识管理装置根据所述第一字符串和所述标识管理装置的私钥制作的；
    所述解密单元，还用于根据所述标识管理装置的公钥对所述数字签名进行解密，获得第二字符串；
    所述验证单元，所述终端根据所述第一字符串以及所述第二字符串验证所述应用标识证书的合法性。
  22. 如权利要求21所述的终端，其特征在于，所述终端还包括确定单元和第一发送单元：
    所述确定单元，用于若所述验证单元验证所述应用标识证书合法，根据所述用户的应用需求确定目的服务器；
    所述第一发送单元，向所述目的服务器发出注册请求，所述注册请求中包括用户标识、所述应用标识证书以及所述应用标识证书的数字签名以使得所述目的服务器验证应用标识证书的合法性并完成注册，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。
  23. 如权利要求21或22所述的终端，其特征在于，终端还包括第二发送单元；
    所述第二发送单元，用于若所述应用标识证书合法，所述终端向另一终端发送通信请求，所述通信请求中包括所述应用标识证书以及所述应用标识证书的数字签名以使得所述另一终端验证所述应用标识证书的合法性，其中，所述应用标识证书的数字签名是所述终端根据所述应用标识证书和所述用户的私钥制作的。
  24. 如权利要求22或23所述的终端，其特征在于，所述数字签名中包括 应用标识的类型、时间戳和随机值中的一个或多个。
PCT/CN2015/091766 2015-03-31 2015-10-12 一种管理应用标识的方法及装置 WO2016155281A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/498,310 US10630488B2 (en) 2015-03-31 2017-04-26 Method and apparatus for managing application identifier

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510147302.6 2015-03-31
CN201510147302.6A CN106161350B (zh) 2015-03-31 2015-03-31 一种管理应用标识的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/498,310 Continuation US10630488B2 (en) 2015-03-31 2017-04-26 Method and apparatus for managing application identifier

Publications (1)

Publication Number Publication Date
WO2016155281A1 true WO2016155281A1 (zh) 2016-10-06

Family

ID=57003955

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/091766 WO2016155281A1 (zh) 2015-03-31 2015-10-12 一种管理应用标识的方法及装置

Country Status (3)

Country Link
US (1) US10630488B2 (zh)
CN (1) CN106161350B (zh)
WO (1) WO2016155281A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210042755A1 (en) * 2018-01-30 2021-02-11 Entersekt International Limited A system and method for maintaining a fraud risk profile in a fraud risk engine

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107070654B (zh) * 2017-05-12 2020-11-27 北京小米移动软件有限公司 信息采集方法及装置
CN107612697B (zh) * 2017-10-20 2020-04-14 阿里巴巴集团控股有限公司 数字证书申请方法和装置
CN108964892B (zh) * 2018-06-25 2019-07-26 北京迪曼森科技有限公司 可信应用标识的生成方法、应用方法、管理系统和应用系统
US10778444B2 (en) * 2018-07-11 2020-09-15 Verizon Patent And Licensing Inc. Devices and methods for application attestation
WO2020107104A1 (en) * 2018-11-30 2020-06-04 BicDroid Inc. Personalized and cryptographically secure access control in operating systems
CN111447077B (zh) * 2019-01-17 2023-05-09 中国移动通信有限公司研究院 一种网元配置方法、装置和存储介质
US10931661B2 (en) * 2019-03-05 2021-02-23 Centripetal Networks Methods and systems for certificate filtering
CN110198214B (zh) * 2019-06-02 2022-02-22 四川虹微技术有限公司 身份标识生成方法、验证方法及装置
US11411952B2 (en) * 2020-04-02 2022-08-09 Verizon Patent And Licensing Inc. Systems and methods for multi-level authentication
KR20210145558A (ko) * 2020-05-25 2021-12-02 삼성전자주식회사 에지 컴퓨팅 서비스를 수행하는 전자 장치 및 전자 장치의 동작 방법
JP7533580B2 (ja) * 2020-06-22 2024-08-14 日本電気株式会社 認証システム、認証端末、端末、認証システムの制御方法、認証端末の制御方法及び制御プログラム、端末の制御方法及び制御プログラム
EP4315752A2 (en) * 2021-05-07 2024-02-07 Dfinity Stiftung Identity services and authentication in distributed networks

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20030045419A (ko) * 2001-12-04 2003-06-11 김영제 생체인식정보와 디지털 워터마크기술을 이용하는공개키기반구조
CN102769606A (zh) * 2011-12-27 2012-11-07 中原工学院 一种基于基因证书的网络数字身份认证方法

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7047416B2 (en) * 1998-11-09 2006-05-16 First Data Corporation Account-based digital signature (ABDS) system
US6826690B1 (en) * 1999-11-08 2004-11-30 International Business Machines Corporation Using device certificates for automated authentication of communicating devices
US8812319B2 (en) * 2001-01-31 2014-08-19 Ibiometrics, Inc. Dynamic pass phrase security system (DPSS)
US7574734B2 (en) * 2002-08-15 2009-08-11 Dominique Louis Joseph Fedronic System and method for sequentially processing a biometric sample
JP4425859B2 (ja) * 2003-07-11 2010-03-03 日本電信電話株式会社 アドレスに基づく認証システム、その装置およびプログラム
US8006288B2 (en) * 2004-11-05 2011-08-23 International Business Machines Corporation Method and apparatus for accessing a computer application program
JP2008526173A (ja) * 2006-04-07 2008-07-17 ▲ホア▼▲ウェイ▼技術有限公司 情報セキュリティの認証方法及びシステム
JP4881075B2 (ja) * 2006-05-31 2012-02-22 株式会社東芝 認証システム、統合装置及びプログラム
CN101119198B (zh) * 2006-08-03 2010-09-22 华为技术有限公司 一种生物模版及生物模版构造方法及身份认证方法
CN100584117C (zh) * 2008-12-16 2010-01-20 北京工业大学 无线Mesh网络中安全有效的即时认证方法
US8707418B2 (en) * 2009-11-06 2014-04-22 Telefonaktiebolaget L M Ericsson (Publ) System and methods for web-application communication
US8745405B2 (en) * 2010-02-17 2014-06-03 Ceelox Patents, LLC Dynamic seed and key generation from biometric indicia
JP4970585B2 (ja) * 2010-11-10 2012-07-11 株式会社東芝 サービス提供システム及びユニット装置
CN102006299B (zh) * 2010-11-29 2013-07-31 西安交通大学 一种面向可信互联网的基于实体标识的身份认证方法及系统
US8893244B2 (en) * 2011-11-30 2014-11-18 Verizon Patent And Licensing Inc. Application-based credential management for multifactor authentication
US8775814B2 (en) * 2012-04-02 2014-07-08 Tata Consultancy Services Ltd. Personalized biometric identification and non-repudiation system
US8904498B2 (en) * 2012-10-17 2014-12-02 Ca, Inc. Biometric identification for mobile applications
US20140136419A1 (en) * 2012-11-09 2014-05-15 Keith Shoji Kiyohara Limited use tokens granting permission for biometric identity verification
US9313203B2 (en) * 2013-03-15 2016-04-12 Symantec Corporation Systems and methods for identifying a secure application when connecting to a network
US8965066B1 (en) * 2013-09-16 2015-02-24 Eye Verify LLC Biometric template security and key generation
US9654463B2 (en) * 2014-05-20 2017-05-16 Airwatch Llc Application specific certificate management
US9439062B2 (en) * 2014-05-30 2016-09-06 Apple Inc. Electronic subscriber identity module application identifier handling
EP3065435A4 (en) * 2015-01-05 2017-04-19 EBIID, Products & Solutions, S.L. Method for generating a digital identity for a user of a mobile device, digital user identity, and authentication method using said digital user identity

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20030045419A (ko) * 2001-12-04 2003-06-11 김영제 생체인식정보와 디지털 워터마크기술을 이용하는공개키기반구조
CN102769606A (zh) * 2011-12-27 2012-11-07 中原工学院 一种基于基因证书的网络数字身份认证方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210042755A1 (en) * 2018-01-30 2021-02-11 Entersekt International Limited A system and method for maintaining a fraud risk profile in a fraud risk engine
US11763309B2 (en) * 2018-01-30 2023-09-19 Entersekt International Limited System and method for maintaining a fraud risk profile in a fraud risk engine

Also Published As

Publication number Publication date
US20170230187A1 (en) 2017-08-10
CN106161350B (zh) 2020-03-10
US10630488B2 (en) 2020-04-21
CN106161350A (zh) 2016-11-23

Similar Documents

Publication Publication Date Title
WO2016155281A1 (zh) 一种管理应用标识的方法及装置
US20240039714A1 (en) Secure Circuit For Encryption Key Generation
CN109067801B (zh) 一种身份认证方法、身份认证装置及计算机可读介质
CN109862041B (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
US10003582B2 (en) Technologies for synchronizing and restoring reference templates
CN108259438B (zh) 一种基于区块链技术的认证的方法和装置
US20180241740A1 (en) Certificate authority
WO2016173211A1 (zh) 一种管理应用标识的方法及装置
CA2551113A1 (en) Authentication system for networked computer applications
CN107810617A (zh) 机密认证和供应
KR20080051753A (ko) 보안 제공 시스템 및 방법
EP3206329B1 (en) Security check method, device, terminal and server
US20220005039A1 (en) Delegation method and delegation request managing method
US11082236B2 (en) Method for providing secure digital signatures
WO2020062667A1 (zh) 数据资产管理方法、数据资产管理装置及计算机可读介质
CN115037480B (zh) 设备认证和校验的方法、装置、设备和存储介质
Abraham et al. SSI Strong Authentication using a Mobile-phone based Identity Wallet Reaching a High Level of Assurance.
JPH10336172A (ja) 電子認証用公開鍵の管理方法
WO2015109958A1 (zh) 一种基于协商密钥的数据处理方法和手机
CN106533681B (zh) 一种支持部分出示的属性证明方法与系统
TWI694346B (zh) 多元身分認證憑據之系統與方法
TWI670990B (zh) 自動連線安全無線網路的方法與系統
TWI746504B (zh) 實現會話標識同步的方法及裝置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15887235

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15887235

Country of ref document: EP

Kind code of ref document: A1