Method and device for authenticating based on authenticating device

A client for authenticating based on an authenticating device, comprising:

• a first generating module, a first sending module, a first receiving module, a second generating module, a third generating module, a first determining module, a fourth generating module and a second determining module, wherein
• the first generating module is configured to obtain an application ID according to the uniform resource identifier, and obtain a device authenticating request according to the application ID and a user identification input by a user;
• the first sending module is configured to send the device authenticating request generated by the first generating module to the server, send current authenticating request information generated by the third generating module to the authenticating device, and send a signature verifying request generated by the fourth generating module to the server;
• the first receiving module is configured to receive current authenticating data returned by the server, receive information returned by the authenticating device, and receive information returned by the server;
• the second generating module is configured to obtain a client data object according to a challenge value in the current authenticating data received by the first receiving module;
• the third generating module is configured to apply hash operation to the client data object generated by the second generating module and the application ID in the current authenticating data received by the first receiving module to obtain a client parameter, obtain the key identification in the current authenticating data, and combine the client parameter, the key identification and key identification length into the current authenticating request information;
• the first determining module is configured to determine the type for information returned by the authenticating device and received by the first receiving module and, if the type is authentication fail information, determine that the authenticating is failed and terminate the authenticating;
• the fourth generating module is configured to, when the first determining module determines that the information returned by the authenticating device is authentication response information, combine the authentication response information, the client data object generated by the second generating module, and the session ID in the current authenticating data received by the first receiving module into the signature verifying request;
• and
• the second determining module is configured to determine whether the information returned by the server and received by the first receiving module is success information and, if yes, determine that the authenticating is successful, otherwise, determine that the authenticating is failed.

An authenticating device for authenticating based on the authenticating device, comprising:

• a third receiving module, a fourth obtaining module, a fourteenth determining module, a seventh generating module, a signing module, a second updating module, an eighth generating module and a third sending module, wherein
• the third receiving module is configured to wait for receiving a current authenticating request information sent by the client, and wait for receiving confirming information from the user;
• the fourth obtaining module is configured to obtain the key identification in the current authenticating request information received by the third receiving module;
• the fourteenth determining module is configured to search the authenticating device for a private key in a key pair corresponding to the key identification obtained by the fourth obtaining module, and determine whether any private key in a key pair corresponding to the key identification can be found;
• the seventh generating module is configured to, when the fourteenth determining module determines that a private key in a key pair corresponding to the key identification can be found, obtain data to be signed according to the current authentication count of the authenticating device and the client parameter in the current authenticating request information received by the third receiving module;
• the signing module is configured to, when the third receiving module receives the confirming information from the user, use the found private key corresponding to the key identification to sign the data to be signed, which is generated by the seventh generating module, according to a signature algorithm to obtain a signature result;
• the second updating module is configured to, when the signing module performs the signing, update the current authentication count for the authenticating device;
• the eighth generating module is configured to combine the current authentication count of the authenticating device obtained through updating by the second updating module and the signature result obtained through signing by the signing module into authentication response information;
• and
• the third sending module is configured to return authentication fail information to the client when the fourteenth determining module determines that a private key in a key pair corresponding to the key identification cannot be found, and send the authentication response information generated by the eighth generating module to the client.