Authentication system and working method thereof

A working method of an authenticating system, comprising the following steps:

• Step S1, parsing, by a server, an authentication triggering request to obtain an application identifier when the server receives the authentication triggering request comprising a preset application identifier sent from a relying party;
• generating an authentication policy and a challenge value according to the authentication triggering request;
• generating an authentication request according to the authentication policy and the challenge value and sending the authentication request to a client via the relying party;
• Step S2, receiving and parsing, by the client, the authentication request to obtain the application identifier, the authentication policy and the challenge value;
• generating a first final challenge data according to the application identifier and the challenge value which are obtained by the parsing;
• selecting an authenticator according to the authentication policy;
• generating a signature key identifier list according to the authentication policy;
• generating an identity information verifying instruction according to the first final challenge data, the application identifier and the signature key identifier list and sending the identity information verifying instruction to the selected authenticator;
• Step S3, receiving and parsing, by the authenticator, the identity information verifying instruction to obtain the first final challenge data, the application identifier and the signature key identifier list, generating token accessing data according to the application identifier;
• performing calculation on the first final challenge data to generate a final challenge hash value;
• prompting a user to input identity information of the user, verifying the identity information of the user input by the user, when the verifying is successful, executing Step S4;
• otherwise, reporting an error, the procedure ends;
• Step S4, obtaining, by the authenticator, a signature private key and a signature key identifier according to the signature key identifier list, the application identifier and the token accessing data;
• generating data to be signed according to a preset authenticator identifier, the final challenge hash value and the signature key identifier;
• generating a signature value by performing calculation on the data to be signed using the signature private key;
• generating an authentication response according to the authenticator identifier, the final challenge hash value, the signature key identifier and the signature value, and sending the authentication response to the server via the client and the relying party;
• Step S5, receiving and parsing, by the server, the authentication response to obtain the authenticator identifier, the final challenge hash value, the signature key identifier and the signature value;
• verifying the authenticator identifier and the final challenge hash value respectively, verifying the signature value according to the signature key identifier, determining whether all results of the verifying are successful, if yes, the verification is successful, otherwise, the verification is failed.