# US 2021/0243040 A1 · Authentication system and working method thereof

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0243040 A1
- Document ID: US20210243040A1
- Status: Published application
- Kind: A1
- Application number: 17/173,092
- Filed: 2021-02-10
- Published: 2021-08-05
- Earliest claimed: 2018-08-15
- Assignees: Feitian Technologies Co., Ltd.
- Applicants: Feitian Technologies Co., Ltd.
- Inventors: ZHOU LU; HUAZHANG YU
- Web page: https://patentgrep.com/patent/US20210243040A1

## CPC

- H04L 9/3271: {using challenge-response}
- G06F 16/245: Query processing
- G06F 21/31: User authentication
- G06F 21/44: Program or device authentication
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3247: {involving digital signatures}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A working method includes: a client receives and parses an authentication request to obtain an application identifier, an authentication policy and a challenge value; generates a signature key identifier list according to the authentication policy; sends an identity information verifying instruction generated according to the challenge value, the application identifier and the signature key identifier list; an authenticator obtains a signature private key and a signature key identifier according to the signature key identifier list and the application identifier; generates a final challenge hash value according to the application identifier and the challenge value; generates a signature value according to the final challenge hash value, the preset authenticator identifier and the signature key identifier; sends the signature value to a server; the server receives the signature value and verifies the signature value, determines whether the verifying is successful, if yes, the verifying is successful; otherwise, the verifying is failed.

## Claims

### Claim 1

A working method of an authenticating system, comprising the following steps:
Step S1, parsing, by a server, an authentication triggering request to obtain an application identifier when the server receives the authentication triggering request comprising a preset application identifier sent from a relying party; generating an authentication policy and a challenge value according to the authentication triggering request; generating an authentication request according to the authentication policy and the challenge value and sending the authentication request to a client via the relying party;
Step S2, receiving and parsing, by the client, the authentication request to obtain the application identifier, the authentication policy and the challenge value; generating a first final challenge data according to the application identifier and the challenge value which are obtained by the parsing; selecting an authenticator according to the authentication policy; generating a signature key identifier list according to the authentication policy; generating an identity information verifying instruction according to the first final challenge data, the application identifier and the signature key identifier list and sending the identity information verifying instruction to the selected authenticator;
Step S3, receiving and parsing, by the authenticator, the identity information verifying instruction to obtain the first final challenge data, the application identifier and the signature key identifier list, generating token accessing data according to the application identifier; performing calculation on the first final challenge data to generate a final challenge hash value; prompting a user to input identity information of the user, verifying the identity information of the user input by the user, when the verifying is successful, executing Step S4; otherwise, reporting an error, the procedure ends;
Step S4, obtaining, by the authenticator, a signature private key and a signature key identifier according to the signature key identifier list, the application identifier and the token accessing data; generating data to be signed according to a preset authenticator identifier, the final challenge hash value and the signature key identifier; generating a signature value by performing calculation on the data to be signed using the signature private key; generating an authentication response according to the authenticator identifier, the final challenge hash value, the signature key identifier and the signature value, and sending the authentication response to the server via the client and the relying party;
Step S5, receiving and parsing, by the server, the authentication response to obtain the authenticator identifier, the final challenge hash value, the signature key identifier and the signature value; verifying the authenticator identifier and the final challenge hash value respectively, verifying the signature value according to the signature key identifier, determining whether all results of the verifying are successful, if yes, the verification is successful, otherwise, the verification is failed.

### Claim 2 (depends on 1)

The method of claim 1, wherein before Step S1, the method further comprises:
Step S6, generating, by the relying party, a registration triggering request according to a user account and a preset application identifier when the relying party receives a login registering request information comprising the user account sent from the client and sending the registration triggering request to the server;
Step S7, receiving and parsing, by the server, the registration triggering request to obtain the user account and the application identifier; generating an authentication policy and a challenge value according to the registration triggering request; generating a registering request according to the application identifier, the authentication policy, the challenge value and the user account and sending the registering request to the client via the relying party;
Step S8, receiving and parsing, by the client, the registering request to obtain the application identifier, the authentication policy, the challenge value and the user account; selecting an authenticator according to the authentication policy; generating a first final challenge data according to the application identifier and the challenge value; generating an identity verifying instruction according to the first final challenge data, the application identifier and the user account and sending the identity verifying instruction to the selected authenticator;
Step S9, receiving and parsing, by the authenticator, the identity verifying instruction to obtain the first final challenge data, the application identifier and the user account; generating token accessing data according to the application identifier and the user account; performing hash operation on the first final challenge data to generate a final challenge hash value; obtaining identity information of the user; generating a signature public key, a signature private key and a signature key identifier according to the identity information of the user
Step S10, generating by the authenticator, data to be signed according to the preset authenticator identifier, the final challenge hash value, the signature key identifier and the signature public key, obtaining a signature value by performing calculation on the data to be signed using a preset authenticator private key; generating a registering response according to the authenticator identifier, the final challenge hash value, the signature public key, the signature key identifier, a preset authenticator certificate and the signature value and sending the registering response to the server via the client and the relying party;
Step S11, receiving and parsing, by the server, the registering response, respectively verifying the authenticator identifier, the final challenge hash value, the authenticator certificate and the signature value which are obtained by parsing the registering response; determining whether all results of the verifying are successful, if yes, correspondingly storing the signature public key, the signature key identifier and the authenticator identifier which are obtained by parsing the registering response, otherwise, reporting an error, ends.

### Claim 3 (depends on 1)

The method of claim 1, wherein all data transmission between the relying party and the client is performed via a preset secure channel.

### Claim 4 (depends on 3)

The method of claim 3, wherein in Step S2, the generating a first final challenge data according to the application identifier and the challenge value which are obtained by the parsing specifically comprises: generating, by the client, a first final challenge data according to preset security channel data, the application identifier and the challenge value;
in Step S5, before the verifying the final challenge hash value, the method further comprises: receiving, by the server, the preset security channel data sent by the relying party;
in Step S5, the verifying the final challenge hash value specifically comprises:
generating, by the server, a second final challenge data according to the preset security channel data, the application identifier obtained by parsing the authentication triggering request and the generated challenge value, performing hash operation on the second final challenge data to generate a hash operation result, determining whether the generated hash operation result is identical to the final challenge hash value obtained by parsing the authentication response, if yes, the verifying for the final challenge hash value is successful; otherwise, the verifying for the final challenge hash value is failed.

### Claim 5 (depends on 1)

The method of claim 1, wherein in Step S2, after the receiving and parsing, by the client, the authentication request to obtain the application identifier, the authentication policy and the challenge value, the method further comprises: determining, by the client, whether a current user proxy identifier is legitimate according to the application identifier obtained by the parsing, if yes, generating the first final challenge data according to the application identifier and the challenge value which are obtained by the parsing, otherwise, reporting an error;
in Step S2, the determining, by the client, whether the current user proxy identifier is legitimate according to the application identifier obtained by parsing comprises the following steps:
Step D1, generating, by the client, a request for a user proxy identifier list according to the application identifier; sending the request for a user proxy identifier list to the relying party;
Step D2, receiving, by the relying party, the request for a user proxy identifier list, obtaining a user proxy identifier list and sending the obtained user proxy identifier list to the client;
Step D3, receiving, by the client, the user proxy identifier list, determining whether the current user proxy identifier exists in the user proxy identifier list, if yes, the current user proxy identifier is legitimate, otherwise, the current user proxy identifier is not legitimate.

### Claim 6 (depends on 1)

The method of claim 1, wherein after the generating the token accessing data according to the application identifier, before the obtaining, by the authenticator, the signature private key and the signature key identifier according to the signature key identifier list, the application identifier and the token accessing data, the method further comprises: updating, by the authenticator, the token accessing data according to the application identifier;
in Step S4, the obtaining, by the authenticator, the signature private key and the signature key identifier according to the signature key identifier list, the application identifier and the token accessing data specifically comprises:
searching, by the authenticator, target original signature key data from preset original signature key data according to the signature key identifier list, the application identifier and the updated token accessing data; obtaining the signature private key and the signature key identifier which are corresponding to the target original signature key data;
wherein the searching, by the authenticator, the target original signature key data from the preset original signature key data according to the signature key identifier list, the application identifier and the updated token accessing data comprises the following steps:
Step A1, searching, by the authenticator, original signature key encrypted data according to the signature key identifier list and the application identifier;
Step A2, decrypting, by the authenticator, the original signature key encrypted data according to a preset wrapper key to obtain an original signature key data list; and
Step A3, screening, by the authenticator, the original signature key data list according to the updated token accessing data, determining the number of original signature key data remained in the original signature key data list after the screening, recording the original signature key data remained in the original signature key data list as the target original signature key data when the number of the original signature key data remained in the original signature key data list after the screening is 1.

### Claim 7 (depends on 1)

The method of claim 1, wherein in Step S4, the sending the authentication response to the server via the client and the relying party comprises the following steps:
Step C1, sending, by the authenticator, the authentication response to the client;
Step C2, receiving, by the client, the authentication response, attaching the generated first final challenge data to the authentication response to update the authentication response, and sending the authentication response to the relying party; and
Step C3, receiving, by the relying party, the authentication response, and sending the authentication response to the server;
in Step S5, after the receiving and parsing, by the server, the authentication response, before the determining whether all results of the verifying are successful, the method further comprises:
determining, by the server, whether the application identifier in the first final challenge data obtained by parsing the authentication response is identical to the application identifier obtained by parsing the authentication triggering request, determining whether the challenge value in the first final challenge data is identical to the generated challenge value, when the application identifier in the first final challenge data obtained by parsing the authentication response is identical to the application identifier obtained by parsing the authentication triggering request and the challenge value in the first final challenge data is identical to the generated challenge value, the verifying is successful, otherwise, the verifying is failed.

### Claim 8 (depends on 2)

The method of claim 2, wherein in Step S8, the generating the first final challenge data according to the application identifier and the challenge value specifically comprises: generating, by the client, the first final challenge data according to preset security channel data, the application identifier and the challenge value;
in Step S11, before the verifying the final challenge hash value obtained by parsing the registering response, the method further comprises: receiving, by the server, the preset security channel data sent by the relying party;
in Step S11, the verifying the final challenge hash value which is obtained by parsing the registering response specifically comprises:
performing hash operation on the second final challenge data to generate a hash operation result according to the received preset security channel data, the application identifier and the generated second final challenge data, determining whether the generated hash operation result is identical to the final challenge hash value obtained by parsing the registering response, if yes, the verifying is successful, otherwise, the verifying is failed.

### Claim 9 (depends on 2)

The method of claim 2, wherein in Step S8, after the receiving parsing, by the client, the registering request to obtain the application identifier, the authentication policy, the challenge value and the user account, the method further comprises: determining, by the client, whether a current user proxy identifier is legitimate according to the application identifier, if yes, generating a first final challenge data according to the application identifier and the challenge value, otherwise, reporting an error;
wherein the determining, by the client, whether the current user proxy identifier is legitimate according to the application identifier, if yes, generating the first final challenge data according to the application identifier and the challenge value; otherwise, reporting an error, specifically comprises the following steps:
Step D4, generating, by the client, a user proxy identifier list obtaining request according to the application identifier and sending the user proxy identifier list obtaining request to the relying party;
Step D5, receiving, by the relying party, the user proxy identifier list obtaining request, obtaining the user proxy identifier list and sending the user proxy identifier list to the client; and
Step D6, receiving, by the client, the user proxy identifier list, determining whether the current user proxy identifier exists in the user proxy identifier list, if yes, determining the current user proxy identifier is legitimate and generating the first final challenge data according to the application identifier and the challenge value, otherwise, reporting an error.

### Claim 10 (depends on 2)

The method of claim 2, wherein in Step S10, the sending the registering response to the server via the client and the relying party specifically comprises the following steps:
Step C4, sending, by the authenticator, the registering response to the client;
Step C5, receiving, by the client, the registering response, attaching the generated first final challenge data to the registering response to update the registering response and sending the updated registering response to the relying party; and
Step C6, receiving, by the relying party, the updated registering response and sending the updated registering response to the server;
in Step S11, after the receiving and parsing, by the server, the registering response, before the determining whether all results of the verifying are successful, the method further comprises: verifying, by the server, the first final challenge data obtained by parsing the registering response;
wherein the verifying, by the server, the first final challenge data obtained by parsing the registering response specifically comprises: determining, by the server, whether the application identifier in the first final challenge data obtained by parsing the registering response is identical to the application identifier in the registration triggering request; determining whether the challenge value in the first final challenge data obtained by parsing the registering response is identical to the generated challenge value, if both results of the determining are yes, the verifying is successful, and determining whether all results of the verifying is successful, otherwise, the verifying is failed.

### Claim 11 (depends on 2)

The method of claim 2, wherein in Step S11, before the correspondingly storing the signature public key, the signature key identifier and the authenticator identifier which are obtained by parsing the registering response, the method further comprises: determining, by the server, whether the authenticator is registered according to the authenticator identifier and the signature key identifier which are obtained by parsing the registering response, if yes, reporting an error, otherwise, correspondingly storing the signature public key, the signature key identifier and the authenticator identifier.

### Claim 12

An authenticating system, comprising an authenticator, a client, a relying party and a server;
the server is configured to parse the authentication triggering request to obtain an application identifier when an authentication triggering request comprising a preset application identifier sent by the relying party is received; generate an authentication policy and a challenge value according to the authentication triggering request; generate an authentication request according to the application identifier, the authentication policy and the challenge value, send the authentication request to the client via the relying party;
the client is configured to receive and parse the authentication request to obtain the application identifier, the authentication policy and the challenge value; generate a first final challenge data according to the application identifier and the challenge value which are obtained by the parsing; select the authenticator according to the authentication policy; generate a signature key identifier list according to the authentication policy; generate an identity information verifying instruction according to the first final challenge data, the application identifier and the signature key identifier list and sending the identity information verifying instruction to the authenticator;
the authenticator is configured to receive and parse the identity information verifying instruction to obtain the first final challenge data, the application identifier and the signature key identifier list; generate token accessing data according to the application identifier; perform calculation on the first final challenge data to generate a final challenge hash value; prompt a user to input identity information of the user, verify the identity information of the user input by the user; report an error when authenticating is failed, the procedure ends;
the authenticator is further configured to obtain a signature private key and a signature key identifier according to the signature key identifier list, the application identifier and the token accessing data; generate data to be signed according to a preset authenticator identifier, the final challenge hash value and the signature key identifier, generate a signature value by performing calculation on the data to be signed using the signature private key; generate an authentication response according to the authenticator identifier, the final challenge hash value, the signature key identifier and the signature value and send the authentication response to the server via the client and the relying party;
the server is further configured to receive and parse the authentication response to obtain the authenticator identifier, the final challenge hash value, the signature key identifier and a signature value, verify the authenticator identifier and the final challenge hash value respectively, verify the signature value according to the signature key identifier, determine whether all results of the verifying are successful, if yes, the verification is successful, otherwise, the verification is failed.

### Claim 13 (depends on 12)

The system of claim 12, wherein
the relying party is further configured to generate a registration triggering request according to a user account and a preset application identifier when receiving a login registering request information comprising the user account sent from the client, and send the registration triggering request to the server;
the server is further configured to receive and parse the registration triggering request to obtain the user account and the application identifier; generate an authentication policy and a challenge value according to the registration triggering request; generate a registering request according to the application identifier, the authentication policy, the challenge value and the user account and send the registering request to the client via the relying party;
the client is further configured to receive and parse the registering request to obtain the application identifier, the authentication policy, the challenge value and the user account; select an authenticator according to the authentication policy; generate a first final challenge data according to the application identifier and the challenge value; generate an identity verifying instruction according to the first final challenge data, the application identifier and the user account and sending the identity verifying instruction to the selected authenticator;
the authenticator is further configured to receive and parse the identity verifying instruction to obtain the first final challenge data, the application identifier and the user account; generate token accessing data according to the application identifier and the user account; perform hash operation on the first final challenge data to generate a final challenge hash value; obtain identity information of the user; generate a signature public key, a signature private key and a signature key identifier according to the identity information of the user;
the authenticator is further configured to generate data to be signed according to the preset authenticator identifier, the final challenge hash value, the signature key identifier and the signature public key, obtain a signature value by performing calculation on the data to be signed using a preset authenticator private key; generate a registering response according to the authenticator identifier, the final challenge hash value, the signature public key, the signature key identifier, a preset authenticator certificate and the signature value and send the registering response to the server via the client and the relying party;
the server is further configured to receive and parse the registering response, respectively verify the authenticator identifier, the final challenge hash value, the authenticator certificate and the signature value which are obtained by parsing the registering response; determine whether all the verifying are success, if yes, correspondingly store the signature public key, the signature key identifier and the authenticator identifier which are obtained by parsing the registering response, otherwise, report an error, the procedure ends.

### Claim 14 (depends on 12)

The system of claim 12, wherein all data transmission between the relying party and the client is performed via a preset secure channel.

### Claim 15 (depends on 14)

The system of claim 14, wherein the client further is configured to generate a first final challenge data according to the preset security channel data, the application identifier and the challenge value;
the server is further configured to receive the preset security channel data sent by the relying party before the verifying the final challenge hash value;
the server is further configured to generate a second final challenge data according to the preset security channel data, the application identifier obtained by parsing the authentication triggering request and the generated challenge value, performing hash operation on the second final challenge data to generate a hash operation result, determining whether the generated hash operation result is identical to the final challenge hash value obtained by parsing the authentication response, if yes, the verifying for the final challenge hash value is successful; otherwise, the verifying for the final challenge hash value is failed.

### Claim 16 (depends on 12)

The system of claim 12, wherein the client is further configured to, after the receiving and parsing, by the client, the authentication request to obtain the application identifier, the authentication policy and the challenge value, determine whether a current user proxy identifier is legitimate according to the application identifier obtained by the parsing, if yes, generate the first final challenge data according to the application identifier and the challenge value which are obtained by the parsing, otherwise, report an error;
the client is further configured to generate a request for a user proxy identifier list according to the application identifier; send the request for a user proxy identifier list to the relying party;
the relying party is further configured to receive the request for a user proxy identifier list, obtain a user proxy identifier list and send the user proxy identifier list to the client;
the client is further configured to receive the user proxy identifier list, determine whether the current user proxy identifier exists in the user proxy identifier list, if yes, the current user proxy identifier is legitimate, otherwise, the current user proxy identifier is not legitimate.

### Claim 17 (depends on 12)

The system of claim 12, wherein the authenticator is further configured to, after the generating token accessing data according to the application identifier and before the obtaining the signature private key and the signature key identifier according to the signature key identifier list, the application identifier and the token accessing data, update the token accessing data according to the application identifier;
the authenticator is further configured to search target original signature key data from preset original signature key data according to the signature key identifier list, the application identifier and the updated token accessing data; obtain the signature private key and the signature key identifier which are corresponding to the target original signature key data;
the authenticator is further configured to search original signature key encrypted data according to the signature key identifier list and the application identifier;
the authenticator is further configured to decrypt the original signature key encrypted data according to a preset wrapper key to obtain an original signature key data list;
the authenticator is further configured to screen the original signature key data list according to the updated token accessing data, determine the number of original signature key data remained in the original signature key data list after the screening, record the original signature key data remained in the original signature key data list as the target original signature key data when the number of original signature key data remained in the original signature key data list after screening is 1.

### Claim 18 (depends on 12)

The system of claim 12, wherein
the authenticator is further configured to send the authentication response to the client;
the client is further configured to receive the authentication response, attach the generated first final challenge data to the authentication response to update the authentication response and send the authentication response to the relying party;
the relying party is further configured to receive the authentication response and send the authentication response to the server;
the server is further configured to, after the receiving and parsing the authentication response and before the determining whether all results of the verifying are successful, determine whether the application identifier in the first final challenge data obtained by parsing the authentication response is identical to the application identifier obtained by parsing the authentication triggering request, determine whether the challenge value in the first final challenge data is identical to the generated challenge value, when the application identifier in the first final challenge data obtained by parsing the authentication response is identical to the application identifier obtained by parsing the authentication triggering request and the challenge value in the first final challenge data is identical to the generated challenge value, the verifying is successful, otherwise, the verifying is failed.

### Claim 19 (depends on 13)

The system of claim 13, wherein the client is further configured to generate a first final challenge data according to preset security channel data, the application identifier and the challenge value;
the server is further configured to, before the verifying the final challenge hash value obtained by parsing the registering response, receive the preset security channel data sent by the relying party;
the server is further configured to performing hash operation on the second final challenge data to generate a hash operation result according to the received preset security channel data, the application identifier and the generated second final challenge data, determining whether the generated hash operation result is identical to the final challenge hash value obtained by parsing the registering response, if yes, the verifying is successful, otherwise, the verifying is failed.

### Claim 20 (depends on 12)

The system of claim 12, wherein the client further is configured to, after the receiving and parsing the registering request to obtain the application identifier, the authentication policy, the challenge value and the user account, determine whether a current user proxy identifier is legitimate according to the application identifier, if yes, generate a first final challenge data according to the application identifier and the challenge value, otherwise, report an error;
the client further is configured to generate a user proxy identifier list obtaining request according to the application identifier and send the user proxy identifier list obtaining request to the relying party;
the relying party is further configured to receive the user proxy identifier list obtaining request, obtain the user proxy identifier list and send the user proxy identifier list to the client;
the client is further configured to receive the user proxy identifier list, determine whether the current user proxy identifier exists in the user proxy identifier list, if yes, determine the current user proxy identifier is legitimate and generate the first final challenge data according to the application identifier and the challenge value; otherwise, report an error.

### Claim 21 (depends on 13)

The system of claim 13, wherein
the authenticator is further configured to send the registering response to the client;
the client is further configured to receive the registering response, attach the generated first final challenge data to the registering response to update the registering response and send the updated registering response to the relying party;
the relying party is further configured to receive the updated registering response and send the updated registering response to the server;
the server is further configured to, after the receiving and parsing the registering response and before the determining whether all results of the verifying are successful, verify the first final challenge data obtained by parsing the registering response;
the server is further configured to determine whether the application identifier in the first final challenge data obtained by parsing the registering response is identical to the application identifier in the registration triggering request; determine whether the challenge value in the first final challenge data obtained by parsing the registering response is identical to the generated challenge value, if both results of the determining are yes, the verifying is successful, and determine whether all the verifying is successful, otherwise, the verifying is failed.

### Claim 22 (depends on 13)

The system of claim 13, wherein the server is further configured to, before the correspondingly storing the signature public key, the signature key identifier and the authenticator identifier, determine whether the authenticator is registered according to the authenticator identifier and the signature key identifier which are obtained by parsing the registering response, if yes, report an error, otherwise, correspondingly store the signature public key, the signature key identifier and the authenticator identifier.