Identity authentication system, method, apparatus, and device, and computer-readable storage medium

1 . An identity authentication system, wherein the identity authentication system comprises a terminal device, a registration device, and an authorization device, wherein the terminal device and the authorization device share a first symmetric key, the authorization device stores an ownership relationship record of the terminal device, and the ownership relationship record describes a binding relationship between the terminal device and a current owner of the terminal device;

the terminal device is configured to send a first authentication request to the registration device, wherein the first authentication request carries a first authentication code, and the first authentication code is generated based on the first symmetric key;

the registration device is configured to: receive the first authentication request, generate a second authentication request based on the first authentication request, and send the second authentication request to the authorization device, wherein the second authentication request carries the first authentication code;

the authorization device is configured to: receive the second authentication request, verify the first authentication code based on the first symmetric key and the ownership relationship record, and send a first authentication acknowledgement message to the registration device after verification succeeds, wherein the first authentication acknowledgement message indicates to authorize an ownership relationship between the terminal device and a network to which the registration device belongs, the first authentication acknowledgement message carries a second authentication code, and the second authentication code is generated based on the first symmetric key;

the registration device is further configured to: receive the first authentication acknowledgement message, determine a second authentication acknowledgement message based on the first authentication acknowledgement message, and send the second authentication acknowledgement message to the terminal device, wherein the second authentication acknowledgement message carries the second authentication code; and

the terminal device is further configured to: receive the second authentication acknowledgement message, verify the second authentication code based on the first symmetric key, and determine, after verification succeeds, that bidirectional identity authentication of the terminal device and the registration device succeeds.

2 . An identity authentication method, wherein the method is performed by a terminal device, the terminal device and an authorization device share a first symmetric key, the authorization device stores an ownership relationship record of the terminal device, and the method comprises:

sending, by the terminal device, a first authentication request to a registration device, wherein the first authentication request carries a first authentication code, and the first authentication code is generated based on the first symmetric key;

receiving, by the terminal device, a first authentication acknowledgement message from the registration device, wherein the first authentication acknowledgement message is received from the registration device after verification on the first authentication code based on the first symmetric key and the ownership relationship record succeeds, the first authentication acknowledgement message carries a second authentication code, and the second authentication code is generated by the authorization device based on the first symmetric key; and

verifying, by the terminal device, the second authentication code based on the first symmetric key, and determining, after verification succeeds, that bidirectional identity authentication of the terminal device and the registration device succeeds.

3 . The method according to claim 2 , wherein the first authentication request further carries a first identity (ID) and a first key parameter, the first key parameter comprises plaintext or ciphertext of a first authentication vector (AV), and the first ID is an ID configured by an original owner of the terminal device for the terminal device;

the first AV comprises a first random parameter and a first anti-replay attack parameter, the first random parameter is generated by the terminal device, and the first random parameter comprises at least one of a first random number N1 and a second random number N2; and

the first authentication code is generated based on the first symmetric key, the first ID, and the first AV.

4 . The method according to claim 3 , wherein the first authentication request further carries first identity information, and the first identity information comprises at least one of identity information of the registration device or identity information of a network to which the registration device belongs; and

the first authentication code is generated based on the first symmetric key, the first ID, the first AV, and the first identity information.

5 . An identity authentication method, wherein the method is performed by a registration device, and the method comprises:

receiving, by the registration device, a first authentication request, wherein the first authentication request carries a first authentication code, the first authentication code is generated by a terminal device based on a first symmetric key, and the terminal device and an authorization device share the first symmetric key;

generating, by the registration device, a second authentication request based on the first authentication request, and sending the second authentication request to the authorization device, wherein the second authentication request carries the first authentication code;

receiving, by the registration device, a first authentication acknowledgement message, wherein the first authentication acknowledgement message is determined after verification performed by the authorization device on the first authentication code based on the first symmetric key and an ownership relationship record of the terminal device succeeds, wherein the ownership relationship record is stored on the authorization device, the ownership relationship record describes a binding relationship between the terminal device and a current owner of the terminal device, the first authentication acknowledgement message indicates to the registration device to authorize an ownership relationship between the terminal device and a network to which the registration device belongs, the first authentication acknowledgement message carries a second authentication code, and the second authentication code is generated based on the first symmetric key; and

determining, by the registration device, a second authentication acknowledgement message based on the first authentication acknowledgement message, and sending the second authentication acknowledgement message to the terminal device, wherein the second authentication acknowledgement message carries the second authentication code, and the second authentication acknowledgement message indicates to the terminal device to determine, after verification on the second authentication code based on the first symmetric key succeeds, that bidirectional identity authentication of the terminal device and the registration device succeeds.

6 . The method according to claim 5 , wherein the first authentication request further carries a first identity (ID), the first ID is an ID configured by an original owner of the terminal device for the terminal device, the second authentication request further carries the first ID in the first authentication request, the second authentication request further carries first identity information, and the first identity information comprises at least one of identity information of the registration device and identity information of the network to which the registration device belongs.

7 . The method according to claim 6 , wherein the second authentication request further carries an identity signature of the registration device, and the identity signature of the registration device is a signature generated by the registration device on the first authentication request and the first identity information by using a private key.

8 . The method according to claim 6 , wherein the identity information of the registration device comprises at least one of a digital certificate related to an identity of the registration device or a digest of the digital certificate related to the identity of the registration device.

9 . An identity authentication method, wherein the method is performed by an authorization device, the authorization device and a terminal device share a first symmetric key, the authorization device stores an ownership relationship record of the terminal device, the ownership relationship record describes a binding relationship between the terminal device and a current owner of the terminal device, and the method comprises:

receiving, by the authorization device, a first authentication request from a registration device, wherein the first authentication request carries a first authentication code, and the first authentication code is generated by the terminal device based on the first symmetric key;

verifying, by the authorization device, the first authentication code based on the first symmetric key and the ownership relationship record; and

sending, by the authorization device, to the registration device, a first authentication acknowledgement message after verification succeeds, wherein the first authentication acknowledgement message indicates to the registration device to authorize an ownership relationship between the terminal device and a network to which the registration device belongs, the first authentication acknowledgement message carries a second authentication code, the second authentication code is generated based on the first symmetric key, and the second authentication code indicates to the terminal device to determine, after verification on the second authentication code based on the first symmetric key succeeds, that bidirectional identity authentication of the terminal device and the registration device succeeds.

10 . The method according to claim 9 , wherein the second authentication request further carries a first identity (ID), a first key parameter, and first identity information, the first key parameter is generated by the terminal device, the first identity information comprises at least one of identity information of the registration device or identity information of the network to which the registration device belongs, the first ID is an ID configured by an original owner of the terminal device for the terminal device, and the ownership relationship record comprises a mapping relationship between the first ID and the first identity information;

after the receiving, by the authorization device, a second authentication request, the method further comprises:

verifying, by the authorization device, the first ID and the first identity information based on the ownership relationship record; and

the verifying, by the authorization device, the first authentication code based on the first symmetric key and the ownership relationship record comprises:

verifying, by the authorization device, the first authentication code based on the ownership relationship record, the first ID, the first symmetric key, and the first key parameter.