Biometric identity registration and authentication

1. A computer-implemented method, comprising:

receiving, at an authentication server and from a service server, a first authentication information request packet of a user equipment, wherein the first authentication information request packet includes a device identity of the user equipment;

obtaining, by the authentication server, a registered virtual account identity corresponding to the device identity;

encapsulating, by the authentication server, the registered virtual account identity into an authentication information response packet;

signing, by the authentication server, the authentication information response packet using an authentication server private key;

forwarding, by the authentication server through the service server, the authentication information response packet to the user equipment;

performing, by the user equipment, a first signature verification on the authentication information response packet using a registered authentication server public key, wherein the registered authentication server public key corresponds to the authentication server private key;

in response to a successful first signature verification, receiving, by the authentication server, from the user equipment through the service server, a second authentication request packet signed by the user equipment using a user equipment private key, wherein the second authentication request packet includes the device identity of the user equipment, the registered virtual account identity, and a biometric feature token, and wherein the second authentication request packet originates at the user equipment and provided to the authentication server through the service server;

verifying, by the authentication server, the second authentication request packet based on an authentication verification code and a time interval between the forwarding of the authentication information response packet and receiving the second authentication request packet;

obtaining, by the authentication server, a registered user equipment public key that corresponds to the user equipment private key and a registered biometric feature token corresponding to the device identity, the registered virtual account identity, and a biometric authentication type;

performing, by the authentication server, a second signature verification on the second authentication request packet using the registered user equipment public key; and

performing, by the authentication server, an identity authentication based on the biometric feature token in the second authentication request packet and the registered biometric feature token.

2. The computer-implemented method of claim 1 , wherein performing the identity authentication comprises performing a comparison of the biometric feature token included in the second authentication request packet and the registered biometric feature token.

3. The computer-implemented method of claim 1 , wherein a biometric identity of a user of the user equipment is authenticated if the second signature verification succeeds, and if the biometric feature token and the registered biometric feature token are determined to be identical.

4. The computer-implemented method of claim 1 , further comprising:

in response to an unsuccessful first signature verification, determining, by the user equipment, that the authentication server is not reliable.

5. The computer-implemented method of claim 1 , further comprising:

in response to an unsuccessful second signature verification, or in response to determining that the biometric feature token and the registered biometric feature token are different, determining, by the authentication server, the user equipment is not authenticated; and

sending, from the authentication server to the user equipment through the service server, an authentication failure result.

6. The computer-implemented method of claim 1 , further comprising:

determining, by the authentication server, that a biometric identity of a user of the user equipment is authenticated; and

sending, from the authentication server to the service server, a third authentication response packet, wherein the third authentication response packet comprises an identity authentication success result.

7. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

receiving, at an authentication server and from a service server, a first authentication information request packet of a user equipment, wherein the first authentication information request packet includes a device identity of the user equipment;

obtaining, by the authentication server, a registered virtual account identity corresponding to the device identity;

encapsulating, by the authentication server, the registered virtual account identity into an authentication information response packet;

signing, by the authentication server, the authentication information response packet using an authentication server private key;

forwarding, by the authentication server through the service server, the authentication information response packet to the user equipment;

performing, by the user equipment, a first signature verification on the authentication information response packet using a registered authentication server public key, wherein the registered authentication server public key corresponds to the authentication server private key;

in response to a successful first signature verification, receiving, by the authentication server, from the user equipment through the service server, a second authentication request packet signed by the user equipment using a user equipment private key, wherein the second authentication request packet includes the device identity of the user equipment, the registered virtual account identity, and a biometric feature token, and wherein the second authentication request packet originates at the user equipment and provided to the authentication server through the service server;

verifying, by the authentication server, the second authentication request packet based on an authentication verification code and a time interval between the forwarding of the authentication information response packet and receiving the second authentication request packet;

obtaining, by the authentication server, a registered user equipment public key that corresponds to the user equipment private key and a registered biometric feature token corresponding to the device identity, the registered virtual account identity, and a biometric authentication type;

performing, by the authentication server, a second signature verification on the second authentication request packet using the registered user equipment public key; and

performing, by the authentication server, an identity authentication based on the biometric feature token in the second authentication request packet and the registered biometric feature token.

8. The non-transitory, computer-readable medium of claim 7 , wherein performing the identity authentication comprises performing a comparison of the biometric feature token included in the second authentication request packet and the registered biometric feature token.

9. The non-transitory, computer-readable medium of claim 7 , wherein a biometric identity of a user of the user equipment is authenticated if the second signature verification succeeds, and if the biometric feature token and the registered biometric feature token are determined to be identical.

10. The non-transitory, computer-readable medium of claim 7 , the operations further comprises:

in response to an unsuccessful first signature verification, determining, by the user equipment, that the authentication server is not reliable.

11. The non-transitory, computer-readable medium of claim 7 , the operations further comprises:

in response to an unsuccessful second signature verification, or in response to determining that the biometric feature token and the registered biometric feature token are different, determining, by the authentication server, the user equipment is not authenticated; and

sending, from the authentication server to the user equipment through the service server, an authentication failure result.

12. The non-transitory, computer-readable medium of claim 7 , the operations further comprises:

determining, by the authentication server, that a biometric identity of a user of the user equipment is authenticated; and

sending, from the authentication server to the service server, a third authentication response packet, wherein the third authentication response packet comprises an identity authentication success result.

13. A computer-implemented system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:

receiving, at an authentication server and from a service server, a first authentication information request packet of a user equipment, wherein the first authentication information request packet includes a device identity of the user equipment;

obtaining, by the authentication server, a registered virtual account identity corresponding to the device identity;

encapsulating, by the authentication server, the registered virtual account identity into an authentication information response packet;

signing, by the authentication server, the authentication information response packet using an authentication server private key;

forwarding, by the authentication server through the service server, the authentication information response packet to the user equipment;

performing, by the user equipment, a first signature verification on the authentication information response packet using a registered authentication server public key, wherein the registered authentication server public key corresponds to the authentication server private key;

in response to a successful first signature verification, receiving, by the authentication server, from the user equipment through the service server, a second authentication request packet signed by the user equipment using a user equipment private key, wherein the second authentication request packet includes the device identity of the user equipment, the registered virtual account identity, and a biometric feature token, and wherein the second authentication request packet originates at the user equipment and provided to the authentication server through the service server;

verifying, by the authentication server, the second authentication request packet based on an authentication verification code and a time interval between the forwarding of the authentication information response packet and receiving the second authentication request packet;

obtaining, by the authentication server, a registered user equipment public key that corresponds to the user equipment private key and a registered biometric feature token corresponding to the device identity, the registered virtual account identity, and a biometric authentication type;

performing, by the authentication server, a second signature verification on the second authentication request packet using the registered user equipment public key; and

performing, by the authentication server, an identity authentication based on the biometric feature token in the second authentication request packet and the registered biometric feature token.

14. The computer-implemented system of claim 13 , wherein performing the identity authentication comprises performing a comparison of the biometric feature token included in the second authentication request packet and the registered biometric feature token.

15. The computer-implemented system of claim 13 , the operations further comprises:

in response to an unsuccessful first signature verification, determining, by the user equipment, that the authentication server is not reliable.

16. The computer-implemented system of claim 13 , the operations further comprises:

in response to an unsuccessful second signature verification, or in response to determining that the biometric feature token and the registered biometric feature token are different, determining, by the authentication server, the user equipment is not authenticated; and

sending, from the authentication server to the user equipment through the service server, an authentication failure result.

17. The computer-implemented system of claim 13 , the operations further comprises:

determining, by the authentication server, that a biometric identity of a user of the user equipment is authenticated; and

sending, from the authentication server to the service server, a third authentication response packet, wherein the third authentication response packet comprises an identity authentication success result.