Identity verification

1. A computer-implemented method, comprising:

receiving, by a trusted server, from a first terminal, a first digital certificate of the first terminal, wherein the first digital certificate is issued by a certificate authority to the first terminal, the certificate authority being distinct from the trusted server;

verifying, based on the first digital certificate, an identity of the first terminal;

determining that the verification of the identity is a success;

based on determining that the verification of the identity is a success, determining, using a remote attestation protocol, that the first terminal is in a trusted state, the trusted state comprising that a running state of software of the first terminal conforms to an expected process;

based on determining that the first terminal is in the trusted state, adding a trusted identifier to the first digital certificate, to obtain a digital certificate,

wherein the trusted identifier is added to an extended field of the first digital certificate, such that existing information of the first digital certificate is not disturbed, and

wherein the trusted identifier indicates that the first terminal is in the trusted state; and

issuing the digital certificate comprising the trusted identifier to the first terminal, wherein the digital certificate is usable by a second terminal to verify the identity and the trusted state of the first terminal.

2. The computer-implemented method of claim 1 , further comprising:

prior to determining that the first terminal is in the trusted state, confirming, by the trusted server, that the first digital certificate is valid.

3. The computer-implemented method of claim 2 , wherein confirming that the first digital certificate is valid comprises at least one of:

verifying that a validity period of the first digital certificate is not expired, and

verifying that the first digital certificate is not included in a certificate authority revocation list of the certificate authority.

4. The computer-implemented method of claim 1 , wherein determining, using the remote attestation protocol, that the first terminal is in the trusted state comprises:

receiving, from the first terminal, a measurement value signed using a private key stored in a trusted computing chip configured in the first terminal;

comparing the measurement value with a reference value of the first terminal stored in the trusted server; and

determining, based on determining that the measurement value matches the reference value, that the first terminal is in the trusted state.

5. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

receiving, by a trusted server, from a first terminal, a first digital certificate of the first terminal, wherein the first digital certificate is issued by a certificate authority to the first terminal, the certificate authority being distinct from the trusted server;

verifying, based on the first digital certificate, an identity of the first terminal;

determining that the verification of the identity is a success;

based on determining that the verification of the identity is a success, determining, using a remote attestation protocol, that the first terminal is in a trusted state, the trusted state comprising that a running state of software of the first terminal conforms to an expected process;

based on determining that the first terminal is in the trusted state, adding a trusted identifier to the first digital certificate, to obtain a digital certificate,

wherein the trusted identifier is added to an extended field of the first digital certificate, such that existing information of the first digital certificate is not disturbed, and

wherein the trusted identifier indicates that the first terminal is in the trusted state; and

issuing the digital certificate comprising the trusted identifier to the first terminal, wherein the digital certificate is usable by a second terminal to verify the identity and the trusted state of the first terminal.

6. The computer-readable medium of claim 5 , wherein the operations further comprise:

prior to determining that the first terminal is in the trusted state, confirming, by the trusted server, that the first digital certificate is valid.

7. The computer-readable medium of claim 6 , wherein confirming that the first digital certificate is valid comprises at least one of:

verifying that a validity period of the first digital certificate is not expired, and

verifying that the first digital certificate is not included in a certificate authority revocation list of the certificate authority.

8. The computer-readable medium of claim 5 , wherein determining, using the remote attestation protocol, that the first terminal is in the trusted state comprises:

receiving, from the first terminal, a measurement value signed using a private key stored in a trusted computing chip configured in the first terminal;

comparing the measurement value with a reference value of the first terminal stored in the trusted server; and

determining, based on determining that the measurement value matches the reference value, that the first terminal is in the trusted state.

9. A computer-implemented system, comprising:

one or more computers; and

one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:

receiving, by a trusted server, from a first terminal, a first digital certificate of the first terminal, wherein the first digital certificate is issued by a certificate authority to the first terminal, the certificate authority being distinct from the trusted server;

verifying, based on the first digital certificate, an identity of the first terminal;

determining that the verification of the identity is a success;

based on determining that the verification of the identity is a success, determining, using a remote attestation protocol, that the first terminal is in a trusted state, the trusted state comprising that a running state of software of the first terminal conforms to an expected process;

based on determining that the first terminal is in the trusted state, adding a trusted identifier to the first digital certificate, to obtain a digital certificate,

wherein the trusted identifier is added to an extended field of the first digital certificate, such that existing information of the first digital certificate is not disturbed, and

wherein the trusted identifier indicates that the first terminal is in the trusted state; and

issuing the digital certificate comprising the trusted identifier to the first terminal, wherein the digital certificate is usable by a second terminal to verify the identity and the trusted state of the first terminal.

10. The computer-implemented system of claim 9 , wherein the operations further comprise:

prior to determining that the first terminal is in the trusted state, confirming, by the trusted server, that the first digital certificate is valid.

11. The computer-implemented system of claim 10 , wherein confirming that the first digital certificate is valid comprises at least one of:

verifying that a validity period of the first digital certificate is not expired, and

verifying that the first digital certificate is not included in a certificate authority revocation list of the certificate authority.

12. The computer-implemented system of claim 9 , wherein determining, using the remote attestation protocol, that the first terminal is in the trusted state comprises:

receiving, from the first terminal, a measurement value signed using a private key stored in a trusted computing chip configured in the first terminal;

comparing the measurement value with a reference value of the first terminal stored in the trusted server; and

determining, based on determining that the measurement value matches the reference value, that the first terminal is in the trusted state.

13. The computer-implemented method of claim 4 , wherein the trusted identifier comprises the reference value of the first terminal.