Method and device for authenticating based on authenticating device

An authenticating method based on an authenticating device includes: a client obtains an application ID according to an URI; requests a server for an authentication using the application ID and a user identification; receives current authenticating data from the server; obtains client data object using a challenge value in the current authenticating data; hashes the client data object and the application ID in the current authenticating data; obtains a key identification in the current authenticating data; sends current authentication request information including the client parameter, the key identification and key identification length to the authenticating device; receives authentication response information from the authenticating device; requests the server for a signature verification using the authentication response information, the client data object and a session ID in the current authenticating data; and the authentication is successful if information returned from the server indicates verification pass, or is failed if otherwise.