Abstract: A secure two-way authentication method and system are provided. In this method, a web front-end sends a request to control an android terminal to an SRS server. When receiving the request, the android terminal generates a key pair and encrypts a public key before sending it to the SRS server. After receiving the request again and a user agrees, an SP security chip generates a 32-bit random number as a control token and sends it to the SRS server. The server saves this random number and waits for an opcode. The web front-end obtains screen recording information and generates the opcode to send to the SRS server, the server encrypts it, and sends it together with the opcode to the android terminal. The android terminal uses the private key to decrypt data, verifies whether the random number is matched, and executes the opcode.