Account security operation processing method, system and device

Abstract

The invention relates to an account security operation processing method, which comprises the following steps: S1, establishing a face capacity shield and registering a background system, and applying data transmission of the background system for authentication; s2, acquiring face information of an account holder, performing face registration to generate registration information, and synchronizing a result to an application background system; and S3, the transaction is protected through the face capacity shield, the face capacity shield collects on-site face information of the operator to carry out living body recognition and verification, the face capacity shield generates transaction information and sends the transaction information to the application background system after the operator confirms the transaction information, and the application background system carries out verification and executes related operation and informs the client terminal of a transaction result. According to the invention, face information is not transmitted on line and is not stored in a terminal of a general operation system, so that the face information is strictly protected; the face acquisition process is carried out in a special customized safety device such as a face shield, and hackers cannot carry out attack and face video replacement like on a universal terminal; and the effect of confirming the practical operation of the person can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of authentication security technology, and in particular to an account security operation processing method, system and device. Background Art

[0002] With the development of the information industry and the Internet, more and more people have virtual assets in the digital world, and some even have more digital assets than physical assets. The security of digital assets is becoming more and more important. The premise of protecting the security of digital assets is to protect the security of the accounts that carry the assets.

[0003] Some typical problems caused by account security include: (1) How to recover a stolen account? (2) When authorizing the transfer of large amounts of assets within an account, how can we confirm that it is authorized by the account holder himself? (3) How to combat account buying and selling? However, the security of the account, the experience of using the account, and the cost of solving the account security are always difficult to reconcile. The fundamental solution to account security is to allow the account to return to the identity of the holder, and the account behavior is operated by the holder himself, and it can be resisted. We call it the account owner's actual operation solution. This plays a role in high security protection for the key operations of more important key accounts.

[0004] The solution to the account's actual operation needs to solve the following problems: (1) The account is operated by a real person, not a machine; (2) This real person is the account holder himself; (3) The account holder cannot deny the actual operation of the account after the fact; (4) Biometrics cannot be disclosed online; Biometric-based identity authentication, especially face recognition, has been widely used in recent years. However, the emergence of generative artificial intelligence has greatly reduced the cost of forging face videos and images, and face authentication faces huge challenges. In addition, the use of faces also faces the risk of face information being intercepted after being exposed online, which not only poses a further threat to authentication security, but also poses a challenge to personal privacy protection.

[0005] Face authentication is the process of identifying a person's facial features and then determining their identity. It is divided into two processes: face registration and face verification. Face registration refers to the process of storing the account holder's face or facial features as a face reference. Face verification refers to the process of comparing the face collected on site with the stored face reference to obtain a similarity score to determine whether the two faces are the same person.

[0006] The face registration process needs to solve the problem of having a benchmark account owner's face as a face reference. Due to the strict requirements of privacy protection, it is difficult for applications to obtain face photos from the public face identity library (a library that stores people's identity information and corresponding face photos). Therefore, the application needs to collect its own data and establish a corresponding relationship with the account holder.

[0007] Figure 1 This is a general process for face registration at present, including a camera 101 on the terminal side, application client software 102, and an application background system 103 and a face identity library 104 on the server side. In step S101, the account holder declares himself as the account holder and cooperates with the camera 101 to collect the face; in step S102, the camera 101 sends the face video stream data to the application client 102, and the client 102 can perform face liveness recognition according to its own capabilities, or let the application background system 103 perform face liveness recognition in the next step; in step S103, the customer sends the video data stream or face photo and identity information to the application background system 103; in step S104, the application background system 103 sends the face photo and identity information after liveness recognition to the face identity system 104 for face comparison; in step S105, the application background system 103 obtains the face comparison similarity score and determines whether it can be identified as the same person; if it is determined to be the same person, the application background system can use this collected photo as a face reference, and can calculate the benchmark face feature value based on this photo; if the subsequent face authentication calculation process is completed on the client, then in step S106, the face reference or its face feature value is sent to the application client. In the above process, since the face declared as the account holder needs to be confirmed through the face identity database first, the face needs to be collected through the terminal and transmitted on the network, which may be intercepted by malware. The collected face reference or its feature value also needs to be stored on the server or terminal side, which will also become a risk point for face information leakage.

[0008] Figure 2This is the general process of on-site face verification at present. It includes the camera 201 on the terminal side, the application client 202, and the application background system 203 on the server side. In step S201, the person claiming to be the account holder cooperates in collecting face information in front of the camera 201; in step S202, inside the terminal, the face video stream collected on site is sent from the camera 201 to the application client 202; if the application client 202 has the software and computing power of face recognition, as well as the face reference or its feature value, then the application client 202 can perform liveness recognition and face comparison on the face video stream collected on site, so as to determine whether the person in front of the camera 201 is the account holder; if the application client 202 does not have the software and computing power of face recognition, then in step S203, the above face video stream is sent to the application background system 203 for liveness recognition and face comparison; and in step S204, the authentication result is returned. In the above process, the path from the camera to the application client is not safe in the terminal of the general operating system. After hackers gain access to the underlying permissions of the operating system, they can replace the video stream with a face video generated by artificial intelligence. With the development of generative artificial intelligence, the probability of generating face video streams is getting lower and lower, while the cost of identifying them as generated rather than real shots is getting higher and higher.

[0009] Therefore, a method is needed to protect facial information and prevent attacks on facial authentication security through generative artificial intelligence, so that the account must be operated by the person himself and digital assets cannot be damaged due to account theft. Summary of the invention

[0010] The technical problem to be solved by the present invention is to design a method, system and device for processing account security operations, which uses a special registration and authentication process to perform high-intensity authentication to solve the problem that the account must be operated by the holder himself in key operations, thereby solving the existing technical problems.

[0011] In order to solve the above technical problems, the present invention provides an account security operation processing method, comprising the following steps: Step S1: Establish data transmission between the face shield and the registration background system for device authentication, and establish data transmission between the face shield and the application background system for transaction authentication.

[0012] Step S2: Collect the facial information of the account holder for facial registration, initiate a registration request to the registration background system through the client terminal and receive authentication information, after receiving the authentication information, Face Shield collects the user identity information PI and the facial information in the ID card through the account holder's ID card, and verifies it by collecting the on-site facial video information, Face Shield generates registration information REGINF, the client terminal obtains the registration information REGINF and sends it to the registration background system, the registration background system parses and verifies the registration information REGINF, after the verification is passed, the result is synchronized to the application background system, and Face Shield obtains the registration result.

[0013] Step S3: The transaction is protected by the facial shield. During the transaction, the client terminal initiates the transaction and sends the transaction information to the facial shield. The facial shield collects the operator's on-site facial information for liveness recognition and verification. The facial shield displays the transaction information. After the operator confirms, the facial shield generates transaction information TransactionINF and sends the transaction information TransactionINF to the application background system through the client terminal. The application background system verifies the transaction information TransactionINF and performs related operations, and notifies the client terminal of the transaction results.

[0014] Furthermore, in step S1, Face Shield generates a device public-private key pair DevicePubKey / DevicePriKey, a device serial number DeviceSN and a device random number Magic for each device at the factory stage, and sends the device public key DevicePubkey and the device serial number DeviceSN to the registration background system in a secure manner to form a list of legal devices for device authentication; the device random number Magic is sent to the application background system, and the application background system pre-generates a user privacy identity PIPrivacy based on the user identity information PI and the device random number Magic, and a one-to-one correspondence is formed between the user privacy identity PIPrivacy and the user's account AC, which is used for transaction authentication.

[0015] Furthermore, step S2 specifically includes the following steps: Step S21: The client terminal initiates a registration request to the registration background system; Step S22: the registration backend system sends a random number Nonce1 to the client terminal; Step S23: the client terminal sends Nonce1 to the Face Shield; Step S24: the Face Shield reads the ID card of the account holder through the NFC reading module to obtain the identity information PI and the face photo Face1 in the ID card; Step S25: Face Shield collects on-site facial video information through its built-in camera, and uses its built-in facial recognition engine to perform liveness recognition on the on-site facial information, and extracts the on-site portrait image Face2; then compares the on-site portrait image Face2 with the facial photo Face1 in the ID card read in step S24; if the similarity exceeds the judgment threshold X, it can be considered that they are the same person, and then the facial feature value FaceSample of the account holder is recorded in the security space of Face Shield; otherwise, the process is stopped and a prompt is given that the facial registration has failed; Step S26: the facial shield generates registration information REGINF, and sends the registration information REGINF to the client terminal via wired or wireless means, and the client terminal sends the registration information REGINF to the registration backend system; Step S27: the registration backend system parses the registration information REGINF and verifies it step by step, specifically: First, extract the device serial number DeviceSN and the device public key DevicePubkey to check whether it is in the list of legal devices, and verify the signature of the device private key DevicePrikey to verify the legitimacy of the device; if it is wrong, the process terminates; Then extract the user's public key UserPubkey and verify the correctness of the signature information of the user's private key UserPrikey; if there is an error, the process terminates; After the above verification is passed, the user's private identity PIPrivacy is extracted to check whether the user has registered before; if it is a repeated registration, the process is terminated; Step S28: The registration backend system synchronizes the user's privacy identity PIPrivacy, the user's public key UserPubkey and the corresponding relationship between the two to the application backend system, and sends the registration result to the client terminal; Step S29: The client terminal sends the registration result to the Face Shield to complete the registration.

[0016] Further, in step S26, the face shield generates a user authentication key pair UserPrikey / UserPubkey internally, wherein the user private key UserPrikey is built into the secure storage and operation area of ​​the face shield to generate user signature information; the face shield packages the random number Nounce1, the device serial number DeviceSN, the device public key DevicePubkey, the user privacy identity PIPrivacy, and the user public key UserPubkey, and signs the information with the device private key DevicePrikey and the user private key UserPrikey through the signature algorithm to form the registration information REGINF: Nounce1||DeviceSN||DevicePubkey||HMAC (PI||Magic)||UserPubkey|| (all the preceding fields)|| (all of the preceding fields).

[0017] Furthermore, in step S26, the facial shield transmits registration information REGINF via a USB interface or Bluetooth.

[0018] Furthermore, in step S26, the facial shield presents the registration information REGINF in the form of a QR code on the screen, and the client terminal obtains the registration information REGINF after scanning with a camera.

[0019] Furthermore, step S3 specifically includes the following steps: Step S31: The client terminal initiates a transaction and sends the transaction information to the Face Shield, where the transaction information includes the transaction object and transaction amount; Step S32: the face shield collects the operator's on-site facial information for liveness recognition, captures the face photo, and compares it with the face photo or feature value stored in the face shield; if the similarity is lower than the set threshold value Y, the transaction operation is stopped, otherwise the transaction operation is continued; Step S33: Face Shield displays the transaction information. After the operator confirms, Face Shield signs the transaction information using the user's private key UserPrikey to form transaction information TransactionINF: transaction information of transaction object and transaction amount||PIPrivacy||UserPubkey|| (all of the preceding fields); Step S34: the face shield sends the transaction information TransactionINF to the client terminal; Step S35: The client terminal sends the transaction information TransactionINF to the application backend system; Step S36: Verify using the backend system, specifically: The application backend system extracts the user's private identity PIPrivacy and user public key UserPubkey to check whether they are in the list of successfully registered users. If not, the transaction is terminated and failure is returned. The application backend system verifies the correctness of the signature information of the user's private key UserPrikey. If the verification fails, the transaction is terminated and a failure is returned. If the verification succeeds, the application backend system will execute the transaction with the user's private identity PIPrivacy corresponding account AC. Step S37: The application backend system notifies the client terminal of the transaction result.

[0020] The present invention also provides an account security operation processing system, which executes the above-mentioned account security operation processing method, including: The facial shield is used for data authentication with the registration backend system and the application backend system. It is used to collect account holder information and generate registration information REGINF during facial registration. It is used to collect the operator's on-site facial information for liveness recognition and verification during transactions and display transaction information. At the same time, it generates transaction information TransactionINF and sends the transaction information TransactionINF to the application backend system through the client terminal; The client terminal is used to initiate a registration request and receive authentication information when registering with the face, and send the obtained registration information REGINF to the registration backend system; initiate a transaction request and receive transaction information TransactionINF when conducting a transaction, and send the transaction information TransactionINF to the application backend system, and receive the transaction result of the application backend system; The registration backend system is used to respond to the registration request and send the random number Nonce1 when registering the face. After receiving the registration information REGINF, it will parse and verify it, establish the correspondence between the face shield, the user's privacy identity PIPrivacy and the user's public key UserPubkey, and synchronize the information to the application backend system; The application backend system is used to generate the user privacy identity PIPrivacy, receive the transaction information TransactionINF during the transaction, verify the transaction information TransactionINF and perform related operations, and notify the client terminal of the transaction results.

[0021] Furthermore, the facial shield includes a control unit, a camera, an NFC reading unit, a display unit, a communication unit and a button unit, and the camera, the NFC reading unit, the display unit, the communication unit and the button unit are electrically connected to the control unit respectively.

[0022] The present invention also provides an account security operation processing device, comprising: at least one processor; and at least one memory in communication with the processor; The memory stores instructions that can be executed by the processor, and the instructions are executed by the processor to enable the device to perform the aforementioned account security operation processing method.

[0023] Beneficial effects of the present invention: (1) From face registration to authentication, facial information is neither transmitted online nor stored in the terminal of the general operating system, thus achieving very strict protection of facial information.

[0024] (2) The facial collection process is carried out in a specially customized security device such as the Face Shield. Hackers cannot attack or replace facial videos like they do on general terminals (mobile phones, PADs, notebooks, PCs).

[0025] (3) The transaction is signed through the face shield, and the operator cannot deny the transaction after it is successful. This can effectively prevent the account holder from denying his or her illegal activities after buying and selling the account, and can be used to trace the responsibility afterwards, forming a deterrent to criminal acts through account buying and selling.

[0026] (4) Since the Face Shield can confirm that only the person himself can use it through liveness recognition and portrait authentication, it can achieve the effect of confirming the person's actual operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The specific implementation of the present invention will be further explained below in conjunction with the accompanying drawings.

[0028] Figure 1 This is a general flow chart of current face registration.

[0029] Figure 2 The figure is a general flow chart of current on-site face verification.

[0030] Figure 3 The present invention is a flowchart of the account security operation processing method.

[0031] Figure 4 A schematic diagram of collecting facial information of an account holder for face registration in the present invention.

[0032] Figure 5 This is a schematic diagram of using a facial shield to protect transactions in the present invention.

[0033] Figure 6 Schematic diagram of the facial shield in the present invention. DETAILED DESCRIPTION Example 1

[0034] Combination Figure 3 , Figure 4 and Figure 5 The account security operation processing method of this embodiment specifically includes the following steps: Step S1: Establish data transmission between the facial shield 301 and the registration background system 303 for device authentication, and establish data transmission between the facial shield 301 and the application background system 304 for transaction authentication.

[0035] Specifically, in this embodiment, the face shield 301 is a security device for identity registration and identification. Figure 6 As shown, the face shield 301 includes a control unit, a camera, an NFC reading unit, a display unit, a communication unit and a key unit, and the camera, the NFC reading unit, the display unit, the communication unit and the key unit are electrically connected to the control unit respectively. The control unit is an SE smart security chip; the camera is used to collect face information; the NFC reading unit is used to collect document information; the communication unit is used to transmit information with the client terminal 302, which can be a Bluetooth module or a USB interface module; the display unit is used for information display; and the key unit is used for interaction.

[0036] In this embodiment, preferably, in step S1, the face shield 301 generates a device public-private key pair DevicePubKey / DevicePriKey, a device serial number DeviceSN, and a device random number Magic for each device at the device factory stage, and sends the device public key DevicePubkey and the device serial number DeviceSN to the registration background system 303 in a secure manner to form a legal device list for device authentication; the device random number Magic is sent to the application background system 304. In the account activation stage, the user identity information PI (such as name, certificate number, etc.) has been bound to the user's account AC. In order to protect user privacy, the application background system 304 pre-generates the user privacy identity PIPrivacy based on the user identity information PI and the device random number Magic, and a one-to-one correspondence is formed between the user privacy identity PIPrivacy and the user's account AC, which is used for transaction authentication.

[0037] Specifically in this embodiment, the user privacy identity PIPrivacy=HMAC(PI||Magic).

[0038] Step S2: Collect the facial information of the account holder for facial registration, initiate a registration request to the registration background system 303 through the client terminal 302 and receive authentication information, after receiving the authentication information, the facial shield 301 collects the user identity information PI and the facial information in the ID card through the account holder's ID card, and verifies it by collecting the on-site facial video information, the facial shield 301 generates registration information REGINF, the client terminal 302 obtains the registration information REGINF and sends it to the registration background system 303, the registration background system 303 parses and verifies the registration information REGINF, and after the verification is passed, synchronizes the result to the application background system 304, and the facial shield 301 obtains the registration result.

[0039] In this embodiment, preferably, step S2 specifically includes the following steps: Step S21: the client terminal 302 initiates a registration request to the registration backend system 303 .

[0040] Step S22 : the registration backend system 303 sends a random number Nonce1 to the client terminal 302 .

[0041] Step S23: the client terminal 302 sends Nonce1 to the facial shield 301 .

[0042] Step S24: the face shield 301 reads the identity document of the account holder through the NFC reading module, and obtains the identity identification information PI (such as name, document number) and the face photo Face1 in the document.

[0043] Specifically in this embodiment, the identification document is a new type of document that includes identity information and a facial photo, such as an identification card, a passport, or other travel document.

[0044] Step S25: the Face Shield 301 collects on-site facial video information through its built-in camera, and uses the built-in facial recognition engine to perform liveness recognition on the on-site facial information, and extracts the on-site portrait image Face2; then the on-site portrait image Face2 is compared with the facial photo Face1 in the certificate read in step S24; if the similarity exceeds the judgment threshold X, it can be considered that they are the same person, and then the facial feature value FaceSample of the account holder is recorded in the security space of the Face Shield; otherwise, the process is stopped and a prompt is given that the facial registration has failed.

[0045] Step S26: the facial shield 301 generates registration information REGINF, and sends the registration information REGINF to the client terminal 302 via wired or wireless means, and the client terminal 302 sends the registration information REGINF to the registration background system 303.

[0046] In this embodiment, preferably, in step S26, the face shield 301 generates a user authentication key pair UserPrikey / UserPubkey, wherein the user private key UserPrikey is built into the secure storage and operation area of ​​the face shield 301 to generate user signature information; the face shield 301 packages the random number Nounce1, the device serial number DeviceSN, the device public key DevicePubkey, the user privacy identity PIPrivacy, and the user public key UserPubkey, and signs the information with the device private key DevicePrikey and the user private key UserPrikey through the signature algorithm to form the registration information REGINF: Nounce1||DeviceSN||DevicePubkey ||HMAC(PI||Magic)||UserPubkey|| (all the preceding fields)|| (all of the preceding fields).

[0047] The purpose of the registration information REGINF is to verify the legitimacy of the Face Shield 301 device and to bind the device, the user's personal identification, and the user's public key to the registration.

[0048] Preferably, in this embodiment, in step S26, the facial shield 301 transmits the registration information REGINF via a USB interface or Bluetooth.

[0049] Preferably, in this embodiment, in step S26, the facial shield 301 presents the registration information REGINF in the form of a QR code on the screen, and the client terminal 302 obtains the registration information REGINF by scanning with a camera.

[0050] Preferably, in this embodiment, in step S26, the facial shield 301 directly presents the registration information REGINF on the screen, and the client terminal 302 performs automatic content recognition after taking a photo with a camera, thereby acquiring the registration information REGINF.

[0051] Step S27: the registration backend system 303 parses the registration information REGINF and verifies it step by step, specifically: First, extract the device serial number DeviceSN and the device public key DevicePubkey to check whether it is in the list of legal devices, and verify the signature of the device private key DevicePrikey to verify the legitimacy of the device; if it is wrong, the process terminates; Then extract the user's public key UserPubkey and verify the correctness of the signature information of the user's private key UserPrikey; if there is an error, the process terminates; After the above verification is passed, the user's private identity PIPrivacy is extracted to check whether the user has registered before; if it is a repeated registration, the process is terminated to ensure the one-to-one binding relationship between the Face Shield 301 and the user, to avoid one person holding multiple Face Shields 301, thereby reducing the risk of illegal account trading.

[0052] After the above steps are successful, the registration background system 303 establishes the corresponding relationship between the device (Facial Shield 301), the user (PIPrivacy), and the user public key (UserPubkey).

[0053] Step S28: the registration backend system 303 synchronizes the user privacy identity PIPrivacy, the user public key UserPubkey and the corresponding relationship between the two to the application backend system 304, and sends the registration result to the client terminal 302.

[0054] Step S29: The client terminal 302 sends the registration result to the facial shield 301 to complete the registration.

[0055] Step S3: The transaction is protected by the facial shield 301. During the transaction, the client terminal 302 initiates the transaction and sends the transaction information to the facial shield 301. The facial shield 301 collects the operator's on-site facial information for liveness recognition and verification. The facial shield 301 displays the transaction information. After the operator confirms, the facial shield 301 generates transaction information TransactionINF and sends the transaction information TransactionINF to the application background system 304 through the client terminal 302. The application background system 304 verifies the transaction information TransactionINF and performs related operations, and notifies the client terminal 302 of the transaction results.

[0056] In this embodiment, preferably, step S3 specifically includes the following steps: Step S31: the client terminal 302 initiates a transaction and sends the transaction information to the facial shield 301, wherein the transaction information includes the transaction object and the transaction amount.

[0057] Step S32: the facial shield 301 collects the operator's on-site facial information for liveness recognition, captures the facial photo, and compares it with the facial photo or feature value stored in the facial shield 301; if the similarity is lower than the set threshold Y, the transaction operation is stopped, otherwise the transaction operation continues.

[0058] Step S33: The face shield 301 displays the transaction information. After the operator confirms, the face shield signs the transaction information using the user's private key UserPrikey to form transaction information TransactionINF: transaction information of the transaction object and transaction amount||PIPrivacy||UserPubkey|| (all of the preceding fields).

[0059] Step S34: the facial shield 301 sends the transaction information TransactionINF to the client terminal 302.

[0060] Step S35 : the client terminal 302 sends the transaction information TransactionINF to the application backend system 304 .

[0061] Step S36: Verify using the backend system 304, specifically: The application backend system 304 extracts the user's private identity PIPrivacy and the user's public key UserPubkey, and checks whether they are in the list of users who have successfully registered. If they are not in the list, the transaction is terminated and failure is returned; The application backend system 304 verifies the correctness of the signature information of the user's private key UserPrikey. If the verification fails, the transaction is terminated and a failure is returned. If the verification succeeds, the application backend system 304 executes the transaction with the user's privacy identity PIPrivacy corresponding to the account AC.

[0062] Step S37: the application backend system 304 notifies the client terminal 302 of the transaction result. Example 2

[0063] Combination Figure 4 and Figure 5 This embodiment relates to an account security operation processing system, which executes the account security operation processing method in embodiment 1, including: The facial shield 301 is used to perform data authentication with the registration background system 303 and the application background system 304. It is used to collect account holder information and generate registration information REGINF during facial registration. It is used to collect the operator's on-site facial information for liveness recognition and verification during transactions and display transaction information. At the same time, it generates transaction information TransactionINF and sends the transaction information TransactionINF to the application background system 304 through the client terminal 302.

[0064] The client terminal 302 is used to initiate a registration request and receive authentication information when registering facial features, and send the obtained registration information REGINF to the registration background system 303; initiate a transaction request and receive transaction information TransactionINF when conducting a transaction, and send the transaction information TransactionINF to the application background system 304, and receive the transaction result of the application background system 304.

[0065] The registration background system 303 is used to respond to the registration request and send the random number Nonce1 when registering the face, parse and verify after receiving the registration information REGINF, establish the correspondence between the face shield 301, the user's privacy identity PIPrivacy and the user's public key UserPubkey, and synchronize the information to the application background system 304.

[0066] The application backend system 304 is used to generate a user privacy identity PIPrivacy, receive transaction information TransactionINF during transactions, verify the transaction information TransactionINF and perform related operations, and notify the client terminal 302 of the transaction results.

[0067] Preferably, in this embodiment, the facial shield 301 includes a control unit, a camera, an NFC reading unit, a display unit, a communication unit and a button unit, and the camera, the NFC reading unit, the display unit, the communication unit and the button unit are electrically connected to the control unit respectively.

[0068] Specifically in this embodiment, the control unit is an SE smart security chip; the camera is used to collect facial information; the NFC reading unit is used to collect document information; the communication unit is used to transmit information with the client terminal 302, which can be a Bluetooth module or a USB interface module; the display unit is used for information display; and the button unit is used for interaction. Example 3

[0069] The account security operation processing device of this embodiment includes: at least one processor; and at least one memory in communication with the processor; The memory stores instructions that can be executed by the processor, and the instructions are executed by the processor to enable the device to perform the account security operation processing method in Example 1.

[0070] Many specific details are described in the above description to facilitate a full understanding of the present invention. However, the above description is only a preferred embodiment of the present invention. The present invention can be implemented in many other ways different from those described herein, so the present invention is not limited to the specific implementation disclosed above. At the same time, any person familiar with the art can make many possible changes and modifications to the technical solution of the present invention using the methods and technical contents disclosed above without departing from the scope of the technical solution of the present invention, or modify it into an equivalent embodiment of equivalent changes. Any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of protection of the technical solution of the present invention.

Claims

1. A method for processing account security operations, characterized in that: The steps include: Step S1: establishing data transmission between the facial shield (301) and the registration background system (303) for device authentication, and establishing data transmission between the facial shield (301) and the application background system (304) for transaction authentication; Step S2: Collect the facial information of the account holder for facial registration, initiate a registration request to the registration background system (303) through the client terminal (302) and receive authentication information, after receiving the authentication information, the facial shield (301) collects the user identity information PI and the facial information in the ID card through the identity card of the account holder, and verifies it by collecting the on-site facial video information, the facial shield (301) generates registration information REGINF, the client terminal (302) obtains the registration information REGINF and sends it to the registration background system (303), the registration background system (303) parses and verifies the registration information REGINF, after the verification is passed, the result is synchronized to the application background system (304), and the facial shield (301) obtains the registration result; Step S3: The transaction is protected by the facial shield (301). During the transaction, the client terminal (302) initiates the transaction and sends the transaction information to the facial shield (301). The facial shield (301) collects the operator's on-site facial information for liveness recognition and verification. The facial shield (301) displays the transaction information. After the operator confirms, the facial shield (301) generates transaction information TransactionINF and sends the transaction information TransactionINF to the application background system (304) through the client terminal (302). The application background system (304) verifies the transaction information TransactionINF and performs related operations, and notifies the client terminal (302) of the transaction result.

2. The account security operation processing method according to claim 1, characterized in that: In step S1, the facial shield (301) generates a device public-private key pair DevicePubKey / DevicePriKey, a device serial number DeviceSN and a device random number Magic for each device at the device factory stage, and sends the device public key DevicePubkey and the device serial number DeviceSN to the registration background system (303) in a secure manner to form a legal device list for device authentication; the device random number Magic is sent to the application background system (304), and the application background system (304) pre-generates a user privacy identity PIPrivacy based on the user identity information PI and the device random number Magic, and a one-to-one correspondence is formed between the user privacy identity PIPrivacy and the user's account AC, which is used for transaction authentication.

3. The account security operation processing method according to claim 1, characterized in that: Step S2 specifically includes the following steps: Step S21: The client terminal (302) initiates a registration request to the registration backend system (303); Step S22: the registration backend system (303) sends the random number Nonce1 to the client terminal (302); Step S23: The client terminal (302) sends Nonce1 to the Face Shield (301); Step S24: the face shield (301) reads the identity document of the account holder through the NFC reading module, and obtains the identity information PI and the face photo Face1 in the document; Step S25: the face shield (301) collects the on-site face video information through its built-in camera, and uses the built-in face recognition engine to perform liveness recognition on the on-site face information, and extracts the on-site portrait image Face2; then the on-site portrait image Face2 is compared with the face photo Face1 in the certificate read in step S24; if the similarity exceeds the judgment threshold X, it can be considered that they are the same person, and then the face feature value FaceSample of the account holder is recorded in the security space of the face shield; otherwise, the process is stopped and a prompt is given that the face registration fails; Step S26: the facial shield (301) generates registration information REGINF, and sends the registration information REGINF to the client terminal (302) via wired or wireless means, and the client terminal (302) sends the registration information REGINF to the registration background system (303); Step S27: The registration backend system (303) parses the registration information REGINF and verifies it step by step, specifically: First, extract the device serial number DeviceSN and the device public key DevicePubkey to check whether it is in the list of legal devices, and verify the signature of the device private key DevicePrikey to verify the legitimacy of the device; if it is wrong, the process terminates; Then extract the user's public key UserPubkey and verify the correctness of the signature information of the user's private key UserPrikey; if there is an error, the process terminates; After the above verification is passed, the user's private identity PIPrivacy is extracted to check whether the user has registered before; if it is a repeated registration, the process is terminated; Step S28: The registration backend system (303) synchronizes the user's privacy identity PIPrivacy, the user's public key UserPubkey and the corresponding relationship between the two to the application backend system (304), and sends the registration result to the client terminal (302); Step S29: The client terminal (302) sends the registration result to the Face Shield (301) to complete the registration.

4. The account security operation processing method according to claim 3, characterized in that: In step S26, the face shield (301) generates a user authentication key pair UserPrikey / UserPubkey internally, wherein the user private key UserPrikey is built into the secure storage and operation area of ​​the face shield (301) to generate user signature information; the face shield (301) packages the random number Nounce1, the device serial number DeviceSN, the device public key DevicePubkey, the user privacy identity PIPrivacy, and the user public key UserPubkey, and signs the information with the device private key DevicePrikey and the user private key UserPrikey through a signature algorithm to form the registration information REGINF: Nounce1||DeviceSN||DevicePubkey||HMAC (PI||Magic)||UserPubkey|| (all the preceding fields)|| (all of the preceding fields).

5. The account security operation processing method according to claim 3 is characterized in that: In step S26, the facial shield (301) transmits the registration information REGINF via a USB interface or Bluetooth.

6. The account security operation processing method according to claim 3 is characterized in that: In step S26, the facial shield (301) presents the registration information REGINF in the form of a QR code on the screen, and the client terminal (302) obtains the registration information REGINF by scanning with a camera.

7. The account security operation processing method according to claim 1, characterized in that: Step S3 specifically includes the following steps: Step S31: the client terminal (302) initiates a transaction and sends transaction information to the Face Shield (301), wherein the transaction information includes the transaction object and the transaction amount; Step S32: the facial shield (301) collects the operator's on-site facial information for liveness recognition, captures a facial photo, and compares it with the facial photo or feature value stored in the facial shield (301); if the similarity is lower than a set threshold value Y, the transaction operation is stopped, otherwise the transaction operation is continued; Step S33: The Face Shield (301) displays the transaction information. After the operator confirms, the Face Shield signs the transaction information using the user's private key UserPrikey to form transaction information TransactionINF: transaction information of the transaction object and transaction amount||PIPrivacy||UserPubkey|| (all of the preceding fields); Step S34: the facial shield (301) sends the transaction information TransactionINF to the client terminal (302); Step S35: the client terminal (302) sends the transaction information TransactionINF to the application backend system (304); Step S36: Verify using the backend system (304), specifically: The application backend system (304) extracts the user's private identity PIPrivacy and the user's public key UserPubkey, and checks whether they are in the list of users who have successfully registered. If they are not in the list, the transaction is terminated and failure is returned; The application backend system (304) verifies the correctness of the signature information of the user's private key UserPrikey. If the verification fails, the transaction is terminated and a failure is returned. If the verification succeeds, the application backend system (304) executes the transaction with the user's private identity PIPrivacy corresponding to the account AC. Step S37: The application backend system (304) notifies the client terminal (302) of the transaction result.

8. An account security operation processing system, characterized in that: The system executes the account security operation processing method according to any one of claims 1 to 7, including: The facial shield (301) is used to perform data authentication with the registration backend system (303) and the application backend system (304), to collect account holder information and generate registration information REGINF during facial registration, to collect operator's on-site facial information for liveness recognition and verification during transactions and to display transaction information, and to generate transaction information TransactionINF and send the transaction information TransactionINF to the application backend system (304) through the client terminal (302); The client terminal (302) is used to initiate a registration request and receive authentication information when registering face, and send the obtained registration information REGINF to the registration background system (303); initiate a transaction request and receive transaction information TransactionINF when conducting a transaction, and send the transaction information TransactionINF to the application background system (304), and receive the transaction result of the application background system (304); The registration backend system (303) is used to respond to the registration request and send the random number Nonce1 when registering the face, parse and verify the registration information REGINF after receiving it, establish the corresponding relationship between the face shield (301), the user's privacy identity PIPrivacy and the user's public key UserPubkey, and synchronize the information to the application backend system (304); The application backend system (304) is used to generate a user privacy identity PIPrivacy, receive transaction information TransactionINF during a transaction, verify the transaction information TransactionINF and perform related operations, and notify the client terminal (302) of the transaction result.

9. The account security operation processing system according to claim 8, characterized in that: The facial shield (301) comprises a control unit, a camera, an NFC reading unit, a display unit, a communication unit and a key unit, and the camera, the NFC reading unit, the display unit, the communication unit and the key unit are electrically connected to the control unit respectively.

10. An account security operation processing device, characterized in that: include: at least one processor; as well as at least one memory in communication with the processor; Wherein, the memory stores instructions executable by the processor, and the instructions are executed by the processor so that the device executes the account security operation processing method described in any one of claims 1-7.

Images