Identity authentication method and device, storage medium and electronic equipment

Abstract

The invention discloses an identity authentication method and device, a storage medium and electronic equipment, and belongs to the technical field of information and network security. The to-be-authenticated user information comprises encryption information generated according to a first biological feature of a to-be-authenticated user, a first Ukey identifier written in a used Ukey, a first local symmetric key and a server encryption public key; extracting a first Ukey identifier, a first local symmetric key and a first biological feature from the encrypted information; taking the first Ukey identifier as an index, and respectively searching a second local symmetric key and an encrypted biological feature from a second local symmetric key library and an encrypted biological feature library; and according to the extracted first local symmetric key and the first biological feature, and the searched second local symmetric key and the encrypted biological feature, identity authentication is performed on the user to be authenticated, so that multi-level security protection can be provided in the identity authentication process, and the method is suitable for various complex network environments.

Description

Technical Field

[0001] The present application belongs to the field of information and network security technology, and in particular, relates to an identity authentication method, device, storage medium and electronic device. Background Art

[0002] As power transactions, bidding activities and interactions between power grid operators in power systems increasingly move online via the Internet, security issues for important data such as commercial data and user information generated in system transactions are becoming increasingly prominent.

[0003] To ensure the security of transaction data, public key infrastructure (PKI) is generally used for identity authentication. This process usually involves: the client inserts the Ukey to enter user information to log in to the business system, the business specialist uses the Ukey to encrypt and sign the data, and calls the Certificate Authority System (CA) for user identity authentication.

[0004] However, the existing identity authentication method cannot guarantee the security of key operations and cannot cope with the increasingly complex network environment. Therefore, the industry is in urgent need of a safe and reliable identity authentication method. Summary of the invention

[0005] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes an identity authentication method, device, storage medium and electronic device, which can realize safe and reliable identity authentication in various network environments.

[0006] In a first aspect, the present application provides an identity authentication method, applied to an identification server, comprising: Receive the user information to be authenticated sent by the client, where the user information to be authenticated includes encrypted information generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; Extracting the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; Using the extracted first Ukey identifier as an index, respectively searching for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users; The identity of the user to be authenticated is performed according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

[0007] In some embodiments, the user information to be authenticated also includes a signature data packet generated according to the first biometric feature and the signature key written in the Ukey, and before the extracted first Ukey identifier is used as an index to find the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric library of all registered users respectively, it also includes: Performing signature verification according to the signature data packet and the extracted first biometric feature; When the signature verification succeeds, the step of using the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric from the second local symmetric key library and encrypted biometric library of all registered users is performed.

[0008] In some embodiments, the signature data packet includes a signature public key and a user signature, and the performing signature verification according to the signature data packet and the extracted first biometric feature includes: Decrypt the user signature according to the signature public key to obtain a decrypted hash value; Calculating a hash value of the extracted first biometric feature; The signature verification result is determined based on a matching result between the calculated hash value and the decrypted hash value.

[0009] In some embodiments, the performing identity authentication on the user to be authenticated according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature, includes: Determine a target symmetric key according to the extracted first local symmetric key and the found second local symmetric key; Decrypting the found encrypted biometric feature according to the target symmetric key to obtain a second biometric feature of the corresponding registered user; An identity authentication result of the user to be authenticated is determined according to a matching result between the decrypted second biometric feature and the extracted first biometric feature.

[0010] In some embodiments, the identity authentication method further includes: Receive user registration information sent by the registration server, where the user registration information includes the biometrics of the user to be registered and the second Ukey identifier of the Ukey used; Generate a symmetric key for the user to be registered; According to the symmetric key, the biometrics and the second Ukey identifier of the user to be registered, the data in the second local symmetric key library, the encrypted biometrics library and the Ukey are updated to register the user to be registered.

[0011] In some embodiments, updating the data in the second local symmetric key library, the encrypted biometric library and the Ukey according to the symmetric key, the biometric and the second Ukey identification of the user to be registered includes: Encrypt the biometric feature according to the symmetric key to obtain the encrypted biometric feature of the user to be registered, and store the encrypted biometric feature in the encrypted biometric feature library with the second Ukey identifier as an index; Splitting the symmetric key into a first local symmetric key and a second local symmetric key, and storing the second local symmetric key in the second local symmetric key library using the second Ukey identifier as an index; The first local symmetric key is sent to the registration server so that the registration server writes the first local symmetric key into the Ukey.

[0012] In a second aspect, the present application provides an identity authentication method, applied to a client, comprising: Generate encryption information according to the first biometric feature of the user to be authenticated, the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; Generate user information to be authenticated according to the encrypted information; The user information to be authenticated is sent to an authentication server, so that the authentication server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users.

[0013] In some embodiments, the identity authentication method further includes: Sign the hash value of the first biometric feature according to the signature private key written in the Ukey to obtain a user signature; Generate a signature data packet according to the user signature and the signature public key written in the Ukey; The generating the user information to be authenticated according to the encrypted information includes: generating the user information to be authenticated according to the signature data packet and the encrypted information.

[0014] In some embodiments, the identity authentication method further includes: Collecting a facial image of the user to be authenticated; A facial feature is extracted from the facial image as a first biometric feature.

[0015] In a third aspect, the present application provides an identity authentication device, applied to an identification server, comprising: A receiving unit, configured to receive user information to be authenticated sent by a client, wherein the user information to be authenticated includes encrypted information generated according to a first biometric feature of the user to be authenticated and a first Ukey identifier written in the Ukey used, a first local symmetric key, and a server encryption public key; An extraction unit, configured to extract the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; A search unit, configured to use the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users respectively; An authentication unit is used to perform identity authentication on the user to be authenticated based on the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

[0016] In some embodiments, the user information to be authenticated further includes a signature data packet generated according to the first biometric feature and the signature key written in the Ukey, and the search unit is further used to: Performing signature verification according to the signature data packet and the extracted first biometric feature; When the signature verification succeeds, the step of using the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric from the second local symmetric key library and encrypted biometric library of all registered users is performed.

[0017] In some embodiments, the signature data packet includes a signature public key and a user signature, and the search unit is used to: Decrypt the user signature according to the signature public key to obtain a decrypted hash value; Calculating a hash value of the extracted first biometric feature; The signature verification result is determined based on a matching result between the calculated hash value and the decrypted hash value.

[0018] In some embodiments, the authentication unit is used to: Determine a target symmetric key according to the extracted first local symmetric key and the found second local symmetric key; Decrypting the found encrypted biometric feature according to the target symmetric key to obtain a second biometric feature of the corresponding registered user; An identity authentication result of the user to be authenticated is determined according to a matching result between the decrypted second biometric feature and the extracted first biometric feature.

[0019] In some embodiments, the identity authentication device further includes a registration unit, which is used to: Receive user registration information sent by the registration server, where the user registration information includes the biometrics of the user to be registered and the second Ukey identifier of the Ukey used; Generate a symmetric key for the user to be registered; According to the symmetric key, the biometrics and the second Ukey identifier of the user to be registered, the data in the second local symmetric key library, the encrypted biometrics library and the Ukey are updated to register the user to be registered.

[0020] In some embodiments, the registration unit is specifically used to: Encrypt the biometric feature according to the symmetric key to obtain the encrypted biometric feature of the user to be registered, and store the encrypted biometric feature in the encrypted biometric feature library with the second Ukey identifier as an index; Splitting the symmetric key into a first local symmetric key and a second local symmetric key, and storing the second local symmetric key in the second local symmetric key library using the second Ukey identifier as an index; The first local symmetric key is sent to the registration server so that the registration server writes the first local symmetric key into the Ukey.

[0021] In a fourth aspect, the present application provides an identity authentication device, applied to a client, comprising: The first generating unit is used to generate encryption information according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the used Ukey, the first local symmetric key and the server encryption public key; A second generating unit, used to generate user information to be authenticated according to the encrypted information; The sending unit is used to send the user information to be authenticated to the authentication server, so that the authentication server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users.

[0022] In some embodiments, the first generating unit is specifically configured to: Sign the hash value of the first biometric feature according to the signature private key written in the Ukey to obtain a user signature; Generate a signature data packet according to the user signature and the signature public key written in the Ukey; The second generating unit is specifically used to generate the user information to be authenticated according to the signature data packet and the encrypted information.

[0023] In some embodiments, the first generating unit is specifically configured to: Collecting a facial image of the user to be authenticated; A facial feature is extracted from the facial image as a first biometric feature.

[0024] In a fifth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the identity authentication method described in any one of the above items is implemented.

[0025] In a sixth aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-described identity authentication methods when executing the computer program.

[0026] In a seventh aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned identity authentication methods.

[0027] The identity authentication method, device, storage medium, electronic device and computer program product provided in the embodiments of the present application receive user information to be authenticated sent by a client, wherein the user information to be authenticated includes encrypted information generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the used Ukey, the first local symmetric key and the server-side encrypted public key; extract the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; use the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and the encrypted biometric feature from the second local symmetric key library and the encrypted biometric feature library of all registered users respectively; perform identity authentication on the user to be authenticated according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature, that is, combine the Ukey identifier, the user biometric feature, and various cryptographic means such as symmetric encryption, asymmetric encryption, and key splitting technology to realize user identity authentication, can provide multi-level security protection in the identity authentication process, is suitable for various complex network environments, and has strong authentication reliability and high security. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0029] Figure 1 It is a schematic diagram of the architecture of the identity authentication method provided in the embodiment of the present application; Figure 2 It is a flowchart of the identity authentication method provided in the embodiment of the present application; Figure 3 It is a schematic diagram of the architecture of the user registration process provided in the embodiment of the present application; Figure 4 It is a flowchart of another identity authentication method provided in an embodiment of the present application; Figure 5 is a schematic diagram of the structure of an identity authentication device provided in an embodiment of the present application; Figure 6 is a schematic diagram of the structure of another identity authentication device provided in an embodiment of the present application; Figure 7 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application; Figure 8 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0030] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0031] Embodiments of the present application provide an identity authentication method, device, electronic device, storage medium, and computer program product.

[0032] See also Figure 1 , Figure 1: This is a schematic diagram of the architecture of the identity authentication method provided in the embodiment of the present application. The identity authentication method is applied to a client and an authentication server (a server of an authentication system), and the client can be an independent client or an embedded sub-client integrated in a client (for example, a social client), without limitation. The authentication server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms.

[0033] Among them, the client can support the login services of multiple application systems, which include but are not limited to OA systems, bidding systems, financial systems, etc. When a user wants to log in to an application system (such as a bidding system) through the client to perform key business operations, the client needs to obtain the user's first biometric feature, which can be a facial feature. Specifically, the client first collects the user's facial image, and then extracts the facial feature from the facial image as the first biometric feature through algorithms such as Local Binary Pattern (LBP). After that, the client generates the user information to be authenticated based on the first biometric feature and the written data in the inserted Ukey (USB Key), and sends the user information to be authenticated to the authentication server for identity authentication. After the identity authentication is passed, the authentication server will issue an identity token to the client, and the user will log in to the system based on the identity token to perform key business operations.

[0034] See also Figure 2 , Figure 2 101 is a flowchart of an identity authentication method provided in an embodiment of the present application. The identity authentication method is applied to an identification server and includes the following steps 101-104, wherein: 101. Receive user information to be authenticated sent by a client, where the user information to be authenticated includes encrypted information generated according to a first biometric feature of the user to be authenticated and a first Ukey identifier written in the Ukey used, a first local symmetric key, and a server encryption public key.

[0035] Among them, the client can support the login services of multiple application systems, including but not limited to OA systems, bidding systems, financial systems, etc. When a user wants to log in to an application system (such as a bidding system) to perform key business operations, the client can first collect the user's first biometric feature and pass it to Ukey, and generate the user information to be authenticated inside Ukey based on the first biometric feature and the data written in Ukey, and send it to the authentication server for identity authentication.

[0036] Different application systems can set different server-side encryption public keys and store them in Ukey, while the encryption private keys corresponding to each encryption public key are stored on the server side. The encrypted information can be obtained by the client using the server-side encryption public key and an asymmetric encryption algorithm such as the SM2 public key encryption algorithm to encrypt the first biometric feature, the first Ukey identifier and the first local symmetric key. The first Ukey identifier can be the serial number (SN) of the Ukey, which is the unique identifier of the Ukey and is used to distinguish and identify different Ukeys. The first local symmetric key here (which can be recorded as image_sym_key_1') is a partial symmetric key stored in the Ukey after the target symmetric key (which can be recorded as image_sym_key') is split.

[0037] The first biometric feature mainly refers to the physiological or behavioral characteristics inherent in the human body, which can be facial features, fingerprint features, iris features, palm vein features, sound features, or a combination of these features, etc., and there is no restriction here. For example, the client can collect the user's facial image and pre-process the collected image to remove the noise caused by factors such as expression, brightness, light, color, etc., to generate the most close to the user's actual facial image. Then, the local binary pattern (LBP) and other algorithms are used to extract facial features from the facial image as the first biometric feature. Before collecting the facial image, the client can also perform liveness detection on the user, and verify the authenticity of the user by prompting the user to shake his head, nod, open his mouth, blink, etc., so as to improve the reliability of identity authentication.

[0038] 102. Extract a first Ukey identifier, a first local symmetric key, and a first biometric feature from the encrypted information.

[0039] The authentication server can decrypt the encrypted information through a universal / cooperative cryptographic machine, and various keys can be stored in the cryptographic machine. When different application systems set different server-side encryption public keys, the private keys corresponding to each public key are stored in the cryptographic machine. The authentication server forwards the received encrypted information to the cryptographic machine, which decrypts the encrypted information using the private key of the corresponding public key to extract the first Ukey identifier, the first local symmetric key image_sym_key_1' and the first biometric feature.

[0040] In some embodiments, in addition to the above-mentioned encrypted information, the identity information to be authenticated also includes a signature data packet generated according to the first biometric feature and the signature key written in Ukey. In this case, before executing the following step 103, the identity authentication method also includes: Performing signature verification according to the signature data packet and the extracted first biometric feature; When the signature verification succeeds, the following step 103 is executed.

[0041] The written data in Ukey also includes the user's signature public key and signature private key (i.e., signature key). When the client collects the user's first biometric feature, the signature private key can be used to sign the hash value of the first biometric feature, and the user signature, signature public key and the above encrypted information are sent to the authentication server. The authentication server performs signature verification based on the signature public key, user signature, and the first biometric feature decrypted from the encrypted information.

[0042] The signature key is usually stored in the digital certificate of Ukey, which is applied by the user to the Certificate Authority (CA). The CA will verify the identity of the user, bind the user's public key with the identity information, generate a digital certificate and issue it to the user. By introducing signature verification, the sender's identity can be confirmed and the data can be ensured not to be tampered with or replaced during transmission to the authentication server, ensuring the authenticity and integrity of information transmission and improving the security and reliability of identity authentication.

[0043] Furthermore, the signature data packet includes a signature public key and a user signature, and the above step of "performing signature verification according to the signature data packet and the extracted first biometric feature" may specifically include: Decrypt the user's signature according to the signature public key to obtain the decrypted hash value; Calculating a hash value of the extracted first biometric feature; The signature verification result is determined based on the match between the calculated hash value and the decrypted hash value.

[0044] Among them, when performing signature verification, the cipher machine uses the signature public key in the signature data packet to decrypt the user's signature to obtain a hash value, and performs hash calculation on the first biometric feature decrypted from the encrypted information to obtain another hash value. If the two hash values ​​are the same, the signature verification is successful, otherwise the signature verification fails.

[0045] 103. Using the extracted first Ukey identifier as an index, respectively search for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users.

[0046] Among them, the second local symmetric key database and the encrypted biometric database are two databases created by the authentication server for registered users. Each time a new user registers, the authentication server will update the two databases according to the information of the new user.

[0047] 104. Perform identity authentication on the user to be authenticated based on the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

[0048] In some embodiments, the above step 104 specifically includes: Determine a target symmetric key according to the extracted first local symmetric key and the found second local symmetric key; Decrypting the found encrypted biometric feature according to the target symmetric key to obtain a second biometric feature of the corresponding registered user; The identity authentication result of the user to be authenticated is determined according to the matching result between the decrypted second biometric feature and the extracted first biometric feature.

[0049] Among them, the general / collaborative cipher adopts the technology corresponding to the key splitting technology to merge the keys, such as using Shamir threshold technology to merge the extracted first local symmetric key image_sym_key_1' and the found second local symmetric key (which can be recorded as image_sym_key_2') into the target symmetric key image_sym_key'. Shamir threshold technology is a key splitting technology in cryptography, which allows the key to be split into multiple parts, and the complete key can only be reconstructed when there are enough parts.

[0050] Then, the cipher machine uses the combined image_sym_key' to decrypt the encrypted biometric into the second biometric, and compares the first biometric with the second biometric for similarity. If the comparison value is greater than the set threshold, the user to be authenticated is considered a registered user and the identity authentication is successful. Otherwise, the user is an unknown user and the identity authentication fails. When the identity authentication is successful, the identification system can further issue an identity token to the user so that the authenticated user can log in to the business system to perform key business operations. At the same time, the user does not need to perform identity authentication again within a certain period of time.

[0051] It should be pointed out that the identity authentication method in the embodiment of the present application combines multiple cryptographic methods such as symmetric encryption, asymmetric encryption, key splitting technology, and introduces user biometrics and Ukey identification, so as to provide multi-level security protection in the identity authentication process. For example, using the Ukey identification as an index can ensure that each user's key and biometric data can be uniquely identified and accurately extracted; splitting the key into two parts, and storing and transmitting it locally can enhance the storage and transmission security of the key. Even if one of the keys is leaked, the attacker cannot use it alone to decrypt the biometric data, which increases the security and complexity of key management and improves the ability to resist attacks; the biometrics are stored in ciphertext form. Even if the biometric database is hacked, unauthorized parties cannot directly access the user's original biometrics. This method effectively protects the user's privacy. In addition, when a new user registers, the data in the second local symmetric key library and the encrypted biometric library need to be updated accordingly, that is, the identity authentication method also includes: Receive user registration information sent by the registration server, where the user registration information includes the biometrics of the user to be registered and the second Ukey identifier of the Ukey used; Generate a symmetric key for the user to be registered; According to the symmetric key, biometrics and second Ukey identification of the user to be registered, the data in the second local symmetric key library, the encrypted biometrics library and the Ukey are updated to register the user to be registered.

[0052] Among them, see Figure 3 , Figure 3 It is a schematic diagram of the architecture of the user registration process provided by the embodiment of the present application. The registration center (registration server) supports user registration of multiple application systems. The registration center and the CA system, as well as the CA system and the authentication server can communicate encrypted through digital envelope technology. When a user registers through the client, the registration center needs to collect clearer and more accurate biometric features of the user. For example, if the biometric feature is a facial feature, a good collection environment needs to be built, including a high-definition camera, the position of the face and the high-definition camera, no obstruction to the face, and natural light as much as possible. In this collection environment, a standard face image is collected, and the LBP algorithm is used to extract the face features from the face image as the biometric features of the user to be registered. Then, the biometric feature and the Ukey identifier (serial number) of the Ukey used by the user are transmitted to the CA system using digital envelope technology.

[0053] Next, the CA system uses digital envelope technology to send the received biometrics and user information such as the Ukey identifier to the authentication system. The authentication system uses a universal / collaborative cipher machine to generate a symmetric key (the symmetric key is used for both encrypting and decrypting data) and updates the second local symmetric key library and encrypted biometric library based on the symmetric key and the received user information.

[0054] Furthermore, the above step of “updating the data in the second local symmetric key library, the encrypted biometric library and the Ukey according to the symmetric key, biometrics and second Ukey identification of the user to be registered” specifically includes: Encrypt the biometric feature according to the symmetric key to obtain an encrypted biometric feature of the user to be registered, and store the encrypted biometric feature in an encrypted biometric feature database using the second Ukey identifier as an index; Splitting the symmetric key into a first local symmetric key and a second local symmetric key, and storing the second local symmetric key in a second local symmetric key library using the second Ukey identifier as an index; The first local symmetric key is sent to the registration server so that the registration server writes the first local symmetric key into the Ukey.

[0055] For example, a general / collaborative cryptographic machine can generate a symmetric key for each user to be registered, and use it to encrypt the biometric features of the user to be registered to obtain encrypted biometric features, and then use key splitting techniques such as Shamir threshold technology to divide the symmetric key of the user to be registered into two parts: a first local symmetric key and a second local symmetric key.

[0056] Then, one of the keys (the second local symmetric key) is stored and managed in the second local symmetric key library of the cipher machine with the second Ukey identifier as the index, and the encrypted biometric is stored and managed in the biometric library with the second Ukey identifier as the index. At the same time, the universal / collaborative cipher machine will send another key (the first local symmetric key) to the CA system through the digital envelope technology, and the first local symmetric key will be sent to the registration center through the CA system. The registration center will write the first local symmetric key into the Ukey of the user to be registered, and issue the Ukey to the user to be registered, thus completing the entire user registration process.

[0057] As can be seen from the above, the identity authentication method provided in the embodiment of the present application is applied to the identification server, by receiving the user information to be authenticated sent by the client, the user information to be authenticated includes the encrypted information generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used, the first local symmetric key and the server-side encrypted public key; extracting the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; using the extracted first Ukey identifier as an index, respectively searching for the corresponding second local symmetric key and the encrypted biometric feature from the second local symmetric key library and the encrypted biometric library of all registered users; according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature, the user to be authenticated is authenticated, that is, combining the Ukey identifier, the user biometric feature, and symmetric encryption, asymmetric encryption, key splitting technology and other cryptographic means to realize user identity authentication, which can provide multi-level security protection in the identity authentication process, is suitable for various complex network environments, and has strong authentication reliability and high security.

[0058] According to the method described in the above embodiment, the present application embodiment also provides another identity authentication method. Figure 4 , Figure 4 201 is a flowchart of another identity authentication method provided in an embodiment of the present application. The identity authentication method is applied to a client and includes the following steps 201-203, wherein: 201. Generate encryption information according to the first biometric feature of the user to be authenticated, the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key.

[0059] The encrypted information may be obtained by encrypting the first biometric feature, the first Ukey identifier and the first local symmetric key image_sym_key_1' of the authenticated user using an asymmetric encryption algorithm such as the SM2 public key encryption algorithm by the client using the server encryption public key.

[0060] Different application systems can set different server-side encryption public keys and store them in Ukey, while the encryption private keys corresponding to each encryption public key are stored on the server side. The first Ukey identifier can be the serial number of the Ukey, which is the unique identifier of the Ukey and is used to distinguish and identify different Ukeys. The first local symmetric key here (which can be recorded as image_sym_key_1') is the partial symmetric key stored in Ukey after splitting the target symmetric key (which can be recorded as image_sym_key') generated by the cipher machine.

[0061] Specifically, when a user wants to log in to an application system through a client to perform key business operations, the authentication server will authenticate the user. At this time, the client needs to collect the user's first biometric feature. The first biometric feature mainly refers to the physiological or behavioral characteristics inherent in the human body, which can be facial features, fingerprint features, iris features, palm vein features, voice features, or a combination of these features, etc., and there is no limitation here.

[0062] In some embodiments, when the first biometric feature is a facial feature, step 201 includes: Collecting facial images of users to be authenticated; A facial feature is extracted from the facial image as a first biometric feature.

[0063] That is, the client can collect the user's face image and pre-process the collected image to remove the noise caused by factors such as expression, brightness, light, color, etc., to generate the face image that is closest to the user. Then, the LBP algorithm is used to extract the face features from the face image as the first biometric feature of the user to be authenticated.

[0064] In some embodiments, before collecting facial images, the client may also perform liveness detection on the user, and verify the authenticity of the user by prompting the user to shake his head, nod, open his mouth, blink, etc., so as to improve the reliability of identity authentication.

[0065] 202. Generate user information to be authenticated according to the encrypted information.

[0066] The encrypted information may be used as the user information to be authenticated, or the encrypted information and signature-related information may be used together as the user information to be authenticated.

[0067] In some embodiments, the identity authentication method further includes: Sign the hash value of the first biometric feature according to the signature private key written in the Ukey to obtain a user signature; Generate a signature data packet based on the user's signature and the signature public key written in the Ukey; At this time, the above step 203 includes: generating the user information to be authenticated according to the signature data packet and the encrypted information.

[0068] The written data in Ukey also includes the user's signature public key and signature private key (i.e., signature key). When the client collects the first biometric feature of the user to be authenticated, the signature private key can be used to sign the hash value of the first biometric feature, and the user signature, signature public key and the above encrypted information are sent to the authentication server. The authentication server performs signature verification based on the signature public key, user signature, and the first biometric feature decrypted from the encrypted information.

[0069] 203. Send the user information to be authenticated to the authentication server, so that the authentication server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users.

[0070] Among them, the authentication server will first decrypt and extract the first biometric feature, the first Ukey identifier and the first local symmetric key image_sym_key_1' from the user information to be authenticated, and perform signature verification on the user signature. If the verification passes, the first Ukey identifier is used as an index to find the corresponding second local symmetric key (which can be recorded as image_sym_key_2') in the second local symmetric key library of all registered users, and find the corresponding encrypted biometric feature in the encrypted biometric library. Then, the decrypted image_sym_key_1' and the found image_sym_key_2' are merged, and the merged key is used to decrypt the found encrypted biometric feature to obtain the original second biometric feature. Then, the user's identity authentication result is confirmed by comparing the similarity between the first biometric feature and the second biometric feature.

[0071] From the above, it can be seen that the identity authentication method provided in the embodiment of the present application is applied to the client, and encrypted information is generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used by the user to be authenticated, the first local symmetric key and the server-side encrypted public key; the user information to be authenticated is generated according to the encrypted information; the user information to be authenticated is sent to the identification server, so that the identification server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users, that is, user identity authentication is realized by combining Ukey identifier, user biometrics, and symmetric encryption, asymmetric encryption, key splitting technology and other cryptographic means, which can provide multi-level security protection in the identity authentication process, is suitable for various complex network environments, and has strong authentication reliability and high security.

[0072] According to the method described in the above embodiment, the present application embodiment also provides an identity authentication device for executing the steps in the identity authentication method applied to the authentication server. Figure 5 , Figure 5 300 is a schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application. The identity authentication device 300 is applied to the authentication server, and the above-mentioned identity authentication method can be implemented by the functional module or functional entity in the authentication server. Specifically, the identity authentication device 300 includes a receiving unit 301, an extraction unit 302, a search unit 303 and an authentication unit 304, wherein: The receiving unit 301 is used to receive the user information to be authenticated sent by the client, where the user information to be authenticated includes encrypted information generated according to the first biometric feature of the user to be authenticated, the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; An extraction unit 302 is used to extract the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; A search unit 303 is used to use the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users respectively; The authentication unit 304 is used to perform identity authentication on the user to be authenticated according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

[0073] In some embodiments, the user information to be authenticated also includes a signature data packet generated according to the first biometric feature and the signature key written in the Ukey, and the search unit 303 is further used to: Performing signature verification according to the signature data packet and the extracted first biometric feature; When the signature verification succeeds, the step of using the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric from the second local symmetric key library and encrypted biometric library of all registered users is executed.

[0074] In some embodiments, the signature data packet includes a signature public key and a user signature, and the search unit 303 is used to: Decrypt the user's signature according to the signature public key to obtain the decrypted hash value; Calculating a hash value of the extracted first biometric feature; The signature verification result is determined based on the match between the calculated hash value and the decrypted hash value.

[0075] In some embodiments, the authentication unit 304 is used to: Determine a target symmetric key according to the extracted first local symmetric key and the found second local symmetric key; Decrypting the found encrypted biometric feature according to the target symmetric key to obtain a second biometric feature of the corresponding registered user; The identity authentication result of the user to be authenticated is determined according to the matching result between the decrypted second biometric feature and the extracted first biometric feature.

[0076] In some embodiments, the identity authentication device 300 further includes a registration unit, which is used to: Receive user registration information sent by the registration server, where the user registration information includes the biometrics of the user to be registered and the second Ukey identifier of the Ukey used; Generate a symmetric key for the user to be registered; According to the symmetric key of the user to be registered, the biometric feature and the second Ukey identifier, the data in the second local symmetric key library, the encrypted biometric feature library and the Ukey are updated to register the user to be registered.

[0077] In some embodiments, the registration unit is specifically used to: Encrypt the biometric feature according to the symmetric key to obtain the encrypted biometric feature of the user to be registered, and store the encrypted biometric feature in the encrypted biometric feature database using the second Ukey identifier as an index; Splitting the symmetric key into a first local symmetric key and a second local symmetric key, and storing the second local symmetric key in the second local symmetric key library using the second Ukey identifier as an index; The first local symmetric key is sent to the registration server so that the registration server writes the first local symmetric key into the Ukey.

[0078] It should be noted that the specific details of each module unit in the above-mentioned identity authentication device 300 have been described in detail in the embodiment of the above-mentioned identity authentication method, and will not be repeated here.

[0079] As can be seen from the above, the identity authentication device 300 provided in the embodiment of the present application is applied to the identification server, and receives the user information to be authenticated sent by the client through the receiving unit 301, and the user information to be authenticated includes the encrypted information generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; the extraction unit 302 extracts the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; the search unit 303 uses the extracted first Ukey identifier as an index to find the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and the encrypted biometric library of all registered users respectively; the authentication unit 304 performs identity authentication on the user to be authenticated according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and encrypted biometric feature, that is, combining the Ukey identifier, the user biometric feature, and symmetric encryption, asymmetric encryption, key splitting technology and other cryptographic means to realize user identity authentication, which can provide multi-level security protection in the identity authentication process, is suitable for various complex network environments, and has strong authentication reliability and high security.

[0080] According to the method described in the above embodiment, the present application embodiment also provides an identity authentication device for executing the steps in the above identity authentication method applied to the client. Figure 6 , Figure 6 400 is a schematic diagram of the structure of another identity authentication device provided in an embodiment of the present application. The identity authentication device 400 is applied to a client, and the above-mentioned identity authentication method can be implemented by a functional module or functional entity in the client. Specifically, the identity authentication device 400 includes a first generation unit 401, a second generation unit 402 and a sending unit 403, wherein: The first generating unit 401 is used to generate encryption information according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the used Ukey, the first local symmetric key and the server encryption public key; The second generating unit 402 is used to generate the user information to be authenticated according to the encrypted information; The sending unit 403 is used to send the user information to be authenticated to the authentication server, so that the authentication server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users.

[0081] In some embodiments, the first generating unit 401 is specifically used for: Sign the hash value of the first biometric feature according to the signature private key written in the Ukey to obtain a user signature; Generate a signature data packet based on the user's signature and the signature public key written in the Ukey; The second generating unit 402 is specifically used to generate the user information to be authenticated according to the signature data packet and the encrypted information.

[0082] In some embodiments, the first generating unit 401 is specifically used for: Collecting facial images of users to be authenticated; A facial feature is extracted from the facial image as a first biometric feature.

[0083] It should be noted that the specific details of each module unit in the above-mentioned identity authentication device 400 have been described in detail in the embodiment of the above-mentioned identity authentication method, and will not be repeated here.

[0084] From the above, it can be seen that the identity authentication device 400 provided in the embodiment of the present application is applied to the client, and the first generation unit 401 generates encryption information according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used, the first local symmetric key and the server-side encryption public key; the second generation unit 402 generates the user information to be authenticated according to the encrypted information; the sending unit 403 sends the user information to be authenticated to the identification server, so that the identification server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users, that is, combining the Ukey identifier, user biometrics, and symmetric encryption, asymmetric encryption, key splitting technology and other cryptographic means to realize user identity authentication, which can provide multi-level security protection in the identity authentication process, is suitable for various complex network environments, and has strong authentication reliability and high security.

[0085] The identity authentication device in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc. It can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0086] In some embodiments, Figure 7 As shown, an embodiment of the present application also provides an electronic device 500, including a processor 501, a memory 502, and a computer program stored in the memory 502 and executable on the processor 501. When the program is executed by the processor 501, each process of the above-mentioned identity authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0087] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0088] Figure 8 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0089] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610 and other components.

[0090] Those skilled in the art will appreciate that the electronic device 600 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 610 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Figure 8 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0091] The processor 610 is used for: Receive the user information to be authenticated sent by the client, where the user information to be authenticated includes encrypted information generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; Extracting the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; Using the extracted first Ukey identifier as an index, respectively search for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users; The identity of the user to be authenticated is authenticated according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

[0092] In some embodiments, the user information to be authenticated also includes a signature data packet generated according to the first biometric feature and the signature key written in the Ukey. Before using the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric library of all registered users, the processor 610 is further used to: Performing signature verification according to the signature data packet and the extracted first biometric feature; When the signature verification succeeds, the step of using the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric from the second local symmetric key library and encrypted biometric library of all registered users is executed.

[0093] In some embodiments, the signature data packet includes a signature public key and a user signature, and the processor 610 is configured to: Decrypt the user's signature according to the signature public key to obtain the decrypted hash value; Calculating a hash value of the extracted first biometric feature; The signature verification result is determined based on the match between the calculated hash value and the decrypted hash value.

[0094] In some embodiments, the processor 610 is configured to: Determine a target symmetric key according to the extracted first local symmetric key and the found second local symmetric key; Decrypting the found encrypted biometric feature according to the target symmetric key to obtain a second biometric feature of the corresponding registered user; The identity authentication result of the user to be authenticated is determined according to the matching result between the decrypted second biometric feature and the extracted first biometric feature.

[0095] In some embodiments, the processor 610 is further configured to: Receive user registration information sent by the registration server, where the user registration information includes the biometrics of the user to be registered and the second Ukey identifier of the Ukey used; Generate a symmetric key for the user to be registered; According to the symmetric key of the user to be registered, the biometric feature and the second Ukey identifier, the data in the second local symmetric key library, the encrypted biometric feature library and the Ukey are updated to register the user to be registered.

[0096] In some embodiments, the processor 610 is configured to: Encrypt the biometric feature according to the symmetric key to obtain the encrypted biometric feature of the user to be registered, and store the encrypted biometric feature in the encrypted biometric feature database using the second Ukey identifier as an index; Splitting the symmetric key into a first local symmetric key and a second local symmetric key, and storing the second local symmetric key in the second local symmetric key library using the second Ukey identifier as an index; The first local symmetric key is sent to the registration server so that the registration server writes the first local symmetric key into the Ukey.

[0097] It should be understood that in the embodiment of the present application, the input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 606 may include a display panel 6061, and the display panel 6061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 607 includes a touch panel 6071 and at least one of other input devices 6072. The touch panel 6071 is also called a touch screen. The touch panel 6071 may include two parts: a touch detection device and a touch controller. Other input devices 6072 may include, but are not limited to, a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0098] The memory 609 can be used to store software programs and various data. The memory 609 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 609 may include a volatile memory or a non-volatile memory, or the memory 609 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 609 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0099] The processor 610 may include one or more processing units; the processor 610 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 610.

[0100] An embodiment of the present application also provides a chip, which includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the above-mentioned identity authentication method.

[0101] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned identity authentication method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0102] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0103] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned identity authentication method when executed by a processor.

[0104] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0105] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0106] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0107] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0108] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0109] In the description of the present application, “plurality” means two or more.

[0110] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0111] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. An identity authentication method, characterized in that: Applicable to authentication servers, including: Receive the user information to be authenticated sent by the client, where the user information to be authenticated includes encrypted information generated according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; Extracting the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; Using the extracted first Ukey identifier as an index, respectively searching for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users; The identity of the user to be authenticated is performed according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

2. The identity authentication method according to claim 1, characterized in that: The user information to be authenticated also includes a signature data packet generated according to the first biometric feature and the signature key written in the Ukey, and before the corresponding second local symmetric key and encrypted biometric feature are respectively searched from the second local symmetric key library and encrypted biometric feature library of all registered users with the extracted first Ukey identifier as an index, it also includes: Performing signature verification according to the signature data packet and the extracted first biometric feature; When the signature verification succeeds, the step of using the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric from the second local symmetric key library and encrypted biometric library of all registered users is performed.

3. The identity authentication method according to claim 2, characterized in that: The signature data packet includes a signature public key and a user signature, and the signature verification according to the signature data packet and the extracted first biometric feature includes: Decrypt the user signature according to the signature public key to obtain a decrypted hash value; Calculating a hash value of the extracted first biometric feature; The signature verification result is determined based on a matching result between the calculated hash value and the decrypted hash value.

4. The identity authentication method according to any one of claims 1 to 3, characterized in that: The step of performing identity authentication on the user to be authenticated according to the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature, comprises: Determine a target symmetric key according to the extracted first local symmetric key and the found second local symmetric key; Decrypting the found encrypted biometric feature according to the target symmetric key to obtain a second biometric feature of the corresponding registered user; An identity authentication result of the user to be authenticated is determined according to a matching result between the decrypted second biometric feature and the extracted first biometric feature.

5. The identity authentication method according to claim 4, characterized in that: Also includes: Receive user registration information sent by the registration server, where the user registration information includes the biometrics of the user to be registered and the second Ukey identifier of the Ukey used; Generate a symmetric key for the user to be registered; According to the symmetric key, the biometrics and the second Ukey identifier of the user to be registered, the data in the second local symmetric key library, the encrypted biometrics library and the Ukey are updated to register the user to be registered.

6. The identity authentication method according to claim 5, characterized in that: The updating of the second local symmetric key library, the encrypted biometric library and the data in the Ukey according to the symmetric key, the biometric feature and the second Ukey identification of the user to be registered includes: Encrypt the biometric feature according to the symmetric key to obtain the encrypted biometric feature of the user to be registered, and store the encrypted biometric feature in the encrypted biometric feature library using the second Ukey identifier as an index; Splitting the symmetric key into a first local symmetric key and a second local symmetric key, and storing the second local symmetric key in the second local symmetric key library using the second Ukey identifier as an index; The first local symmetric key is sent to the registration server so that the registration server writes the first local symmetric key into the Ukey.

7. An identity authentication method, characterized in that: Applied to the client, including: Generate encryption information according to the first biometric feature of the user to be authenticated, the first Ukey identifier written in the Ukey used, the first local symmetric key and the server encryption public key; Generate user information to be authenticated according to the encrypted information; The user information to be authenticated is sent to an authentication server, so that the authentication server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users.

8. The identity authentication method according to claim 7, characterized in that: Also includes: Sign the hash value of the first biometric feature according to the signature private key written in the Ukey to obtain a user signature; Generate a signature data packet according to the user signature and the signature public key written in the Ukey; The generating the user information to be authenticated according to the encrypted information includes: generating the user information to be authenticated according to the signature data packet and the encrypted information.

9. The identity authentication method according to claim 7, characterized in that: Also includes: Collecting a facial image of the user to be authenticated; A facial feature is extracted from the facial image as a first biometric feature.

10. An identity authentication device, characterized in that: Applicable to authentication servers, including: A receiving unit, configured to receive user information to be authenticated sent by a client, wherein the user information to be authenticated includes encrypted information generated according to a first biometric feature of the user to be authenticated, a first Ukey identifier written in the Ukey used, a first local symmetric key, and a server encryption public key; An extraction unit, configured to extract the first Ukey identifier, the first local symmetric key and the first biometric feature from the encrypted information; A search unit, configured to use the extracted first Ukey identifier as an index to search for the corresponding second local symmetric key and encrypted biometric feature from the second local symmetric key library and encrypted biometric feature library of all registered users respectively; An authentication unit is used to perform identity authentication on the user to be authenticated based on the extracted first local symmetric key and the first biometric feature, and the found second local symmetric key and the encrypted biometric feature.

11. An identity authentication device, characterized in that: Applied to the client, including: The first generating unit is used to generate encryption information according to the first biometric feature of the user to be authenticated and the first Ukey identifier written in the used Ukey, the first local symmetric key and the server encryption public key; A second generating unit, used to generate user information to be authenticated according to the encrypted information; The user information to be authenticated is sent to an authentication server, so that the authentication server performs identity authentication on the user to be authenticated according to the user information to be authenticated, and the second local symmetric key library and encrypted biometric library of all registered users.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the identity authentication method as described in any one of claims 1-6 or 7-9 is implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the identity authentication method as described in any one of claims 1-6 or 7-9 is implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the identity authentication method as described in any one of claims 1-6 or 7-9 is implemented.

Images