User authority management method and terminal device

Abstract

The embodiment of the present application provides a user rights management method and terminal device, the method comprising: obtaining the identity information of the user currently holding the terminal device and performing identity authentication on the user, the terminal device or the target application has performed at least one identity authentication and is in a running state after the identity authentication is passed; according to the authentication results of one or more identity authentications, feedback information to the user, so that the user can access the terminal device or the target application within the scope of the permission. The embodiment of the present application can improve the security performance of the terminal device.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a user authority management method and terminal device. Background Art

[0002] With the rapid development of electronic technology, terminal devices (such as mobile phones, computers, etc.) are used as carriers for humans to use mobile services and store user personal information, and their usage and popularity rates are also increasing. As more and more personal information is stored in terminal devices, and the rich communication and data exchange functions provide channels for information leakage and virus transmission, the security issues faced by terminal devices are becoming increasingly prominent. At present, when solving the security issues faced by terminal devices, the common way is to perform security authentication, and security authentication usually adopts a "gateway" management strategy. Specifically, after a security authentication is passed, the user who operates the terminal device can continue to use the terminal device for a long period of time. If the owner of the terminal device performs security authentication on the terminal device and then gives it to another person for use, once the terminal device is out of the owner's sight, it is likely to cause security problems. For example, children use terminal devices to reward anchors, buy game equipment, view chat records, personal albums, etc. How to perform security authentication on terminal devices to effectively improve the security of terminal devices is a technical problem that technicians in this field need to solve. Summary of the invention

[0003] The embodiments of the present application disclose a user authority management method and a terminal device, which can improve the security performance of the terminal device.

[0004] In a first aspect, an embodiment of the present application provides a user authority management method, the method comprising: obtaining the identity information of a user currently holding a terminal device and performing identity authentication on the user, the terminal device or target application having performed identity authentication at least once and being in an operating state after passing the identity authentication; providing feedback to the user based on the authentication results of one or more of the identity authentications, so that the user can access the terminal device or the target application within the scope permitted by the authority.

[0005] In the above method, after the terminal device or target application has performed identity authentication and passed the authentication, the user operating the terminal device or target application continues to be authenticated, and information is fed back to the user based on one or more identity authentication results obtained by the continued authentication, so that the user can access the terminal device or target application within the scope of the permission. This continuous identity authentication method can continuously ensure the security of the terminal device or target application.

[0006] In some possible implementations of the first aspect, the feedback of information to the user based on the authentication results of one or more identity authentications so that the user can access the terminal device or the target application within the scope permitted by authority includes: outputting prompt information to the user based on the authentication results of the multiple identity authentications, the prompt information being used to prompt whether the user operating the terminal device or the target application has changed during operation.

[0007] In this way, the target user can instantly know whether the terminal device has been operated by other users, so as to instantly evaluate possible security issues and risks and provide immediate remedial measures for possible security issues and risks.

[0008] In some possible implementations of the first aspect, the prompt information includes a voice prompt, a text prompt, or an image prompt, or the output prompt information includes requesting the user to re-enter identity information for identity authentication.

[0009] In some possible implementations of the first aspect, the information is fed back to the user based on the authentication results of the identity authentication performed one or more times, so that the user can access the terminal device or the target application within the scope permitted by the permission, including: determining the user's current operation permission for the terminal device or the target application based on the authentication results of the identity authentication performed one or more times; and controlling the user's access to the terminal device or the target application based on the operation permission. It can be understood that after the terminal device or the target application has performed identity authentication and the authentication has passed, one or more identity authentications are performed and the operation permission is further determined based on the one or more identity authentication results, so that the security level of the determined operation permission is higher, thereby improving the security of the terminal device.

[0010] In some possible implementations of the first aspect, the obtaining of the identity information of the user currently holding the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device at a preset frequency, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication. That is, identity authentication is performed at a preset frequency, so as to achieve the purpose of continuous identity authentication.

[0011] In some possible implementations of the first aspect, the obtaining of the identity information of the user currently holding the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device whenever a triggering operation on a preset function is detected, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication, and the number of preset functions in the terminal device is greater than or equal to 1. That is, identity authentication is performed whenever the first application runs to the preset function, thereby achieving the purpose of continuous identity authentication.

[0012] In some possible implementations of the first aspect, the identity information used in the identity authentication includes a fusion of one or more of the user's fingerprint information, facial information, iris information, or voiceprint information.

[0013] In some possible implementations of the first aspect, controlling the user's current access to the terminal device or the target application based on the operating authority includes: if it is determined that the user does not have the operating authority for the terminal device or the target application, outputting a prompt message to prompt the target user to perform identity authentication; receiving re-entered identity authentication information; if it is determined that the user operating the terminal device or the target application is the target user based on the re-entered identity authentication information, granting the operating authority for the terminal device or the target application.

[0014] In an embodiment of the present application, after the user is initially denied operating permissions for the terminal device or target application, the target user may be further prompted to perform secondary authorization. If the secondary authorization is successful, the user will still be granted operating permissions for the terminal device or target application. This improves the flexibility of authorization and can meet user needs in more application scenarios.

[0015] In some possible implementations of the first aspect, if it is determined that the user currently does not have the operating authority for the terminal device or the target application, then a prompt message is output to prompt the target user to perform identity authentication, including: if it is determined that the user currently does not have the operating authority for the terminal device or the target application, and the type of the target application is a first preset type, then a prompt message is output to prompt the target user to perform identity authentication. That is to say, only applications of a specific type are pre-configured to be eligible for secondary authorization, so that differential management of various applications at different security levels can be achieved.

[0016] In some possible implementations of the first aspect, determining the user's current operating authority over the terminal device or the target application based on the authentication results of one or more identity authentications includes: determining whether the user currently operating the terminal device has the operating authority over the terminal device or the target application based on the authentication results of multiple identity authentications and information about the currently running target application; the information about the target application includes the type of the target application and / or the function currently executed by the target application.

[0017] In the above method, the terminal device or target application is authenticated by continuous identity authentication (i.e., full-process tracking authentication); then, the user's operating authority for the terminal device or target application is determined by combining multiple identity authentication results (i.e., chain authentication) and the information of the target application; this continuous identity authentication and determination of operating authority based on multiple authentication results of continuous authentication can more timely and accurately identify the identity of the user currently operating the terminal device or target application, and has higher security.

[0018] In some possible implementations of the first aspect, the method of determining whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the currently running target application includes: if the authentication results of the multiple identity authentications exceed the target ratio threshold, indicating that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the security requirements of the target application to the greatest extent.

[0019] In some possible implementations of the first aspect, the method of determining whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on at least multiple authentication results of the identity authentication and the information of the currently running target application includes: if the last authentication result among the multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the needs of the target application to the greatest extent. In addition, requiring the most recent authentication result to be the target user further improves security.

[0020] In some possible implementations of the first aspect, the method further includes: if the last identity authentication result among the multiple identity authentication results indicates that the user operating the terminal device is not the target user, and / or the authentication result among the multiple identity authentication results that does not exceed the target ratio threshold indicates that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application; wherein the target ratio threshold is determined based on information of the target application.

[0021] In some possible implementations of the first aspect, the authentication result of any one of the multiple identity authentications is obtained by multiple virtual computing nodes respectively authenticating the user operating the terminal device and reaching consensus on the authentication results obtained by each of them. It can be understood that since a method of joint authentication of multiple virtual computing nodes is adopted, even if a computing node is maliciously hacked and produces an authentication result that is not conducive to security, other virtual computing nodes that have not been hacked can still obtain a relatively safe final authentication result after reaching consensus with the hacked virtual computing node, thereby improving the security of identity authentication.

[0022] In some possible implementations of the first aspect, the multiple virtual computing nodes are different operating systems installed on the terminal device, or are at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, and the multiple virtual computing nodes are based on different modalities when performing identity authentication. It can be understood that since the multiple virtual computing nodes are different operating systems installed on the terminal device, or are at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, the multiple virtual computing nodes are in a relatively isolated environment, and even if one of them is maliciously hacked, the remaining virtual computing nodes can still operate normally, thereby improving the security of identity authentication. In addition, since the modalities based on which the identity authentication of each virtual computing node is performed are different (for example, not exactly the same), the form of the modality is enriched, making the identity authentication process difficult to be cracked by the outside world; for example, if there is only one modality, such as fingerprint recognition, then when the user's fingerprint information is leaked, the identity authentication process can be easily cracked by the outside world; however, if the user's operating behavior habits when using various applications, the user's various biometric features, etc. are included in the modal authentication, then even if some of the user's characteristic information is leaked, it will still not bring substantial security risks to the identity authentication link of the terminal device.

[0023] In a second aspect, an embodiment of the present application provides a user authority management method, the method comprising: if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device has the operating authority to the terminal device or the target application, a first prompt message is displayed to prompt the user to be allowed to use the terminal device or the target application within a preset time period; if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority to the terminal device or the target application, a prompt is given to the target user to perform identity authentication.

[0024] Using the above method, after initially denying the user permission to operate the terminal device or target application, the target user can be further prompted to perform secondary authorization. If the secondary authorization is passed, the user will still be granted permission to operate the terminal device or target application. This improves the flexibility of authorization and can meet user needs in more application scenarios.

[0025] In some possible implementations of the second aspect, if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application, prompting the target user to perform identity authentication, including: if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application, outputting a second prompt message to prompt the target user to perform identity authentication; receiving re-entered identity authentication information; if it is determined based on the re-entered identity authentication information that the user operating the terminal device or the target application is the target user, granting the operating authority for the terminal device or the target application.

[0026] In some possible implementations of the second aspect, the authentication result is used to determine the user's operating authority over the target application; if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority over the terminal device or the target application, then a second prompt message is output to prompt the target user to perform identity authentication, including: if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority over the terminal device or the target application, and the target application belongs to a preset first preset type, then a second prompt message is output to prompt the target user to perform identity authentication. In other words, only applications of a specific type are pre-configured to be eligible for secondary authorization, so that differential management of various applications at different security levels can be achieved.

[0027] In some possible implementations of the second aspect, it further includes: if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application, and the target application does not belong to the preset first preset type, then restricting the operation of the target application. It can be understood that some target applications have a relatively high security level. As long as it is determined that the user does not have the operating authority for them, the operating authority of the target application is directly restricted, thereby improving the security level of such target applications.

[0028] In some possible implementations of the second aspect, the restriction on operations on the target application includes: exiting the display of the target application, or displaying an interface for blocking the content displayed by the application to prevent the user from using it, or displaying partial content of the target application other than private content, or displaying a prompt message to prompt the user that he does not have permission to view the private content in the target application, or prohibiting the user from calling the target application from a third-party device.

[0029] In some possible implementations of the second aspect, before determining that the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of one or more identity authentications, it also includes: obtaining the identity information of the user currently operating the terminal device and performing identity authentication on the user, and the terminal device or the target application has performed at least one identity authentication and is in an operating state after the identity authentication is passed. It can be understood that after the terminal device or the target application has performed identity authentication and the authentication is passed, the user operating the terminal device or the target application continues to be authenticated, and information is fed back to the user based on the one or more identity authentication results obtained by the continued authentication, so that the user can access the terminal device or the target application within the scope permitted by the authority. This continuous identity authentication method can continuously ensure the security of the terminal device or the target application.

[0030] In some possible implementations of the second aspect, the obtaining the identity information of the user currently operating the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device at a preset frequency, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication. That is, identity authentication is performed at a preset frequency, so as to achieve the purpose of continuous identity authentication.

[0031] In some possible implementations of the second aspect, the obtaining of the identity information of the user currently operating the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device whenever a triggering operation on a preset function is detected, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of one authentication, and the number of preset functions in the terminal device is greater than or equal to 1. That is, identity authentication is performed each time the first application runs to the preset function, thereby achieving the purpose of continuous identity authentication.

[0032] In some possible implementations of the second aspect, the identity information used in the identity authentication includes a fusion of one or more of the user's fingerprint information, facial information, iris information, or voiceprint information.

[0033] In some possible implementations of the second aspect, if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device has the operating authority for the terminal device or the target application, then before displaying the first prompt information, it also includes: determining whether the user currently operating the terminal device has the operating authority for the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the target application; the information of the target application includes the type of the target application and / or the function currently executed by the target application.

[0034] In the above method, the terminal device or target application is authenticated by continuous identity authentication (i.e., full-process tracking authentication); then, the user's operating authority for the terminal device or target application is determined by combining multiple identity authentication results (i.e., chain authentication) and the information of the target application; this continuous identity authentication and determination of operating authority based on multiple authentication results of continuous authentication can more timely and accurately identify the identity of the user currently operating the terminal device or target application, and has higher security.

[0035] In some possible implementations of the second aspect, the determination of whether the user currently operating the terminal device has the operating authority to the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the target application includes: if the authentication results of the multiple identity authentications exceed the target ratio threshold, indicating that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the operating authority to the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined based on the information of the target application (i.e., the scenario), so that the control of authority meets the security requirements of the target application to the greatest extent.

[0036] In some possible implementations of the second aspect, the method of determining whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of multiple authentications and the information of the target application includes: if the last authentication result among the multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the needs of the target application to the greatest extent possible. In addition, requiring the most recent authentication result to be the target user further improves security.

[0037] In some possible implementations of the second aspect, the authentication result of any one of the multiple identity authentications is obtained by multiple virtual computing nodes respectively authenticating the user operating the terminal device and reaching consensus on the authentication results obtained by each of them. It can be understood that, since a method of joint authentication of multiple virtual computing nodes is adopted, even if a computing node is maliciously hacked and produces an authentication result that is not conducive to security, other virtual computing nodes that have not been hacked can still obtain a relatively safe final authentication result after reaching consensus with the hacked virtual computing node, thereby improving the security of identity authentication.

[0038] In some possible implementations of the second aspect, the multiple virtual computing nodes are different operating systems installed on the terminal device, or are at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, and the multiple virtual computing nodes are based on different modalities when performing identity authentication. It can be understood that since the multiple virtual computing nodes are different operating systems installed on the terminal device, or are at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, the multiple virtual computing nodes are in a relatively isolated environment, and even if one of them is maliciously hacked, the remaining virtual computing nodes can still operate normally, thereby improving the security of identity authentication. In addition, since the modalities based on which the identity authentication of each virtual computing node is performed are different (for example, not exactly the same), the form of the modality is enriched, making the identity authentication process difficult to be cracked by the outside world; for example, if there is only one modality, such as fingerprint recognition, then when the user's fingerprint information is leaked, the identity authentication process can be easily cracked by the outside world; however, if the user's operating behavior habits when using various applications, the user's various biometric features, etc. are included in the modal authentication, then even if some of the user's characteristic information is leaked, it will still not bring substantial security risks to the identity authentication link of the terminal device.

[0039] In a third aspect, an embodiment of the present application provides a terminal device, which includes one or more processors and a memory, wherein the memory is used to store a computer program, and the one or more processors call the computer program to implement the method described in the first aspect or any possible implementation of the first aspect.

[0040] In a fourth aspect, an embodiment of the present application provides a terminal device, which includes one or more processors and a memory, wherein the memory is used to store a computer program, and the one or more processors call the computer program to implement the method described in the second aspect or any possible implementation of the second aspect.

[0041] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is executed on one or more processors, the computer-readable storage medium implements the method described in the first aspect or any possible implementation manner of the first aspect.

[0042] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on one or more processors, the computer-readable storage medium implements the method described in the second aspect or any possible implementation manner of the second aspect.

[0043] According to the embodiment of the present application, after the terminal device or target application has performed identity authentication and passed the authentication, the user operating the terminal device or target application continues to be authenticated, and information is fed back to the user based on one or more identity authentication results obtained by the continued authentication, so that the user can access the terminal device or target application within the scope of the permission. This continuous identity authentication method can continuously ensure the security of the terminal device or target application. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The following is an introduction to the drawings used in the embodiments of the present application.

[0045] Figure 1 It is a schematic diagram of an operation framework of a terminal provided in an embodiment of the present application;

[0046] Figure 2 This is a schematic diagram of an operating framework of another terminal provided in an embodiment of the present application;

[0047] Figure 3 It is a structural diagram of an Android operating system provided in an embodiment of the present application;

[0048] Figure 4A It is a flowchart of a user rights management method provided in an embodiment of the present application;

[0049] Figure 4B It is a flowchart of another user rights management method provided in an embodiment of the present application;

[0050] Figure 5 It is a flowchart of a user rights management method provided in an embodiment of the present application;

[0051] Figure 6 It is a flowchart of a user rights management method provided in an embodiment of the present application;

[0052] Figure 7 It is a flowchart of a user rights management method provided in an embodiment of the present application;

[0053] Figure 8 It is a flowchart of a user rights management method provided in an embodiment of the present application;

[0054] Fig. 9 It is a flowchart of a user rights management method provided in an embodiment of the present application;

[0055] Fig.10 It is a structural diagram of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0057] The user authority management method in the embodiments of the present application can be implemented based on a terminal, which can be a handheld device (for example, a mobile phone, a tablet computer, a PDA, etc.), a vehicle-mounted device (for example, a car, a bicycle, an electric car, an airplane, a ship, etc.), a wearable device (for example, a smart watch (such as iWatch, etc.), a smart bracelet, a pedometer, etc.), a smart home device (for example, a refrigerator, a television, an air conditioner, an electric meter, etc.), an intelligent robot, a workshop equipment, and the like.

[0058] like Figure 1 As shown, the terminal includes a business layer 101, an SDK layer 102, an execution layer 103, an engine layer 104, a link layer 105 and a data layer 106, and these layers cooperate to jointly complete the user rights management method, wherein:

[0059] Data layer 106: used to obtain modal data during the use of the terminal, and then perform fusion calculations on the acquired modal data, specifically including five parts: modal acquisition, modal detection, feature extraction, feature fusion and classification decision; this layer can support multiple computing nodes to perform fusion calculations on modal data and support distributed security defense detection.

[0060] Link layer 105: used to integrate the results of data layer fusion, such as shielding the differences between data from different computing nodes in the data layer through CA plug-ins, sensor hub plug-ins and distributed protocol plug-ins to meet the requirements of the engine layer.

[0061] Engine layer 104: used to provide continuous identity authentication services, security defense chain engine and multi-modal computing engine, including:

[0062] Provides continuous authentication services for continuous authentication of terminals based on modal data integrated by the link layer.

[0063] The security defense chain engine is used to implement the security defense chain mechanism, which includes security detectors, chain management and node management. Among them: the security detector is used to set security detection points according to security authentication requirements. A security detection point can have one or multiple multi-modal identity authentications. The result of one identity authentication is recorded on the chain as a transaction record. Chain management is used to implement the security defense chain mechanism of distributed blockchain-like networks, and the consistency and non-tamperability of the elements on the chain are ensured through the data synchronization mechanism. Node management is used to manage node information and inter-node communication in distributed blockchain-like networks.

[0064] The multimodal computing engine is used to implement multimodal computing, which includes an owner feature manager for registering owner features and for fusion classification of the multimodal computing engine. It also includes a multimodal manager for managing multimodal computing and driving the data layer to start or stop the acquisition of modal data (for example, multimodal computing pipeline work).

[0065] Execution layer 103: Provides dynamic authorization management and control services, and performs authorization management and control based on the continuous identity authentication results on the chain of the engine layer, for example, authorization and re-authorization operations. The authorization types may include system permissions, general permissions, etc.

[0066] Software development kit (SDK) layer 102: An application programming interface (API) that provides continuous authentication services to the business layer, for example, providing continuous authentication APIs to various applications (APPs) installed on the terminal, or cloud services, or Internet of Things (IoT) services, etc. This layer can be regarded as an adaptation layer. On the one hand, it provides an entry for service registration (the above-mentioned continuous authentication API is called immediately after registration) for the service, and on the other hand, it transparently transmits the relevant information of the user rights finally obtained after continuous authentication (such as authorization, or not authorization, or which specific functions are authorized, etc.) to the registered service.

[0067] Business layer 101: used to support the implementation of some services, for example, various application programs, cloud services, IoT services, etc.

[0068] Optional, such as Figure 2 As shown, multiple operating systems can be deployed in the terminal, and the multiple operating systems can be regarded as computing nodes in the distributed blockchain. For example, the multiple operating systems can include Android system 201, iTrustee system 202 and LiteOS system 203. Each operating system is described in detail below.

[0069] Android system 201: can be used as a rich execution environment (REE) to directly connect to the upper business layer to implement five modules including scenario recognition (also known as application information recognition, for example, the information includes the type of application and / or the function currently executed by the application), continuous authentication service, security defense chain engine on the REE side, multimodal computing engine and dynamic authorization management service. The upper-layer business can set security detection points through the API of the continuous authentication service, and can also define security detection strategies for specific scenarios through scenario recognition. The authentication results are returned to the upper-layer business and dynamic authorization management service through the API of the continuous authentication service. The multimodal computing engine drives the computing nodes to perform multimodal computing through the adaptation layer, and provides computing services for the security defense chain engine. The security defense chain engine includes security detectors, chain management and node management, and provides reliable multimodal authentication results for upper-layer businesses and dynamic authorization management services.

[0070] like Figure 3 As shown, a more detailed structure of the internal structure of an Android system provided in an embodiment of the present application is mainly distributed in the application layer 301, the framework layer 302 and the native layer 303. Among them: Framework layer 302: includes dynamic authorization management service, security defense chain engine, multimodal computing engine, configuration management module, and two background services, namely security defense chain service and multimodal computing service, which support the above engines. The security defense chain engine and the multimodal computing engine communicate with the security defense chain service and the multimodal computing service through the binder mechanism. Native layer 303: mainly implements the REE security defense chain engine, and provides underlying computing for the upper-level security defense chain service, including node management, communication between nodes, creation, deletion, monitoring and synchronization of chain elements.

[0071] iTrustee system 202: can be used as a trusted execution environment (TEE), which includes a multimodal trusted application (TA) and an authorized TA, wherein the multimodal TA is used to realize the integration and classification decision of the user's behavior, physiology and other characteristics, and the authorized TA is used to authorize (i.e., perform user rights management) according to the classification decision results of the multimodal TA. Optionally, REE and TEE can communicate through a client API (CA) plug-in.

[0072] LiteOS system 203: mainly realizes the calculation of low-power modes (low-power camera (Camera), low-power microphone MIC), and transmits the calculation results to TEE for fusion. Optionally, the sensor hub (SensorHub) and TEE can communicate through the sensor hub IPC driver (SensorHub IPC driver).

[0073] See also Figure 4A , Figure 4A This is a user rights management method provided by the embodiment of the present application. The method can be based on Figure 1 The method is implemented by the terminal shown in the figure, and includes but is not limited to the following steps:

[0074] Step S411: The terminal device obtains the identity information of the user currently holding the terminal device and performs identity authentication on the user.

[0075] Specifically, before executing the above step "the terminal device obtains the identity information of the user currently holding the terminal device and performs identity authentication on the user", the terminal device or the target application has performed at least one identity authentication and is in a running state after the identity authentication is passed; that is, the terminal device has obtained the identity information of the user for identity authentication during its own operation or the operation of the target application. Generally speaking, the terminal device will pre-store the information of one (of course, it may be multiple) users. The embodiment of the present application refers to this one user as the target user. Optionally, the target user is usually the owner of the terminal device. The terminal device compares the obtained identity information with the pre-stored identity information of the target user. If the obtained identity information is different from the pre-stored identity information of the target user, it indicates that the authentication has not been passed; if the obtained identity information is the same as the pre-stored identity information of the target user, it indicates that the authentication has been passed, thereby entering the running state after the identity authentication has been passed. Optionally, the identity authentication that has been performed can be considered as the identity authentication performed when the terminal device is unlocked in the lock screen state. The authentication in this case is also usually called "access control" authentication.

[0076] Optionally, the target application is a currently running application, which may be an application running on the terminal device or an application running on a third-party device (this case may be referred to as a third-party application).

[0077] In the embodiment of the present application, there are multiple ways for the terminal device to obtain the identity information of the user currently holding the terminal device and authenticate the user. Several optional implementation methods are provided below:

[0078] Method 1: collect the identity information of the user who currently holds the terminal device at a preset frequency, and perform identity authentication on the user who operates the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication. For example, collection and identity authentication are performed once every 2 minutes, or once every 5 minutes.

[0079] Method 2: Whenever a trigger operation for a preset function is detected, the identity information of the user currently holding the terminal device is collected, and the user operating the terminal device is authenticated according to the identity information collected each time, so as to obtain one or more authentication results of the identity authentication. Each time the identity information collected is used to obtain an authentication result of the identity authentication, the number of preset functions in the terminal device is greater than or equal to 1. It can be understood that many business functions can be realized on the terminal device, such as taking pictures, playing music, playing games, purchasing game equipment, paying, transferring money, modifying account information, etc. Some of the functions can be marked as preset functions, and the identity information needs to be obtained every time the user wants to use the preset function. For example, if payment, transfer, and modification of account information are marked as preset functions, then when the user triggers any of the functions of payment, transfer, and modification of account information, the terminal device will perform identity authentication.

[0080] Optionally, the authentication result of any one of the above authentication processes is obtained by multiple virtual computing nodes respectively authenticating the user operating the terminal device and reaching a consensus on the authentication results obtained by each of them. For example, if there are virtual computing nodes 1, virtual computing nodes 2 and virtual computing nodes 3, virtual computing nodes 1 will authenticate and obtain the authentication result 1, virtual computing nodes will authenticate and obtain the authentication result 2, and virtual computing nodes will authenticate and obtain the virtual computing node 3, and then these three virtual computing nodes reach a consensus on the authentication result 1, the authentication result 2 and the authentication result 3 to obtain an authentication result. Further, the multiple virtual computing nodes are different operating systems installed on the terminal device (for example, an Android system, a LiteOS system, etc. installed on the terminal device), or at least one operating system installed on the terminal device and at least one third-party device (i.e., an external device) connected to the terminal device, and the modalities based on which the multiple virtual computing nodes perform authentication are different (for example, one virtual computing node performs authentication based on iris, and another virtual computing node performs authentication based on fingerprint).

[0081] In the embodiments of the present application, it is mentioned that the terminal device or the target application performs identity authentication, and it is also mentioned that the operation authority of the terminal device or the target application is determined. In these descriptions, the terminal device and the target application are described as a parallel relationship, because in actual applications, there are indeed some control strategies that are only for certain target applications, and some control strategies are for the terminal device (that is, no matter what application the terminal device is currently running, the control strategy is applicable). Therefore, in many links of the embodiments of the present application, the terminal device and the target application are described in parallel.

[0082] Optionally, during the identity authentication process, the modality on which the authentication is based will be selected first. The modality may refer to the source or form of information. For example, fingerprint recognition, iris recognition, face recognition, user operation (habit) recognition, etc. all belong to different modalities. In the embodiment of the present application, the modality selected for each authentication may be one or more (i.e., multimodal). There are many ways to select a modality. For ease of understanding, an optional method is given below.

[0083] Optionally, if the purpose of identity authentication is to determine the operating permissions of the above-mentioned target application, then the matching relationship between various application information and various modalities can be pre-configured. Once the information of the target application is determined, the corresponding modality can be determined from the matching relationship based on the target application, thereby obtaining the final modality used for identity authentication.

[0084] Optionally, if the identity authentication is to determine the operating authority of an application (such as the target application described above), the matching relationship between the application information and the candidate modalities may be pre-configured, and then the candidate modalities corresponding to the target application information are matched according to the matching relationship during the operation of the target application, wherein the candidate modalities include at least one modality; wherein the matching relationship defines the candidate modalities corresponding to at least two types of information, and the candidate modalities corresponding to any two of the at least two types of information are not completely the same. Optionally, if the application information includes the application type but does not include the currently executed function, Table 1 illustrates the candidate modalities corresponding to game applications, shopping applications, and music applications.

[0085] Table 1

[0086] Application Type Candidate modalities Games Fingerprint recognition, user operation, face recognition Shopping Face recognition, fingerprint recognition, iris recognition Music Face recognition, fingerprint recognition

[0087] Referring to Table 1, when the target application is Honor of Kings, it belongs to the category of game applications, so its corresponding candidate modalities include fingerprint recognition, user operation, and face recognition; when the target application is JD.com, it belongs to the category of shopping applications, so its corresponding candidate modalities include face recognition, fingerprint recognition, and iris recognition; and the rest are similar.

[0088] After the candidate modalities corresponding to the target application are determined, one or more modalities among the candidate modalities corresponding to the target application are used as the final modalities for identity authentication of the user operating the terminal device. For example, when the target application is a shopping application, one or more modalities are selected from face recognition, fingerprint recognition, and iris recognition corresponding to the shopping application as the final modalities for identity authentication. For example, a multi-modality consisting of face recognition and fingerprint recognition is selected; for another example, a multi-modality consisting of fingerprint recognition and iris recognition is selected. Optionally, one or more modalities can be selected from the candidate modalities corresponding to the target application as the modalities for identity authentication of the user operating the terminal device according to the environmental parameters in the environment in which the terminal device is currently located. That is to say, when selecting one or more modalities from the candidate modalities corresponding to the type described in the target application, the selection can be made based on the environmental parameters in the environment in which the terminal device is currently located. For example, when it is determined according to the environmental parameters that the terminal device is currently in the dark, a modality other than face recognition and iris recognition is used, which can improve the accuracy of subsequent identity recognition.

[0089] Step S412: The terminal device feeds back information to the user based on the authentication results of one or more identity authentications, so that the user can access the terminal device or the target application within the scope permitted by the authority.

[0090] Specifically, there are at least two possible implementation schemes for feeding back information to the user:

[0091] Option 1 is to output prompt information to the user based on the authentication results of multiple identity authentications, and the prompt information is used to prompt whether the user operating the terminal device or the target application has changed during the operation.

[0092] Case 1: If the multiple times are specifically 3 times, where the first identity authentication result shows that the user is the target user, the second identity authentication result shows that the user is the target user, and the third identity authentication result shows that the user is not the target user, then a prompt message is output to the user, and the output prompt message includes requesting the user to re-enter the identity information for identity authentication.

[0093] Case 2, if the number of times is specifically 4 times, where the result of the first identity authentication indicates that it is the target user, the result of the second identity authentication indicates that it is the target user, the result of the third identity authentication indicates that it is not the target user, and the result of the fourth identity authentication indicates that it is the target user, then the above prompt information is output. In this case, the last identity authentication among the multiple identity authentications indicates that the target user is operating the terminal device or the target application, and before the last identity authentication, there was an identity authentication result indicating that the user operating the terminal device or the target application was not the target user. In this case, a prompt information is output to indicate that the user has been changed. The purpose of this configuration is to allow the target user to see the above prompt information as much as possible, and to prevent users other than the target user from seeing the prompt information as much as possible; optionally, the prompt information includes voice prompts, text prompts, or image prompts.

[0094] Option 2 is to determine the user's current operating authority for the terminal device or the target application based on one or more authentication results of the identity authentication.

[0095] In case A, when the determination is made based on the result of a single identity authentication, if the result of the single identity authentication indicates that the user operating the terminal device or the target application is not the target user, the user will not be granted the operation permission for the terminal device or the target application; if the result of the single identity authentication indicates that the user operating the terminal device or the target application is the target user, the user will be granted the operation permission for the terminal device or the target application.

[0096] Case B, when the determination is made based on multiple identity authentication results, it is determined whether the user currently operating the terminal device has the operation authority for the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the currently running target application. The following is an example of determining the operation authority of the target application. When the terminal device determines the current operation authority of the target application, the first aspect is to consider the multiple identity authentication results, and the second aspect is also to consider the information of the target application; the second aspect is mainly to consider that the information of the application is different and its security level is often different. The embodiment of the present application has higher requirements for the identity authentication of applications with high security levels, and relatively low requirements for the identity authentication of applications with low security levels. For example, Taobao, JD.com, and Vipshop belong to shopping applications, and NetEase Music, QQ Music, and Kuwo Music belong to music applications. The security level of music applications is obviously lower than that of shopping applications (involving financial transactions), so the requirements for the identity authentication results of shopping applications can be relatively higher. For example, for the same application, the security levels of the various business functions it includes are often different. For example, the security level of the function of querying goods in the Taobao application is lower than the security level of the payment of goods, so the requirements of the identity authentication results of the commodity payment function are higher than the requirements of the identity authentication results of the commodity query function.

[0097] The target application information includes the type of the target application and / or the function currently executed by the target application. The terminal device can pre-identify the target application information. Identifying the information of the currently running target application can also be considered as identifying the current application scenario of the target application. The target application information includes the type of the target application and / or the function currently executed by the target application. For example, the target application information includes the type of the target application; for another example, the target application information includes the function currently executed by the target application; for another example, the type of the target application and the function currently executed by the target application. Optionally, in addition to the information listed above, the target application information may also include other information, and the specific information is not limited here.

[0098] It can be understood that each application has a corresponding type. For example, NetEase Music, QQ Music, etc. belong to the music type; Taobao, Tmall, JD.com, etc. belong to the shopping type; Alipay, Tenpay, etc. belong to the payment type, and applications on third-party devices belong to the third-party application type, and so on. Figure 4A The payment type is used as an example for illustration. The type of application can be determined by its name, description file, type identifier and other information.

[0099] Optionally, the target application information can be obtained by identifying the program of the terminal device (which can be considered as system-active, such as active identification by the Huawei mobile phone intelligent scene recognition system), or it can be obtained by calling the API of the terminal device through a third-party platform that has established a communication connection with the terminal device or a third-party application running on the terminal device (which can be considered as business-active).

[0100] The following two optional cases describe how to combine the first and second aspects to comprehensively determine the current operating permissions of the target application (for the above situation B):

[0101] Case 1: If there are authentication results exceeding the target ratio threshold in multiple identity authentication results that indicate that the user operating the terminal device is the target user, it is determined that the user currently operating the terminal device has the operation authority for the target application; if there are no authentication results exceeding the target ratio threshold in the multiple identity authentication results that indicate that the user operating the terminal device is the target user, it is determined that the user currently operating the terminal device does not have the operation authority for the target application. Wherein, the target ratio threshold is determined according to the information of the target application. For example, if the above multiple times are 5 times, when the information of the target application indicates that its type is a shopping application, the target ratio threshold can be set to 100%, that is, the last 5 identity authentication results are required to show that the user operating the terminal device is the target user (i.e., the owner himself), and the current operation authority of the target application can be obtained; when the information of the target application indicates that its type is a music application, the target ratio threshold can be set to 20%; that is, it is required that at least one of the last 5 identity authentication results shows that the user operating the terminal device is the target user, and the current operation authority of the target application can be obtained.

[0102] Case 2: If the last authentication result among multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then it is determined that the user currently operating the terminal device has the right to operate the target application; if the last authentication result among multiple authentication results indicates that the user operating the terminal device is not the target user, and / or the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then it is determined that the user currently operating the terminal device does not have the right to operate the target application. Among them, the target ratio threshold is determined based on the information of the target application. It can be seen that compared with Case 1, Case 2 requires that the last authentication result obtained in time sequence (if a blockchain-like architecture is adopted, it is the last authentication result obtained by consensus in time sequence) shows that the user operating the terminal device is the target user, which further improves security.

[0103] Case three, determine the number value N according to the information of the target application; optionally, the terminal device stores the number values ​​corresponding to various application information, so the number value N can be determined based on the corresponding relationship. After determining the number value N according to the target application, determine whether the N most recent identity authentication results in time sequence all show that the user operating the terminal device is the target user. If so, determine that the current operating authority of the target application is to allow operation. For example, when the information of the target application indicates that the function it is currently executing is a payment function, the determined number value N is equal to 5, that is, the most recent 5 identity authentication results are required to show that the user operating the terminal device is the target user, and the current operating authority of the target application can be obtained; when the information of the target application indicates that the function it is currently executing is the function of playing music, the determined number value N is equal to 2; that is, the most recent 2 identity authentication results are required to show that the user operating the terminal device is the target user, and the current operating authority of the target application can be obtained.

[0104] After determining the user's operating authority for the terminal device or the target application in the above manner, the user's access to the terminal device or the target application is controlled according to the operating authority. For example, if it is determined that the user has the operating authority for the terminal device or the target application, the user is allowed to currently operate the terminal device or the target application, for example, a first prompt message is displayed to prompt the user to use the terminal device or the target application within a preset time period; if it is determined that the user does not have the operating authority for the terminal device or the target application, the user is not allowed to currently operate the terminal device or the target application, or enters the secondary authorization process, for example, prompting the target user to perform identity authentication.

[0105] Optionally, the secondary authorization process can be as follows: output a second prompt message to prompt the target user of the terminal device to perform identity authentication; then, receive the identity authentication information input by the user; if the user operating the terminal device is determined to be the target user based on the identity authentication information, then grant the operation permission to the terminal device or the target application. It should be noted that the identity authentication mechanism in the secondary authorization process can be regarded as a higher level of authentication, which can more accurately identify whether the user operating the terminal device is the target user. Therefore, even if it was determined last time that the user does not have the operation permission to the terminal device or the target application, as long as the identity authentication result in the secondary authorization process shows that it is the target user who is operating, the user can still be granted the operation permission to the terminal device or the target application.

[0106] Optionally, when the secondary authorization is to determine the user's operating authority for the target application, the secondary authorization mechanism is not applicable to all applications, and the specific applications that can use the secondary authorization mechanism can be preset. For example, according to the type of application, which ones can use the secondary authorization mechanism and which ones cannot use the secondary authorization mechanism, for example, game applications and music applications can use the secondary authorization mechanism. In this case, the following operations need to be performed before the secondary authorization: determine the type of the target application; when the type of the target application is the preset first preset type, perform the step of outputting the second prompt information to prompt the target user of the terminal device to perform identity authentication. Optionally, which applications are granted operating authority after the secondary authorization can be recorded in the terminal device, so that when the user uses the application again next time, the terminal device determines the current operating authority of the target application based on multiple identity authentication results and the information of the application, and does not grant the user currently operating the terminal device the operating authority of the target application. Then, because the terminal device records the history of granting the operating authority to the target application when the secondary authorization was previously granted, the terminal device still grants the user the operating authority to the target application this time without the need for secondary authorization again.

[0107] Optionally, if it is determined based on the authentication results of multiple identity authentications and the information of the currently running target application that the user currently operating the terminal device does not have the operating authority for the target application, and the target application does not belong to the preset first preset type, the operation of the target application is restricted.

[0108] Optionally, the restriction on operations on the target application may specifically include: exiting the display of the target application, or displaying an interface for blocking the content displayed by the application to prevent the user from using it, or displaying partial content of the target application other than private content, or displaying a prompt message to prompt the user that he does not have permission to view the private content in the target application, or prohibiting the target application from being called from a third-party device.

[0109] exist Figure 4A In the method shown, after the terminal device or target application has performed identity authentication and passed the authentication, the user operating the terminal device or target application continues to be authenticated, and information is fed back to the user based on one or more identity authentication results obtained by continuing the authentication, so that the user can access the terminal device or target application within the scope of the permission. This continuous identity authentication method can continuously ensure the security of the terminal device or target application.

[0110] See also Figure 4B , Figure 4B This is a user rights management method provided by the embodiment of the present application. The method can be based on Figure 1 The terminal shown in the figure is implemented, and this method can be considered as Figure 4A A more specific implementation of the method embodiment shown in the figure specifically describes how to determine the current operation permissions of the target application based on the identity authentication results of multiple identity authentications, corresponding to Figure 4A In the case B of the optional solution 2 in the illustrated embodiment, the method includes but is not limited to the following steps:

[0111] Step S421: The terminal device identifies information of the currently running target application.

[0112] Specifically, the target application can be an application currently running on the terminal, or it can be an application currently running on a third-party device (this case can also be called a third-party application). The information identifying the currently running target application can also be considered to identify the current application scenario of the target application. The target application information includes the type of the target application and / or the function currently executed by the target application. For example, the target application information includes the type of the target application; for another example, the target application information includes the function currently executed by the target application; for another example, the target application type and the function currently executed by the target application. Optionally, in addition to the information listed above, the target application information can also include other information, and the specific information is not limited here.

[0113] It can be understood that each application has a corresponding type. For example, NetEase Music, QQ Music, etc. belong to the music type; Taobao, Tmall, JD.com, etc. belong to the shopping type; Alipay, Tenpay, etc. belong to the payment type, and applications on third-party devices belong to the third-party application type, and so on. Figure 4B The payment type is used as an example for illustration. The type of application can be determined by its name, description file, type identifier and other information.

[0114] It is understandable that each application usually has one or more functions. For example, the Alipay application has functions such as transfer, payment, Ant Insurance, and social security inquiry. For another example, the Taobao application has functions such as product search, adding shopping, order inquiry, applying for after-sales service, asking someone to pay, and payment.

[0115] Specifically, the information of the target application can be obtained by identifying the program of the terminal device (which can be considered as system-active, such as the active identification of Huawei's mobile phone intelligent scene recognition system), or it can be identified by a third-party platform that has established a communication connection with the terminal device or a third-party application running on the terminal device by calling the terminal device's API (which can be considered as business-active).

[0116] Step S422: The terminal device determines the modality for identity authentication based on the information of the target application.

[0117] Specifically, during the identity authentication process, the modality on which the authentication is based will be selected first. The modality may refer to the source or form of information. For example, fingerprint recognition, iris recognition, face recognition, user operation (habit) recognition, etc. all belong to different modalities. In the embodiment of the present application, the modality selected for each authentication may be one or more (i.e., multimodal). There are many ways to select a modality. For ease of understanding, an optional method is given below.

[0118] Optionally, a matching relationship between application information and modality may be pre-configured, and once the application information is determined, the final modality for identity authentication may be determined based on the matching relationship.

[0119] Optionally, a matching relationship between application information and candidate modalities may be preconfigured, and then during the operation of the target application, the candidate modalities corresponding to the target application information are matched according to the matching relationship, wherein the candidate modalities include at least one modality; wherein the matching relationship defines candidate modalities corresponding to at least two types of information, and the candidate modalities corresponding to any two of the at least two types of information are not completely the same. Optionally, if the application information includes the application type but does not include the currently executed function, Table 1 illustrates the candidate modalities corresponding to game applications, shopping applications, and music applications.

[0120] Referring to Table 1, when the target application is Honor of Kings, it belongs to the category of game applications, so its corresponding candidate modalities include fingerprint recognition, user operation, and face recognition; when the target application is JD.com, it belongs to the category of shopping applications, so its corresponding candidate modalities include face recognition, fingerprint recognition, and iris recognition; and the rest are similar.

[0121] After the candidate modalities corresponding to the target application are determined, one or more modalities among the candidate modalities corresponding to the target application are used as the final modalities for identity authentication of the user operating the terminal device. For example, when the target application is a shopping application, one or more modalities are selected from face recognition, fingerprint recognition, and iris recognition corresponding to the shopping application as the final modalities for identity authentication. For example, a multi-modality consisting of face recognition and fingerprint recognition is selected; for another example, a multi-modality consisting of fingerprint recognition and iris recognition is selected. Optionally, one or more modalities can be selected from the candidate modalities corresponding to the target application as the modalities for identity authentication of the user operating the terminal device according to the environmental parameters in the environment in which the terminal device is currently located. That is to say, when selecting one or more modalities from the candidate modalities corresponding to the type described in the target application, the selection can be made based on the environmental parameters in the environment in which the terminal device is currently located. For example, when it is determined according to the environmental parameters that the terminal device is currently in the dark, a modality other than face recognition and iris recognition is used, which can improve the accuracy of subsequent identity recognition.

[0122] Step S423: The terminal device collects information according to the determined modality to obtain identity information for identity identification.

[0123] Specifically, this link may include modality acquisition, modality detection, feature extraction, feature fusion, decision-making and other processes (of course, some of these links may also be omitted), wherein modality acquisition is specifically performed based on the determined modality. For example, if the determined modality is a multi-modality consisting of iris recognition and fingerprint recognition, then iris information and fingerprint information may be collected; then the collected original information is processed accordingly, such as modality detection (for example, used to detect whether there is available modal data under one or some modalities), feature extraction, feature fusion, classification decision, etc., so as to obtain refined data with better usability, which can be called identity information.

[0124] Step S424: The terminal device reads the acquired identity information at the configured security detection point.

[0125] Specifically, the terminal device needs to continuously authenticate the user operating the terminal device during operation. For example, multiple security detection points can be configured, and identity information is read at each security detection point for continuous authentication. The security detection point can be the default configuration of the terminal device (which can be called system active), or it can be configured by a third-party platform that has established a communication connection with the terminal device or a third-party application running on the terminal device by calling the API of the terminal device (which can be called business active).

[0126] There are at least two ways to configure the safety checkpoint:

[0127] In the first method, the security detection points are distributed according to a certain frequency rule. In this way, the identity information is read according to a preset frequency during the operation of the target application, and the user operating the terminal device is authenticated accordingly. For example, identity authentication is performed every two minutes, or every five minutes. The frequency can be preset as needed.

[0128] Method 2: The security detection point is configured based on business functions. It is understandable that many business functions can be realized on the terminal device, such as taking pictures, playing music, playing games, purchasing game equipment, paying, transferring money, modifying account information, etc. Some of the functions can be marked as preset functions. Whenever a user wants to use a preset function, there will be a security detection point, that is, the identity information needs to be read. In other words, during the operation of the target application, the identity information is read whenever a triggering operation of the preset function of the target application is detected, and the user operating the terminal device is authenticated accordingly. The number of preset functions of the target application is greater than or equal to 1. For example, if payment, transfer, and modification of account information are marked as preset functions, then when the user triggers any of the functions of payment, transfer, and modification of account information, the terminal device will perform identity authentication.

[0129] It should be noted that when configuring the security detection points, the type of target application (i.e., scenario) can be taken into consideration. The configuration results of the security detection points of different types of applications may be different. For example, if the target application is a music application, the security detection points can be set more densely; if the target application is a payment application, the security detection points can be set more densely. In addition, the configuration of the security detection points can be set in step S424, or in other previous steps, for example, in step S421.

[0130] Step S425: The terminal device performs identity authentication based on the identity information, and obtains M consecutive identity authentication results in time sequence.

[0131] Step S426: The terminal device determines the current operation authority of the target application based on multiple identity authentication results among the above M identity authentication results and the information of the target application. Optionally, M is equal to the number of authentication results obtained.

[0132] Specifically, the multiple identity authentication results are all identity authentication results obtained during the operation of the target application, or the multiple identity authentication results include the identity authentication results during the operation of the target application and the identity authentication results during the operation of the previous application. In short, it is necessary to determine based on two different identity authentication results in time sequence and the type of the target application, reflecting the "security defense chain" type of identity authentication mechanism. Among them, the previous application is the last application that was run before running the target application. For example, after running the Taobao client, the user exits from the Taobao client and enters the Alipay client. If the target application is Alipay, the previous application is Taobao. It can be understood that the principle of obtaining the identity authentication result during the operation of the previous application is the same as the principle of obtaining the identity authentication result during the operation of the target application.

[0133] In the embodiment of the present application, the above-mentioned multiple identity authentication results can be multiple identity authentication results that are continuous in time sequence, or multiple identity authentication results that are discontinuous in time sequence. For example, if the previous application is running from 6:00 to 6:15 on January 10, 2019, and the target application is running from 6:15 to 6:20 on January 10, 2019, and the identity authentication results are obtained at 6:00, 6:04, 6:08, 6:11, 6:12, 6:15, 6:16, 6:18, and 6:20, respectively, then 6:16 and 6:18 can be considered as two identity authentication results that are continuous in time sequence, 6:12, 6:15, and 6:16 can also be considered as three identity authentication results that are continuous in time sequence, and 6:16 and 6:20 can be considered as two identity authentication results that are discontinuous in time sequence. The multiple times may be two times, three times, four times, five times, or other times. The specific number of times can be pre-configured as needed and is not limited here.

[0134] In the embodiment of the present application, when the terminal device determines the current operation authority of the target application, the first aspect is to consider multiple identity authentication results, and the second aspect is also to consider the information of the target application; the second aspect is mainly to consider that the information of the application is different and its security level is often different. The embodiment of the present application has higher requirements for identity authentication of applications with high security levels, and relatively lower requirements for identity authentication of applications with low security levels. For example, Taobao, JD.com, and Vipshop belong to shopping applications, and NetEase Music, QQ Music, and Kuwo Music belong to music applications. The security level of music applications is obviously lower than that of shopping applications (involving financial transactions), so the requirements of shopping applications for identity authentication results can be relatively higher. For another example, for the same application, the security levels of the various business functions it includes are often different. For example, the security level of the function of querying goods in the Taobao application is lower than the security level of goods payment, so the requirements of the goods payment function for identity authentication results are higher than the requirements of the goods query function for identity authentication results. The following provides two optional cases to describe how to combine the first and second aspects to comprehensively determine the current operation authority of the target application.

[0135] Solution 1: If there are authentication results exceeding the target ratio threshold in the multiple identity authentication results that indicate that the user operating the terminal device is the target user (for example, the owner of the terminal device), then the current operation permission of the target application is determined to be allowed; if there are no authentication results exceeding the target ratio threshold in the multiple identity authentication results that indicate that the user operating the terminal device is the target user, then the current operation permission of the target application is determined to be not allowed; wherein the target ratio threshold is determined according to the information of the target application, and can be pre-configured as needed. For example, if the multiple times are 5 times, when the information of the target application indicates that its type is a shopping application, the target ratio threshold can be set to 100%, that is, the target application current operation permission can be obtained by requiring that the latest 5 identity authentication results all show that the user operating the terminal device is the target user; when the information of the target application indicates that its type is a music application, the target ratio threshold can be set to 20%; that is, the target application current operation permission can be obtained by requiring that at least one of the latest 5 identity authentication results shows that the user operating the terminal device is the target user.

[0136] Solution 2: If the last authentication result among the multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then the current operation permission of the target application is determined to be allowed; if the last authentication result among the multiple authentication results indicates that the user operating the terminal device is not the target user, and / or the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then the current operation permission of the target application is determined to be not allowed; wherein the target ratio threshold is determined based on the information of the target application. It can be seen that, compared with Solution 1, Solution 2 requires the last authentication result obtained in time sequence (if a blockchain-like architecture is adopted, it is the last authentication result obtained by consensus in time sequence) to show that the user operating the terminal device is the target user, which further improves security.

[0137] Solution three, determine the number value N according to the information of the target application; optionally, the terminal device stores the number values ​​corresponding to various application information, so the number value N can be determined based on the corresponding relationship. After determining the number value N according to the target application, determine whether the N most recent identity authentication results in time sequence all show that the user operating the terminal device is the target user. If so, determine that the current operating authority of the target application is to allow operation. For example, when the information of the target application indicates that the function it is currently executing is a payment function, the determined number value N is equal to 5, that is, the five most recent identity authentication results are required to show that the user operating the terminal device is the target user, so that the current operating authority of the target application can be obtained; when the information of the target application indicates that the function it is currently executing is the function of playing music, the determined number value N is equal to 2; that is, the two most recent identity authentication results are required to show that the user operating the terminal device is the target user, so that the current operating authority of the target application can be obtained.

[0138] In an embodiment of the present application, if the current operating permission of the target application is determined to allow operation, the user currently operating the terminal device is allowed to use the first function of the target application currently requested. For example, if the user currently needs to use the payment function on the target application, then the payment function is the first function; if the user currently needs to use the transfer function on the target application, then the transfer function is the first function.

[0139] In the embodiment of the present application, if the current operation permission of the target application is determined to be not allowed, the user currently operating the terminal device is not allowed to use the first function of the target application currently requested.

[0140] Optionally, after not allowing the use of the first function, secondary authorization may be allowed, for example, outputting a second prompt information to prompt the target user of the terminal device to perform identity authentication; then, receiving the input identity authentication information; if it is determined that the user operating the terminal device is the target user according to the identity authentication information, the user currently operating the terminal device is allowed to use the first function of the target application currently requested. It should be noted that the identity authentication mechanism in the secondary authorization process can be regarded as a higher level of authentication, which can more accurately identify whether the user operating the terminal device is the target user. Therefore, even if the first function was not allowed to be used last time, as long as the identity authentication result in the secondary authorization process shows that the target user is operating, the user can still be allowed to use the first function of the target application. If the secondary authorization result shows that the user operating the terminal is not the target user, the use of the target application is restricted, for example, the first function of the target application is not allowed to be used. For example, the display of the target application is exited, or an interface for blocking the content displayed by the application is displayed to prevent the user from using it, or part of the content in the target application other than the private content is displayed, or a prompt message is displayed to prompt the user that he has no authority to view the private content in the target application, or the target application is prohibited from being called from a third-party device, etc.

[0141] Among them, the secondary authorization mechanism can not be used for all applications, and the specific applications that can use the secondary authorization mechanism can be preset. For example, according to the type of application, it is divided into which applications can use the secondary authorization mechanism and which cannot use the secondary authorization mechanism. For example, game applications and music applications can use the secondary authorization mechanism. In this case, it is necessary to perform the following operations before the secondary authorization: determine the type of the target application; when the type of the target application is the first preset type, execute the step of outputting the second prompt information to prompt the target user of the terminal device to perform identity authentication.

[0142] In addition, which applications are allowed to use the first function after the second authorization can be recorded in the terminal device. In this way, when the user uses the application next time, the terminal device determines the current operating authority of the target application based on multiple identity authentication results and the information of the application, and does not allow the user currently operating the terminal device to use the first function of the currently requested application. Then, because the terminal device has recorded the history of the previous second authorization, the terminal device still allows the user to use the first function of the currently requested application without the need for a second authorization. Figure 4BIn the described method, the target application is authenticated by continuous identity authentication (i.e., full-process tracking authentication); then, the current operation permissions of the target application are determined by combining multiple identity authentication results (i.e., chain authentication) and the information of the target application (i.e., scenario); compared with obtaining the use permissions of all applications through a single authentication, this continuous identity authentication method can identify the identity of the user currently operating the target application more timely and accurately, and has higher security.

[0143] Figure 5 This is a user rights management method provided by the embodiment of the present application, which focuses on Figure 4B The secondary authorization process in the illustrated embodiment is as follows: Figure 5 The principles of each operation in the method shown can refer to Figure 4B Description of the illustrated embodiment, which includes:

[0144] 501. Collect scene information and identify scenes accordingly, and identify whether the currently running target application is a payment scene, a chat scene, a game scene, an album browsing scene, or other scenes.

[0145] 502. Input the identified scenario to the continuous identity authentication service, so that the continuous identity authentication service determines the modality for identity recognition according to the scenario, and obtains the identity information for identity authentication based on the determined modality (which may include modality acquisition, modality detection, feature extraction, feature fusion, decision-making, etc.), and continuously authenticates the user operating the terminal device accordingly.

[0146] 503. Input the identified scenario to the dynamic authorization control service.

[0147] 504. The continuous identity authentication service inputs the multiple identity authentication results to the dynamic authorization control service. Accordingly, the dynamic authorization control service makes authorization decisions based on the input multiple identity authentication results and scenarios. The decision-making process is as follows:

[0148] a. If the authorization is successful (i.e. the operation is allowed as described above), then return to execute the above step 501;

[0149] b. If the authorization is unsuccessful, one option is to directly terminate the use of the first service currently running in the target application, or to restrict the use of the target application, for example, not allowing the use of the first function of the target application, for example, exiting the display of the target application, or displaying an interface for blocking the content displayed by the application to prevent the user from using it, or displaying part of the content in the target application except for the private content, or displaying a prompt message to prompt the user that he has no authority to view the private content in the target application, or prohibiting calling the target application from a third-party device, etc.; Another option is to trigger a secondary authorization mechanism, at which time a corresponding interface can be displayed to prompt the target user to perform identity authentication, and then detect the identity authentication information entered by the user; if it is determined based on the identity authentication information that the user operating the terminal device is indeed the target user, then the authorization is successful (i.e., the operation is allowed as described above), and this process is the secondary authorization.

[0150] Then, the terminal device can control the user's use of the first function of the target application according to the result of the authorization decision.

[0151] Optionally, the target application may be deployed on a third-party device or platform instead of the terminal device. In this case, the entire identity authentication and authorization decision process also includes steps 505 and 506, as described below.

[0152] 505. A third-party device (such as an IoT device) or platform registers with the terminal device, and requests the terminal device to continuously authenticate the target application running on the third-party device or platform and make an authorization decision based on the authentication result. Step 505 may also be performed in advance, for example, before the above step 501.

[0153] 506. The terminal device sends the result of the authorization decision to the third-party device or platform. Accordingly, the third-party device or platform controls the user's use of the first function of the target application according to the result of the authorization decision.

[0154] The internal execution principles of the above steps 501-506 have been introduced in steps S421 and S422 and will not be repeated here.

[0155] against Figure 5 The user rights management method shown below is combined with Figure 6-Figure 8 Three specific application cases are provided.

[0156] Case 1: Dynamic authorization control for game applications, such as Figure 6 .

[0157] 601. If a non-machine owner (such as a child) enters the game scene, the scene recognition module will perform scene recognition and send the recognized game scene to the continuous identity authentication service. The continuous identity authentication service determines the mode corresponding to the game scene and continues to perform identity authentication based on it to obtain an identity authentication result.

[0158] 602. The user rights management in the dynamic authorization control service obtains the identity authentication result.

[0159] 603. User authority management makes authorization decisions based on multiple identity authentication results. The decision-making process is as follows:

[0160] 604. If the authorization is successful (i.e., the permission operation described above), the game is allowed to continue, for example, the game is allowed to be played within a specified time.

[0161] 605. If the authorization is unsuccessful, determine whether a second authorization (ie, re-authorization) is required.

[0162] 606. If secondary authorization is not allowed, the currently running game is not allowed to be operated, that is, the game is controlled, where the control method includes blocking the authorization interface (UI) (such as blocking the game interface so that the user can no longer operate it), exiting the current game, etc.

[0163] 607. If secondary authorization is allowed, a re-authorization UI interface is displayed to prompt the target user to perform identity authentication.

[0164] 608. The continuous identity authentication service detects the identity authentication information input by the user.

[0165] 609. If it is determined based on the identity authentication information that the user operating the terminal device is indeed the target user, the user authority management updates the user's operating authority so that the game is allowed to be used (ie, the secondary authorization is successful).

[0166] Case 2: Dynamic authorization control for privacy-related applications, such as Figure 7 .

[0167] 701. If a person other than the owner of the device (such as a stranger) browses the photo album, the scene recognition module will perform scene recognition and send the recognized privacy scene to the continuous identity authentication service. The continuous identity authentication service determines the mode corresponding to the privacy scene and performs continuous identity authentication accordingly to obtain an identity authentication result.

[0168] 702. The user rights management in the dynamic authorization control service obtains the identity authentication result.

[0169] 703. User authority management makes authorization decisions based on multiple identity authentication results. The decision-making process is as follows:

[0170] 704. If the authorization is successful (ie, the permission operation described above), the user is allowed to continue browsing the album content.

[0171] 705. If the authorization is unsuccessful, determine whether a second authorization (ie, re-authorization) is required.

[0172] 706. If secondary authorization is not allowed, browsing of the album is not allowed, i.e., browsing control, wherein the control method includes reminding the user through the authorization interface (UI) that the private content cannot be viewed, or directly filtering the private content, or prompting the user that the private content cannot or should not be viewed, etc.

[0173] 707. If secondary authorization is allowed, a re-authorization UI interface is displayed to prompt the target user to perform identity authentication.

[0174] 708. The continuous identity authentication service detects the identity authentication information input by the user.

[0175] 709. If it is determined based on the identity authentication information that the user operating the terminal device is indeed the target user, the user authority management updates the user's operating authority so that the album is allowed to be browsed (ie, the secondary authorization is successful).

[0176] Case 3: Dynamic authorization control for third-party applications (installed on third-party devices, which can be considered as the target application described above), such as Figure 8 .

[0177] 801. If a non-machine owner (such as a stranger) uses a third-party application in a third-party device (such as a speaker) to play music in the terminal device, the scene recognition module will perform scene recognition and send the recognized third-party application scene to the continuous identity authentication service. The continuous identity authentication service determines the modality corresponding to the third-party application scene, and continuously performs identity authentication based on it to obtain an identity authentication result. Among them, the third-party device has established a connection with the terminal device in advance and registered relevant information on the terminal device, so the terminal device can identify the third-party device and the third-party application on it.

[0178] 802. The user authority management in the dynamic authorization control service obtains the identity authentication result.

[0179] 803. User authority management makes authorization decisions based on multiple identity authentication results. The decision-making process is as follows:

[0180] 804. If the authorization is successful, third-party authorization management is performed to allow the current user to operate the third-party application on the third-party device.

[0181] 805. If the authorization is unsuccessful, determine whether a second authorization (ie, re-authorization) is required.

[0182] 806. If secondary authorization is not allowed, third-party authorization management is performed to prevent the current user from operating the third-party application on the third-party device.

[0183] 807. If secondary authorization is allowed, a re-authorization UI interface is displayed to prompt the target user to perform identity authentication.

[0184] 808. The continuous identity authentication service detects the identity authentication information input by the user.

[0185] 809. If it is determined according to the identity authentication information that the user operating the terminal device is indeed the target user, the user authority management updates the user operation authority to allow the current user to operate the third-party application on the third-party device.

[0186] It should be noted that the identity authentication in the embodiment of the present application can be completed by a single virtual computing node, for example, identity authentication is performed on an operating system. Of course, the identity authentication in the embodiment of the present application can also be completed by multiple virtual computing nodes, for example, the multiple virtual computing nodes are multiple operating systems installed on the terminal device, or the multiple virtual computing nodes are at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device. When it is completed by multiple virtual computing nodes, it can be considered that these multiple virtual computing nodes constitute a blockchain-like architecture, and its specific identity authentication process can be: during the operation of the target application, the user operating the terminal device is authenticated by multiple virtual computing nodes respectively; then the multiple virtual computing nodes are used to reach a consensus on the identity authentication results obtained by each of the multiple virtual computing nodes, and an identity authentication result is obtained during the operation of the target application. For example, at a certain moment, multiple virtual computing nodes have all performed identity authentication, then these multiple virtual computing nodes will reach a consensus on the identity authentication results obtained at that moment, and obtain a consensus result, which can be used as the final identity authentication result at that moment. For another example, within a certain period of time (such as 30 seconds), multiple virtual computing nodes have all performed identity authentication, then these multiple virtual computing nodes will reach a consensus on the identity authentication results obtained during this period of time to obtain a consensus result, and this consensus result can be used as the final identity authentication result for this period of time. In this case, when the operation authority is subsequently determined based on multiple identity authentication results, the multiple identity authentication results refer to the multiple identity authentication results obtained after the consensus based on the blockchain-like architecture, that is, the multiple identity authentication results on the security defense chain after consensus. Optionally, the modalities based on which the multiple virtual computing nodes perform identity authentication are different, which can improve the accuracy of identity authentication.

[0187] See also Fig. 9 , Fig. 9 This is a user rights management method provided by the embodiment of the present application, which focuses on Figure 4B In the embodiment shown, identity authentication is performed by multiple virtual computing nodes.

[0188] In the case where the point is completed, the multiple virtual computing nodes include REE nodes, TEE nodes and SensorHub nodes, which constitute a blockchain-like architecture. Fig. 9 The principles of each operation in the method shown can refer to Figure 4B The corresponding description of the illustrated embodiment, Fig. 9 The methods shown include:

[0189] 901. A scene recognition module in a REE node determines the type of a target application (ie, scene).

[0190] 902. The security defense chain engine in REE sets security detection points according to the scenario.

[0191] 903. The multimodal computing engine in the REE node determines the modality to be adopted by the REE node and the modality to be adopted by the TEE node when authenticating the target application according to the scenario. Then, the REE node and the TEE node collect modal data according to the determined modality, and fuse the collected modal data in the TEE node to obtain identity information for identity authentication.

[0192] 904. The security defense chain engine in REE obtains identity information from the multimodal computing engine at each security detection point.

[0193] 905. The security defense chain engine in REE authenticates the identity information of each security detection point and obtains the identity authentication results of each security detection point; then the obtained identity authentication results and the identity information of each security detection point are broadcast to the blockchain-like architecture. Correspondingly, each node in the blockchain reaches a consensus on the received identity authentication results based on the received identity information of each security detection point and obtains the consensus identity authentication results. Optionally, a consensus identity authentication result can be obtained for each security detection point, and the consensus identity authentication results of each security detection point constitute a time-series continuous identity authentication result, that is, a security defense chain identity authentication result.

[0194] 906. Each node in the blockchain-like architecture selects the accounting node through a formula algorithm. Each node can include REE nodes, TEE nodes, SensorHub nodes and others (such as IOT device nodes accessed by third parties). The consensus algorithm can consider node asymmetry and adopt a similar blockchain proof of stake (POS) / proof of importance (POI) mechanism. Different nodes are assigned different weights according to different security levels.

[0195] 907. The security defense chain engine of the selected accounting node (such as TEE node) records the block content after consensus.

[0196] 908. The accounting node publishes a ledger synchronization notification to the nodes in the blockchain system.

[0197] 909. After receiving the synchronization notification, each node in the blockchain verifies the ledger and maintains the consistency of the defense chain data through the synchronization mechanism.

[0198] 910. When the ledger is updated, the decision authorization module of the REE node is triggered to make authorization decisions based on the historical records on the chain.

[0199] 911. The dynamic authorization control service in the REE node performs dynamic authorization control based on the decision result of the decision authorization module. The principle of dynamic authorization control has been introduced in detail above and will not be repeated here.

[0200] The method of the embodiment of the present application is described in detail above, and the device of the embodiment of the present application is provided below.

[0201] See also Fig.10 , Fig.10 A terminal device 100 is provided in an embodiment of the present application. The terminal device 100 includes a processor 1001, a memory 1002 and a communication interface 1003. The processor 1001 and the memory 1002 are interconnected via a bus.

[0202] The terminal device 100 may also include an input device and an output device. For example, the input device may include a touch screen, a physical button, a microphone, etc.; the output device may be a display screen, a voice output circuit, etc.

[0203] The memory 1002 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or portable read only memory (CD-ROM), and the memory 1002 is used for related computer programs and data.

[0204] The processor 1001 may be one or more central processing units (CPUs). When the processor 1001 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.

[0205] In a first solution, the processor 1001 in the terminal device 100 reads a computer program stored in the memory 1002 to perform the following operations:

[0206] Obtain the identity information of the user currently holding the terminal device and perform identity authentication on the user, wherein the terminal device or the target application has performed identity authentication at least once and is in a running state after passing the identity authentication; feedback information is provided to the user based on the authentication results of one or more identity authentications, so that the user can access the terminal device or the target application within the scope permitted by the authority.

[0207] In the above method, after the terminal device or target application has performed identity authentication and passed the authentication, the user operating the terminal device or target application continues to be authenticated, and information is fed back to the user based on one or more identity authentication results obtained by the continued authentication, so that the user can access the terminal device or target application within the scope of the permission. This continuous identity authentication method can continuously ensure the security of the terminal device or target application.

[0208] In one possible implementation, the information is fed back to the user based on the authentication results of one or more identity authentications so that the user can access the terminal device or the target application within the scope permitted by permissions, including: outputting prompt information to the user based on the authentication results of multiple identity authentications, and the prompt information is used to prompt whether the user operating the terminal device or the target application has changed during operation.

[0209] In this way, the target user can instantly know whether the terminal device has been operated by other users, so as to instantly evaluate possible security issues and risks and provide immediate remedial measures for possible security issues and risks.

[0210] In a possible implementation manner, the prompt information includes a voice prompt, a text prompt or an image prompt, or the output prompt information includes requesting the user to input identity information again for identity authentication.

[0211] In a possible implementation, the information is fed back to the user based on the authentication results of one or more identity authentications so that the user can access the terminal device or the target application within the scope of the permission, including: determining the user's current operation authority for the terminal device or the target application based on the authentication results of one or more identity authentications; and controlling the user's access to the terminal device or the target application based on the operation authority. It can be understood that after the terminal device or the target application has performed identity authentication and the authentication has passed, one or more identity authentications are performed and the operation authority is further determined based on the one or more identity authentication results, so that the security level of the determined operation authority is higher, thereby improving the security of the terminal device.

[0212] In a possible implementation, the obtaining of the identity information of the user currently holding the terminal device and performing identity authentication on the user includes: collecting the identity information of the user currently holding the terminal device at a preset frequency, and performing identity authentication on the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication. That is, identity authentication is performed at a preset frequency, so as to achieve the purpose of continuous identity authentication.

[0213] In a possible implementation, the obtaining of the identity information of the user currently holding the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device whenever a triggering operation on a preset function is detected, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication, and the number of preset functions in the terminal device is greater than or equal to 1. That is, identity authentication is performed whenever the first application runs to the preset function, thereby achieving the purpose of continuous identity authentication.

[0214] In a possible implementation, the identity information used in the identity authentication includes a fusion of one or more of the user's fingerprint information, facial information, iris information, or voiceprint information.

[0215] In one possible implementation, controlling the user's current access to the terminal device or the target application based on the operating authority includes: if it is determined that the user does not have the operating authority for the terminal device or the target application, outputting a prompt message to prompt the target user to perform identity authentication; receiving re-entered identity authentication information; and if it is determined that the user operating the terminal device or the target application is the target user based on the re-entered identity authentication information, granting the operating authority for the terminal device or the target application.

[0216] In an embodiment of the present application, after the user is initially denied operating permissions for the terminal device or target application, the target user may be further prompted to perform secondary authorization. If the secondary authorization is successful, the user will still be granted operating permissions for the terminal device or target application. This improves the flexibility of authorization and can meet user needs in more application scenarios.

[0217] In a possible implementation, if it is determined that the user currently does not have the operating authority for the terminal device or the target application, then a prompt message is output to prompt the target user to perform identity authentication, including: if it is determined that the user currently does not have the operating authority for the terminal device or the target application, and the type of the target application is a first preset type, then a prompt message is output to prompt the target user to perform identity authentication. That is to say, only applications of a specific type are pre-configured to be eligible for secondary authorization, so that different management of various applications at different security levels can be achieved.

[0218] In one possible implementation, determining the user's current operating authority over the terminal device or the target application based on the authentication results of one or more identity authentications includes: determining whether the user currently operating the terminal device has the operating authority over the terminal device or the target application based on the authentication results of multiple identity authentications and information about the currently running target application; the information about the target application includes the type of the target application and / or the function currently executed by the target application.

[0219] In the above method, the terminal device or target application is authenticated by continuous identity authentication (i.e., full-process tracking authentication); then, the user's operating authority for the terminal device or target application is determined by combining multiple identity authentication results (i.e., chain authentication) and the information of the target application; this continuous identity authentication and determination of operating authority based on multiple authentication results of continuous authentication can more timely and accurately identify the identity of the user currently operating the terminal device or target application, and has higher security.

[0220] In a possible implementation, the method of determining whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the currently running target application includes: if the authentication results of the multiple identity authentications exceed the target ratio threshold, indicating that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined based on the information of the target application (i.e., the scenario), so that the control of permissions meets the security requirements of the target application to the greatest extent.

[0221] In a possible implementation, the method of determining whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on at least multiple authentication results of the identity authentication and the information of the currently running target application includes: if the last authentication result among the multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the needs of the target application to the greatest extent. In addition, requiring the most recent authentication result to be the target user further improves security.

[0222] In a possible implementation, the method further includes: if the last identity authentication result among the multiple identity authentication results indicates that the user operating the terminal device is not the target user, and / or the authentication result among the multiple identity authentication results that does not exceed the target ratio threshold indicates that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application.

[0223] In a possible implementation, the authentication result of any one of the multiple authentications is obtained by multiple virtual computing nodes respectively authenticating the user operating the terminal device and reaching consensus on the authentication results obtained by each of them. It can be understood that since multiple virtual computing nodes are used for joint authentication, even if a computing node is maliciously hacked and produces an authentication result that is not conducive to security, other virtual computing nodes that have not been hacked can still obtain a relatively safe final authentication result after reaching consensus with the hacked virtual computing node, thereby improving the security of identity authentication.

[0224] In a possible implementation, the multiple virtual computing nodes are different operating systems installed on the terminal device, or at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, and the multiple virtual computing nodes are based on different modalities for identity authentication. It can be understood that since the multiple virtual computing nodes are different operating systems installed on the terminal device, or at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, the multiple virtual computing nodes are in a relatively isolated environment. Even if one of them is maliciously hacked, the remaining virtual computing nodes can still operate normally, which improves the security of identity authentication. In addition, since the modalities based on the identity authentication of each virtual computing node are different (for example, not completely the same), the form of the modality is enriched, making the identity authentication process difficult to be cracked by the outside world; for example, if there is only one modality of fingerprint recognition, then when the user's fingerprint information is leaked, the identity authentication process is easy to be cracked by the outside world; however, if the user's operating behavior habits when using each application, the user's various biometrics, etc. are all included in the modal authentication, then, even if some of the user's feature information is leaked, it will still not bring substantial security risks to the identity authentication link of the terminal device.

[0225] It should be noted that the implementation of each operation can also refer to Figure 4A , Figure 4B , Figure 5-Figure 9 The corresponding description of the method embodiment shown.

[0226] In the second solution, the processor 1001 in the terminal device 100 reads the computer program stored in the memory 1002 to perform the following operations:

[0227] If it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device has the operating authority for the terminal device or the target application, a first prompt message is displayed to prompt the user to allow the user to use the terminal device or the target application within a preset time period; if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application, the target user is prompted to perform identity authentication.

[0228] Using the above method, after initially denying the user permission to operate the terminal device or target application, the target user can be further prompted to perform secondary authorization. If the secondary authorization is passed, the user will still be granted permission to operate the terminal device or target application. This improves the flexibility of authorization and can meet user needs in more application scenarios.

[0229] In one possible implementation, if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority to the terminal device or the target application, the target user is prompted to perform identity authentication, including: if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority to the terminal device or the target application, a second prompt message is output to prompt the target user to perform identity authentication; the identity authentication information is received again; if it is determined based on the re-entered identity authentication information that the user operating the terminal device or the target application is the target user, the operating authority to the terminal device or the target application is granted.

[0230] In a possible implementation, the authentication result is used to determine the user's operating authority over the target application; if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority over the terminal device or the target application, then a second prompt message is output to prompt the target user to perform identity authentication, including: if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority over the terminal device or the target application, and the target application belongs to a preset first preset type, then a second prompt message is output to prompt the target user to perform identity authentication. In other words, only applications of a specific type are pre-configured to be eligible for secondary authorization, so that differential management of various applications at different security levels can be achieved.

[0231] In a possible implementation, it further includes: if it is determined according to the authentication results of one or more identity authentications that the user currently operating the terminal device does not have the operating authority for the terminal device or the target application, and the target application does not belong to the preset first preset type, then restricting the operation of the target application. It can be understood that some target applications have a relatively high security level. As long as it is determined that the user does not have the operating authority for them, the operating authority of the target application is directly restricted, thereby improving the security level of such target applications.

[0232] In one possible implementation, the restriction on operations on the target application includes: exiting the display of the target application, or displaying an interface for blocking the content displayed by the application to prevent the user from using it, or displaying partial content of the target application other than private content, or displaying a prompt message to prompt the user that he does not have permission to view the private content in the target application, or prohibiting the user from calling the target application from a third-party device.

[0233] In a possible implementation, before determining that the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of one or more identity authentications, it also includes: obtaining the identity information of the user currently operating the terminal device and authenticating the user, and the terminal device or the target application has performed at least one identity authentication and is in an operating state after the identity authentication is passed. It can be understood that after the terminal device or the target application has performed the identity authentication and the authentication is passed, the user operating the terminal device or the target application continues to be authenticated, and information is fed back to the user based on the one or more identity authentication results obtained by the continued authentication, so that the user can access the terminal device or the target application within the scope of the permission. This continuous identity authentication method can continuously ensure the security of the terminal device or the target application.

[0234] In a possible implementation, the obtaining of the identity information of the user currently operating the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device at a preset frequency, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication. That is, identity authentication is performed at a preset frequency, so as to achieve the purpose of continuous identity authentication.

[0235] In a possible implementation, the obtaining of the identity information of the user currently operating the terminal device and authenticating the user includes: collecting the identity information of the user currently holding the terminal device whenever a triggering operation on a preset function is detected, and authenticating the user operating the terminal device according to the identity information collected each time, so as to obtain one or more authentication results of identity authentication, wherein the identity information collected each time is used to obtain an authentication result of identity authentication, and the number of preset functions in the terminal device is greater than or equal to 1. That is, identity authentication is performed each time the first application runs to the preset function, thereby achieving the purpose of continuous identity authentication.

[0236] In a possible implementation, the identity information used in the identity authentication includes a fusion of one or more of the user's fingerprint information, facial information, iris information, or voiceprint information.

[0237] In one possible implementation, if it is determined based on the authentication results of one or more identity authentications that the user currently operating the terminal device has the operating authority for the terminal device or the target application, then before displaying the first prompt information, it also includes: determining whether the user currently operating the terminal device has the operating authority for the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the target application; the information of the target application includes the type of the target application and / or the function currently executed by the target application.

[0238] In the above method, the terminal device or target application is authenticated by continuous identity authentication (i.e., full-process tracking authentication); then, the user's operating authority for the terminal device or target application is determined by combining multiple identity authentication results (i.e., chain authentication) and the information of the target application; this continuous identity authentication and determination of operating authority based on multiple authentication results of continuous authentication can more timely and accurately identify the identity of the user currently operating the terminal device or target application, and has higher security.

[0239] In a possible implementation, the determination of whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of multiple identity authentications and the information of the target application includes: if the authentication results of multiple identity authentications exceed the target ratio threshold, indicating that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined based on the information of the target application (i.e., the scenario), so that the control of permissions meets the security requirements of the target application to the greatest extent.

[0240] In a possible implementation, the method of determining whether the user currently operating the terminal device has the right to operate the terminal device or the target application based on the authentication results of multiple authentications and the information of the target application includes: if the last authentication result among the multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then determining that the user currently operating the terminal device has the right to operate the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the needs of the target application to the greatest extent possible. In addition, requiring the most recent authentication result to be the target user further improves security.

[0241] In a possible implementation, the authentication result of any one of the multiple authentications is obtained by multiple virtual computing nodes respectively authenticating the user operating the terminal device and reaching consensus on the authentication results obtained by each of them. It can be understood that since multiple virtual computing nodes are used for joint authentication, even if a computing node is maliciously hacked and produces an authentication result that is not conducive to security, other virtual computing nodes that have not been hacked can still obtain a relatively safe final authentication result after reaching consensus with the hacked virtual computing node, thereby improving the security of identity authentication.

[0242] In a possible implementation, the multiple virtual computing nodes are different operating systems installed on the terminal device, or at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, and the multiple virtual computing nodes are based on different modalities for identity authentication. It can be understood that since the multiple virtual computing nodes are different operating systems installed on the terminal device, or at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, the multiple virtual computing nodes are in a relatively isolated environment. Even if one of them is maliciously hacked, the remaining virtual computing nodes can still operate normally, which improves the security of identity authentication. In addition, since the modalities based on the identity authentication of each virtual computing node are different (for example, not completely the same), the form of the modality is enriched, making the identity authentication process difficult to be cracked by the outside world; for example, if there is only one modality of fingerprint recognition, then when the user's fingerprint information is leaked, the identity authentication process is easy to be cracked by the outside world; however, if the user's operating behavior habits when using each application, the user's various biometrics, etc. are all included in the modal authentication, then, even if some of the user's feature information is leaked, it will still not bring substantial security risks to the identity authentication link of the terminal device.

[0243] It should be noted that the implementation of each operation can also refer to Figure 4A , Figure 4B , Figure 5-Figure 9 The corresponding description of the method embodiment shown.

[0244] In the third solution, the processor 1001 in the terminal device 100 reads the computer program stored in the memory 1002 to perform the following operations:

[0245] Authenticate the user who operates the terminal device during the operation of the target application;

[0246] The current operation authority of the target application is determined based on multiple identity authentication results and information of the target application, wherein the multiple identity authentication results are all identity authentication results obtained during the operation of the target application, or the multiple identity authentication results include identity authentication results during the operation of the target application and identity authentication results during the operation of a second application, wherein the second application is the last application run before the target application is run.

[0247] In the above-mentioned device, the target application is authenticated by continuous identity authentication (i.e., full-process tracking authentication); then, the current operation permissions of the target application are determined by combining the multiple identity authentication results and the information of the target application (i.e., the scenario); compared with obtaining the use permissions of all applications through a single authentication, this continuous identity authentication method can identify the identity of the user currently operating the target application more timely and accurately, and has higher security.

[0248] In a possible implementation, the target application information includes the type of the target application and / or the function currently executed by the target application. It can be understood that the type of the target application and the function currently executed can reflect the current security requirements of the terminal device to a certain extent, so determining the operation authority based on the target application information can improve the security performance of the terminal device.

[0249] In a possible implementation, the identity authentication of the user operating the terminal device during the running of the target application is specifically performed as follows:

[0250] During the operation of the target application, the user operating the terminal device is authenticated through multiple virtual computing nodes respectively;

[0251] The multiple virtual computing nodes reach a consensus on the identity authentication results obtained by each of the multiple virtual computing nodes to obtain an identity authentication result during the operation of the target application. It can be understood that since a method of joint authentication of multiple virtual computing nodes is adopted, even if a computing node is maliciously hacked and produces an authentication result that is not conducive to security, other virtual computing nodes that have not been hacked can still obtain a relatively safe final authentication result after reaching a consensus with the hacked virtual computing node, thereby improving the security of identity authentication.

[0252] In a possible implementation, the multiple virtual computing nodes are different operating systems installed on the terminal device, or at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, and the multiple virtual computing nodes are based on different modalities for identity authentication. It can be understood that since the multiple virtual computing nodes are different operating systems installed on the terminal device, or at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device, the multiple virtual computing nodes are in a relatively isolated environment. Even if one of them is maliciously hacked, the remaining virtual computing nodes can still operate normally, which improves the security of identity authentication. In addition, since the modalities based on the identity authentication of each virtual computing node are different (for example, not completely the same), the form of the modality is enriched, making the identity authentication process difficult to be cracked by the outside world; for example, if there is only one modality of fingerprint recognition, then when the user's fingerprint information is leaked, the identity authentication process is easy to be cracked by the outside world; however, if the user's operating behavior habits when using each application, the user's various biometrics, etc. are all included in the modal authentication, then, even if some of the user's feature information is leaked, it will still not bring substantial security risks to the identity authentication link of the terminal device.

[0253] In a possible implementation manner, the processor is further configured to:

[0254] If the current operation permission of the target application is determined to be allowed, allowing the user currently operating the terminal device to use the first function of the target application currently requested;

[0255] If the current operation permission of the target application is determined to be not allowed, the user currently operating the terminal device is not allowed to use the first function of the target application currently requested.

[0256] In a possible implementation, the terminal device includes an output device and an input device; after not allowing a user currently operating the terminal device to use the first function of the target application currently requested, the processor is further configured to:

[0257] Outputting prompt information through the output device to prompt the target user of the terminal device to perform identity authentication;

[0258] Receiving identity authentication information input through the input device;

[0259] If it is determined according to the identity authentication information that the user operating the terminal device is the target user, the user currently operating the terminal device is allowed to use the first function of the currently requested target application.

[0260] In an embodiment of the present application, after the current user is not allowed to use the first function, the target user can be further prompted to perform secondary authorization. If the target user allows the current user to use the first function, the terminal device will eventually allow the current user to use the first function, thereby improving the flexibility of authorization and being able to meet user needs in more application scenarios.

[0261] In a possible implementation, after not allowing the user currently operating the terminal device to use the first function of the target application currently requested, and before outputting prompt information through the output device to prompt the target user of the terminal device to perform identity authentication, the processor is further configured to:

[0262] determining a type of the target application;

[0263] When the type of the target application is the first preset type, the output device outputs the prompt information to prompt the target user of the terminal device to perform identity authentication. In other words, only applications of a specific type are pre-configured to be eligible for secondary authorization, so that different security levels of various applications can be managed.

[0264] In a possible implementation, the step of authenticating the user operating the terminal device during the running of the target application includes:

[0265] During the operation of the target application, the user operating the terminal device is authenticated at a preset frequency. In other words, the identity authentication is performed at a preset frequency, thereby achieving the purpose of continuous identity authentication.

[0266] In a possible implementation, the identity authentication of the user operating the terminal device during the running of the target application is specifically performed as follows:

[0267] During the operation of the target application, whenever a trigger operation of a preset function of the target application is detected, the user operating the terminal device is authenticated, and the number of preset functions of the target application is greater than or equal to 1. In other words, whenever the target application runs to a preset function, identity authentication is performed, thereby achieving the purpose of continuous identity authentication. On the one hand, when the user continues to use various functions of the target application, the security of the terminal device can be fully guaranteed; on the other hand, when the user uses the function of the target application but does not switch the function, the number of identity authentications can be reduced, thereby reducing power consumption.

[0268] In a possible implementation, the current operation permission of the target application is determined based on multiple identity authentication results and the information of the target application, specifically:

[0269] If the authentication results of the multiple identity authentication results exceed the target ratio threshold, indicating that the user operating the terminal device is the target user, the current operation permission of the target application is determined to be allowed operation; wherein the target ratio threshold is determined according to the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the needs of the target application to the greatest extent.

[0270] In a possible implementation, the current operation permission of the target application is determined based on multiple identity authentication results and the information of the target application, specifically:

[0271] If the last authentication result among the multiple authentication results indicates that the user operating the terminal device is the target user, and the authentication results exceeding the target ratio threshold among the multiple authentication results indicate that the user operating the terminal device is the target user, then the current operation permission of the target application is determined to be allowed operation; wherein the target ratio threshold is determined based on the information of the target application. In other words, the number of times the target user needs to be authenticated is determined by the information of the target application (i.e., the scenario), so that the control of permissions meets the needs of the target application to the greatest extent possible. In addition, requiring the most recent authentication result to be the target user further improves security.

[0272] In a possible implementation, the identity authentication of the user operating the terminal device during the running of the target application is specifically performed as follows:

[0273] Matching candidate modalities corresponding to information of the target application according to a preset matching relationship during the operation of the target application; wherein the matching relationship defines candidate modalities corresponding to at least two types of information, the candidate modalities include at least one modality, and the candidate modalities corresponding to any two types of the at least two types of information are not completely the same;

[0274] One or more of the candidate modalities corresponding to the target application are used to authenticate the user operating the terminal device. It is understandable that different application scenarios have different requirements for security levels. Therefore, the corresponding modality is reasonably matched for identity authentication according to the scenario of the target application, so that the identity authentication result can better meet the security requirements. In addition, this dynamic rather than fixed modality authentication method has higher anti-attack performance and a higher security level.

[0275] In a possible implementation, the adopting of one or more of the candidate modalities corresponding to the target application to authenticate the user operating the terminal device is specifically:

[0276] According to the environmental parameters of the environment in which the terminal device is currently located, one or more modalities are selected from the candidate modalities corresponding to the target application to authenticate the user operating the terminal device. The inventor of the present application has found that if the same modality is always used for authentication when the environmental parameters are constantly changing, the authentication result will be inaccurate or impossible to authenticate. For example, authentication through facial recognition modality in dim light will lead to inaccurate authentication results. In response to this, the inventor of the present application proposes matching specific modalities for identity authentication according to specific environmental parameters, thereby improving the accuracy of identity authentication. Moreover, this dynamic rather than fixed modality authentication method has higher anti-attack performance and a higher security level.

[0277] It should be noted that the implementation of each operation can also refer to Figure 4A , Figure 4B , Figure 5-Figure 9 The corresponding description of the method embodiment shown.

[0278] The embodiment of the present application also provides a chip system, the chip system includes at least one processor, a memory and an interface circuit, the memory and the at least one processor are interconnected through a line, and a computer program is stored in the at least one memory; when the computer program is executed by the processor, Figure 4A , Figure 4B , Figure 5-Figure 9 The method flow is shown.

[0279] The present application also provides a computer-readable storage medium in which a computer program is stored. When the computer-readable storage medium is executed on a processor, Figure 4A , Figure 4B , Figure 5-Figure 9 The method flow is shown.

[0280] The embodiment of the present application further provides a computer program product, which, when stored in a memory and executed on a processor, implements Figure 4A , Figure 4B , Figure 5-Figure 9 The method flow is shown.

[0281] In summary, by implementing the embodiments of the present application, after the terminal device or target application has performed identity authentication and passed the authentication, the user operating the terminal device or target application continues to be authenticated, and information is fed back to the user based on one or more identity authentication results obtained by continuing the authentication, so that the user can access the terminal device or target application within the scope of the permission. This continuous identity authentication method can continuously ensure the security of the terminal device or target application.

[0282] A person skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by a computer program or hardware related to the computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned method embodiments. The aforementioned storage medium includes: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store computer program codes.

Claims

1. A user rights management method, characterized in that: include: Obtaining identity information of a user currently holding a terminal device and performing identity authentication on the user, wherein the terminal device or the target application has performed identity authentication at least once and is in a running state after passing the identity authentication; If the last identity authentication result among multiple identity authentication results indicates that the user operating the terminal device is the target user, and the authentication results of the multiple identity authentication results exceeding the target ratio threshold indicate that the user operating the terminal device is the target user, it is determined that the user currently operating the terminal device has the operation authority for the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application; the information of the target application includes the type of the target application and / or the function currently executed by the target application; The user's access to the terminal device or the target application is controlled according to the operation authority.

2. The method according to claim 1, characterized in that The obtaining the identity information of the user currently holding the terminal device and authenticating the user includes: The identity information of the user currently holding the terminal device is collected at a preset frequency, and the user operating the terminal device is authenticated according to the identity information collected each time to obtain one or more authentication results of the identity authentication, wherein the identity information collected each time is used to obtain an authentication result of the identity authentication.

3. The method according to claim 1, characterized in that: The obtaining the identity information of the user currently holding the terminal device and authenticating the user includes: Whenever a triggering operation for a preset function is detected, the identity information of the user currently holding the terminal device is collected, and the user operating the terminal device is authenticated according to the identity information collected each time to obtain one or more authentication results of the identity authentication. The identity information collected each time is used to obtain an authentication result of the identity authentication, and the number of preset functions in the terminal device is greater than or equal to 1.

4. The method according to any one of claims 1 to 3, characterized in that: The identity information used in the identity authentication includes a fusion of one or more of the user's fingerprint information, facial information, iris information or voiceprint information.

5. The method according to any one of claims 1 to 3, characterized in that: The controlling the user's current access to the terminal device or the target application according to the operation authority includes: If it is determined that the user does not have the operation authority for the terminal device or the target application, outputting a prompt message to prompt the target user to perform identity authentication; Receive re-entered identity authentication information; If it is determined that the user operating the terminal device or the target application is the target user based on the re-entered identity authentication information, the operation authority for the terminal device or the target application is granted.

6. The method according to claim 5, characterized in that If it is determined that the user currently does not have the operation authority for the terminal device or the target application, outputting a prompt message to prompt the target user to perform identity authentication, including: If it is determined that the user currently does not have the operation authority for the terminal device or the target application, and the type of the target application is a first preset type, a prompt message is output to prompt the target user to perform identity authentication.

7. The method according to any one of claims 1 to 3, characterized in that: Also includes: If the last identity authentication result among the multiple identity authentication results indicates that the user operating the terminal device is not the target user, and / or the authentication results among the multiple identity authentication results that do not exceed the target ratio threshold indicate that the user operating the terminal device is the target user, it is determined that the user currently operating the terminal device does not have the operation authority for the terminal device or the target application; wherein the target ratio threshold is determined based on the information of the target application.

8. The method according to any one of claims 1 to 3, characterized in that: The authentication result of any one of the multiple identity authentications is obtained by multiple virtual computing nodes respectively performing identity authentication on the user operating the terminal device and reaching a consensus on the authentication results obtained by each of them.

9. The method according to claim 8, characterized in that The multiple virtual computing nodes are different operating systems installed on the terminal device, or are at least one operating system installed on the terminal device and at least one third-party device connected to the terminal device. The modalities based on which the multiple virtual computing nodes perform identity authentication are different.

10. A terminal device, characterized in that: The method comprises one or more processors and a memory, wherein the memory is used to store a computer program, and the one or more processors call the computer program to implement the method according to any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed on one or more processors, implements the method according to any one of claims 1 to 9.

Images