Method for updating data set, method for registering authentication client, and method for identity authentication

Abstract

The application discloses an updating method of a data set, a registration method of an authentication client and an identity authentication method, and the method comprises the following steps: receiving a message containing first biological data sent by a collection terminal; obtaining the first biological data by analyzing the message; generating second biological data according to the first biological data according to a first preset rule; calculating the second biological data and original authentication data set to generate a new authentication data set; and replacing the original authentication data set with the new authentication data set to obtain an updated authentication data set. According to the method provided in the embodiment of the application, biological data is used as the basis for identity discrimination, the authentication process is faster, and the user experience is better. The updated authentication data set is used as the authentication model of the user, direct storage of the original physiological data of the user is avoided, and the privacy protection effect is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data set updating method, a client registration method and an identity authentication method. BACKGROUND

[0002] With the development of Internet technology and the maturation of biometric technology, more and more identity authentication schemes use physiological data of users as the basis for identity discrimination. Compared with the traditional "username + password" identity authentication method, the use of biometric technology makes the authentication process faster and the user experience better. However, the extraction of some biological characteristics is greatly affected by environmental factors, such as commonly used face recognition and iris recognition technology, which are greatly affected by the surrounding light environment. Some require a relatively complex interactive process, such as face recognition, voiceprint recognition, and require users to make corresponding actions according to instructions for identification. In addition, the physiological data of users is often directly stored in user terminals, and even uploaded to third-party servers and cloud databases, which threatens the privacy of users. SUMMARY

[0003] In view of this, the present application provides a data set updating method, a client registration method and an identity authentication method, aiming to solve the problems of complex authentication process, great environmental influence and poor user data privacy in related technologies.

[0004] In a first aspect, the embodiments of the present application provide a data set updating method, comprising: receiving a message containing first biological data sent by a collection terminal; parsing the message to obtain the first biological data; generating second biological data according to a first preset rule; calculating the second biological data and the original authentication data set to generate a new authentication data set; replacing the original authentication data set with the new authentication data set to obtain an updated authentication data set.

[0005] Further, the calculation of the second biological data and the original authentication data set to generate a new authentication data set comprises: performing Skyline calculation on the second biological data and the original authentication data set to obtain the final authentication data set.

[0006] Further, the message containing the first biological data is obtained by the collection terminal in the following way: obtaining initial biological data in real time or within a specified time range; extracting biological data from the initial biological data according to a preset strategy to generate first biological data; encapsulating the first biological data to obtain a message containing the first biological data; and sending the message containing the first biological data to the client.

[0007] In a second aspect, the embodiments of the present application further provide a registration method of an authentication client, comprising: receiving an updated authentication data set with identity information; generating a public-private key pair according to the identity information, wherein the public-private key pair comprises a first public key and a first private key; calling a certification private key corresponding to the identity information to sign the first public key to generate a second public key, wherein a certification public key corresponding to the certification private key is stored in an authentication server; calling an encryption public key of the authentication server to encrypt the first public key to generate a third public key, wherein a decryption private key corresponding to the encryption public key is stored in the authentication server; generating a registration request according to the identity information, the second public key and the third public key, and sending the registration request to the authentication server to prompt the authentication server to call the decryption private key to decrypt the third public key to obtain the first public key, and use the certification public key and the first public key to verify the second public key to determine a verification result, if the verification is successful, new user data is created according to the identity information and the first public key; and outputting the verification result to indicate a registration result of successful registration or failed registration.

[0008] In a third aspect, the embodiments of the present application further provide an identity authentication method, comprising: receiving a message with identity information containing first biological data; parsing the message to obtain the first biological data; generating second biological data according to the first biological data according to a first preset rule; calling an original authentication data set according to the identity information; performing first authentication on the second biological data according to the original authentication data set to obtain and output a first authentication result; if the first authentication is successful, combining the first authentication result, performing second authentication on the identity information by using digital signature and key encryption to obtain and output a second authentication result.

[0009] Further, the first authentication on the second biological data according to the original authentication data set to obtain and output the first authentication result comprises: judging a dominance relationship between the second biological data and the original authentication data set; if the second biological data is dominated by the original authentication data set, the first authentication is successful, otherwise, the first authentication fails.

[0010] Further, the judging of the dominance relationship between the second biological data and the original authentication data set comprises: performing Skyline calculation on the second biological data and the original authentication data set to judge the dominance relationship between the second biological data and the original authentication data set.

[0011] Further, the message containing the first biological data is obtained by the collection terminal in the following manner: obtaining initial biological data in real time or within a specified time range; extracting biological data from the initial biological data according to a preset strategy to generate the first biological data; encapsulating the first biological data to obtain the message containing the first biological data; and sending the message containing the first biological data to the client.

[0012] Further, the second authentication of the identity information is performed by combining the first authentication result, using digital signature and key encryption to obtain and output a second authentication result, including: calling a first private key corresponding to the identity information to sign the first authentication result to generate second authentication data; calling an encryption public key of an authentication server to encrypt the first authentication result to generate third authentication data; generating an authentication request according to the identity information, the second authentication data and the third authentication data, and sending the authentication request to the authentication server to prompt the authentication server to call the decryption private key to decrypt the third authentication data to obtain the first authentication result, and use the first public key and the first authentication result to verify the second authentication data to obtain and return a verification result; and outputting the verification result.

[0013] In a fourth aspect, the embodiments of the present application further provide an updating device of a data set, including: a first receiving module configured to receive a message containing first biological data sent by a collection terminal; a first analyzing module configured to analyze the message to obtain the first biological data; a first generating module configured to generate second biological data from the first biological data according to a first preset rule; a first calculating module configured to calculate the second biological data and the original authentication data set to generate a new authentication data set; and a first updating module configured to replace the original authentication data set with the new authentication data set to obtain an updated authentication data set.

[0014] Further, the first calculating module is further configured to perform Skyline calculation on the second biological data and the original authentication data set to obtain a final authentication data set.

[0015] Further, the message containing the first biological data is obtained by the collection terminal in the following manner: obtaining initial biological data in real time or within a specified time range; extracting biological data from the initial biological data according to a preset strategy to generate the first biological data; encapsulating the first biological data to obtain the message containing the first biological data; and sending the message containing the first biological data to the client.

[0016] In a fifth aspect, the embodiments of the present application further provide a registration device, comprising: a second receiving module, configured to receive an updated authentication data set with identity information; a second key pair generating module, configured to generate a public-private key pair according to the identity information, wherein the public-private key pair comprises a first public key and a first private key; a second signing module, configured to call a certification private key corresponding to the identity information to sign the first public key, to generate a second public key, wherein a certification public key corresponding to the certification private key is stored in an authentication server; a second encryption module, configured to call an encryption public key of the authentication server to encrypt the first public key, to generate a third public key, wherein a decryption private key corresponding to the encryption public key is stored in the authentication server; a second signature verifying module, configured to generate a registration request according to the identity information, the second public key and the third public key, and send the registration request to the authentication server, to prompt the authentication server to call the decryption private key to decrypt the third public key to obtain the first public key, and use the certification public key and the first public key to verify the second public key, to determine a verification result, and if the verification is successful, newly create user data according to the identity information and the first public key; and a second output module, configured to output the verification result to indicate a registration result of successful registration or failed registration.

[0017] In a sixth aspect, the embodiments of the present application further provide an identity authentication device, comprising: a third receiving module, configured to receive a message with identity information and containing first biological data; a third analyzing module, configured to analyze the message to obtain the first biological data; a third generating module, configured to generate second biological data according to the first biological data and a first preset rule; a third calling module, configured to call an original authentication data set according to the identity information; a third authentication module, configured to perform first authentication on the second biological data according to the original authentication data set, to obtain and output a first authentication result; and a fourth authentication module, configured to, if the first authentication is successful, combine the first authentication result to perform second authentication on the identity information by using digital signature and key encryption, to obtain and output a second authentication result.

[0018] Further, the third authentication module is further configured to: judge a dominance relationship between the second biological data and the original authentication data set; if the second biological data is dominated by the original authentication data set, the first authentication is successful, otherwise, the first authentication fails.

[0019] Further, the judging of the dominance relationship between the second biological data and the original authentication data set comprises: performing Skyline calculation on the second biological data and the original authentication data set to judge the dominance relationship between the second biological data and the original authentication data set.

[0020] Further, the message containing the first biological data is obtained by the collection terminal in the following manner: obtaining initial biological data in real time or within a specified time range; extracting biological data from the initial biological data according to a preset strategy to generate first biological data; encapsulating the first biological data to obtain the message containing the first biological data; and sending the message containing the first biological data to the client.

[0021] Further, if the first authentication succeeds, the fourth authentication module is further configured to: call a first private key corresponding to the identity information, sign the first authentication result to generate second authentication data; call an encryption public key of an authentication server, encrypt the first authentication result to generate third authentication data; generate an authentication request according to the identity information, the second authentication data and the third authentication data, and send the authentication request to the authentication server, so as to prompt the authentication server to call the decryption private key to decrypt the third authentication data to obtain the first authentication result, and use the first public key and the first authentication result to verify the second authentication data to obtain and return a verification result; and output the verification result.

[0022] The data set updating method, the authentication client registration method and the identity authentication method provided by the embodiments of the present application use biological data as the basis for identity discrimination, and compared with the traditional identity authentication method, the authentication process is faster and the user experience is better; meanwhile, the updated authentication data set is stored as the authentication model of the user, so that the system directly stores the original physiological data of the user is avoided, and the privacy protection effect is improved.

[0023] In the data set updating method, the authentication client registration method and the identity authentication method provided by some embodiments of the present application, the Skyline calculation is used to quickly obtain the effective range of different types of physiological data, greatly remove the repeated data, and reduce the system storage amount, that is, the best authentication performance is ensured with the minimum memory cost.

[0024] In the data set updating method, the authentication client registration method and the identity authentication method provided by some embodiments of the present application, the generation, storage and use of the user key in the registration and authentication process are strictly limited by the system running mechanism and directly affected by the user authentication result, so that the data security is high. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 An exemplary system architecture in which embodiments of the present application can be applied is shown;

[0026] Figure 2 An exemplary flowchart of the data set updating method according to an embodiment of the present application is shown;

[0027] Figure 3 An example diagram of a Skyline authentication model is shown according to an embodiment of the present application;

[0028] Figure 4 An example flow chart of a registration method of an authentication client is shown according to an embodiment of the present application;

[0029] Figure 5 An example flow chart of an identity authentication method is shown according to an embodiment of the present application;

[0030] Figure 6 A structural schematic diagram of an updating apparatus of a data set is shown according to an embodiment of the present application;

[0031] Figure 7 A structural schematic diagram of a registration apparatus is shown according to an embodiment of the present application; and

[0032] Figure 8 A structural schematic diagram of an identity authentication apparatus is shown according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] Reference will now be made to the exemplary embodiments of the present application with reference to the accompanying drawings, however, the present application can be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and fully convey the scope of the application to those skilled in the art. Like reference numerals refer to like elements throughout the specification. It will be understood that when an element is referred to as being "on" another element, it can be directly on the element or intervening elements can also be present. In addition, terms such as first and second are used herein when claiming the present application to provide a clear and consistent indication of the claimed subject matter. Such terms are used with only that intention. The use of these terms in the description is merely intended to differentiate one

[0034] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0035] Reference is made to Figure 1 which shows an example system architecture 100 to which embodiments of the present application can be applied.

[0036] As Figure 1As shown, the system architecture 100 can include an authentication client 101, an authentication server 102, and a plurality of collection terminals 103. The authentication client 101 can be various electronic devices, including but not limited to personal computers, smart phones, smart televisions, tablet computers, personal digital assistants, e-book readers, and the like. The authentication server 102 can be a server that provides authentication services. The authentication server can provide authentication services in response to authentication service requests from users. The collection terminals 103 can include different types of collection terminals for collecting different physiological data, such as a body temperature collection terminal, a blood pressure collection terminal, a heart rate collection terminal, a vital capacity collection terminal, and the like. Each collection terminal can be distinguished by a unique preset code (ID). It should be understood that the same collection terminal does not have a one-to-one correspondence with the number of types of physiological data that it can collect, i.e., the same collection terminal can collect one or more different physiological data, and the same physiological data can be collected by one or more collection terminals. It can be understood that a server can provide one or more services, and the same service can be provided by multiple servers. The plurality of collection terminals 103 are connected to the authentication client 101 for sending collected data to the authentication client 101. The authentication client 101 and the authentication server 102 are connected for data exchange between each other. It should be understood that Figure 1 The number of authentication clients, authentication servers, and collection terminals in the system architecture 100 is only illustrative, and any number can be used as needed.

[0037] Figure 2 An exemplary flowchart of a method for updating a data set according to an embodiment of the present application is shown.

[0038] As Figure 2 shown, the method includes:

[0039] Step S201: receiving a message containing first biological data sent by a collection terminal.

[0040] In an embodiment of the present application, the first biological data includes one or more combinations of physiological data such as heart rate, blood pressure, body temperature, respiratory rate, step frequency, step length, blink frequency, vital capacity, body fat rate, and BMI. The message containing the first biological data can include address information, verification information, and the like in addition to the first biological data.

[0041] Step S202: parsing the message to obtain the first biological data.

[0042] In an embodiment of the present application, the first biological data can be obtained by parsing the received message.

[0043] Step S203: generating second biological data from the first biological data according to a first preset rule.

[0044] In the embodiment of the present application, the first preset rule can be a preset order, for example, the first field represents body temperature, and the second field represents blood pressure, etc. The first biological data is organized in an ordered sequence according to the first preset rule, and all the first biological data is mapped into a sequence of a specified dimension according to the physiological data type, to obtain the second biological data.

[0045] Step S204: calculating the second biological data and the original authentication data set to generate a new authentication data set.

[0046] In the embodiment of the present application, the original authentication data set represents a physiological data model corresponding to the user formed by the current system training, and is the result of calculating the second biological data after the user calls the system training process each time. It should be noted that when the user performs the authentication data set training for the first time, the original authentication data set is empty. When the original authentication data set is empty, the second biological data can be directly calculated to obtain the new authentication data set.

[0047] Step S205: replacing the original authentication data set with the new authentication data set to obtain an updated authentication data set.

[0048] In the embodiment of the present application, the original authentication data set is replaced with the new authentication data set to obtain the updated authentication data set.

[0049] It should be understood that the process of the above-mentioned embodiment of the "data set updating method" can be a training process or a plurality of repeated training processes. In theory, the larger the amount of second biological data participating in the authentication data set generation process, the more it can reflect the physiological characteristics of the user, and the less the accidental data can interfere with the subsequent user identification process.

[0050] Compared with the traditional identity authentication method, the above-mentioned embodiment uses biological data as the basis for identity identification, and the authentication process is faster and the user experience is better. At the same time, the updated authentication data set is stored as the user's authentication model, avoiding the system directly storing the user's original physiological data, and improving the privacy protection effect.

[0051] Further, step S204 comprises:

[0052] Skyline calculation is performed on the second biological data and the original authentication data set to obtain the final authentication data set.

[0053] Specifically, a large m-dimensional space vector set P = {P1, P2,..., Pn} is obtained, and P1, P2,..., Pn are different points in P. n a b

[0054] ​​​Forward Skyline computation: For any positive integer j (1≤j≤m), P satisfies a [j]≤P b [j], and there exists at least one j such that P a [j]<P b [j], then P is called a Positive dominance P b Extract all tuples from dataset P that do not have a positive dominance relationship with each other to form a set PSKY(P), denoted as P.

[0055]

[0056] Reverse Skyline computation: For any positive integer j (1≤j≤m), P satisfies a [j]≥P b [j], and there exists at least one j such that P a [j]>P b [j], then P is called a Reverse Domination P b Extract all tuples from dataset P that do not have an inverse dominance relationship with each other to form a set NSKY(P), denoted as NSKY(P).

[0057]

[0058] Skyline computation exhibits additivity: for a multidimensional set of vectors P = {P1, P2, ..., P...} n If dataset P satisfies P = P1∪P2……∪P n ,but

[0059] SKY(P)=SKY(P1∪P2……∪P n )=SKY(SKY(P1)∪SKY(P2)……∪SKY(P n ));

[0060] Assume |PSKY(P)=(a1,…,a s ), NSKY(P)=(b1,…,b t ), where tuple a i and b j It can be represented as an m-dimensional vector and Where 1≤i≤s and 1≤j≤t, the query request vector

[0061] Therefore, the following judgment rules can be formulated.

[0062]

[0063] Among them, Pdom(ai ,w)=PSKY(a i ,w), Ndom(a i ,w)=NSKY(b j w), if and only if 0 < ρ + ≤1 and -1≤ρ - <0 indicates that the user authentication has passed.

[0064] Figure 3 An example diagram of a Skyline authentication model according to an embodiment of the present invention is shown. Figure 3 As shown, P1 is a two-dimensional spatial vector set composed of two-dimensional vectors A, B, C, D, E, and F. Performing a forward Skyline calculation on all points in P1 yields the upper contour set PSKY(P1) = {A, B, C, D}, and performing a reverse Skyline calculation yields the lower contour set NSKY(P1) = {E, F}. PSKY(P1) and NSKY(P1) together constitute the data contour points of set P1. For another tuple W outside set P1 in this two-dimensional space, we determine the dominance relationship between W and each tuple in PSKY(P1) and NSKY(P1). Since Pdom(B, W) = 1 and Ndom(E, W) = -1, tuple W belongs to the data contour of dataset P1.

[0065] In the above embodiments, the result of Skyline computation on the collected user biometric data and the authentication dataset formed during the data training phase is used as the basis for unlocking the user's local key. This mechanism simplifies user operation for the authentication system by eliminating the need for users to input usernames and passwords on the authentication client, while the authentication server still uses the traditional PKI system, ensuring system security and device compatibility. Simultaneously, based on the dominance relationships of multidimensional data and the additive nature of the Skyline algorithm, the boundaries of valid data are obtained, forming a unique authentication dataset for a specific user within the system. This dataset is then stored as the user's authentication model, avoiding the system directly storing the user's raw physiological data. Furthermore, Skyline computation can quickly determine the valid range of different types of physiological data, significantly removing duplicate data and reducing system storage requirements, thus ensuring optimal identification performance with minimal memory overhead.

[0066] Furthermore, the message containing the first biological data is obtained by the acquisition terminal in the following manner:

[0067] Acquire initial biological data in real time or within a specified time range;

[0068] According to a preset strategy, biological data is extracted from the initial biological data to generate first biological data;

[0069] The first biological data is encapsulated to obtain a message containing the first biological data;

[0070] The message containing the first biological data is sent to the client.

[0071] In the embodiment of the application, the initial biological data can be physiological data of one or more combinations of heart rate, blood pressure, body temperature, respiratory rate, step frequency, step length, blink frequency, vital capacity, body fat rate, BMI, etc. The preset strategy can be a preset processing strategy for related physiological data, including: ① real-time acquisition of single physiological data; ② acquisition of minimum value, average value or maximum value of certain physiological data within a specified time range; ③ weighted value of the physiological data collected within a specified time range. For example, for heart rate, the last heart rate in the collection time range can be taken as the real-time data; for blood pressure, the average value of all blood pressures in the collection time range can be taken as the average value.

[0072] The above embodiment is not limited to the use of a single type of biological feature data. The more types of biological features used, the higher the dimension of the second biological data and the authentication data set, the higher the accuracy of the identification system, and the stronger the overall attack resistance of the system.

[0073] Figure 4 An exemplary flowchart of a registration method of an authentication client according to an embodiment of the application is shown.

[0074] As shown in Figure 4 , the method comprises:

[0075] Step S401: receiving an updated authentication data set with identity information;

[0076] Step S402: generating a public-private key pair according to the identity information, wherein the public-private key pair includes a first public key and a first private key;

[0077] Step S403: calling an authentication private key corresponding to the identity information to sign the first public key to generate a second public key, wherein an authentication public key corresponding to the authentication private key is stored in the authentication server;

[0078] Step S404: calling an encryption public key of the authentication server to encrypt the first public key to generate a third public key, wherein a decryption private key corresponding to the encryption public key is stored in the authentication server;

[0079] Step S405: generating a registration request according to the identity information, the second public key and the third public key, and sending the registration request to the authentication server to cause the authentication server to decrypt the third public key by using the decryption private key to obtain the first public key, and to verify the second public key by using the attestation public key and the first public key to obtain a verification result, and if the verification is successful, newly creating user data according to the identity information and the first public key;

[0080] Step S406: outputting the verification result to indicate a registration result of success or failure.

[0081] In the above embodiment, the step S403 and the step S404 have no sequence and can be executed in sequence or simultaneously. The attestation private key is a secret value saved in the authentication client after the authentication server and the user account are securely negotiated, and the attestation public key corresponding to the attestation private key is saved in the authentication server and is associated with the user account. The encryption public key is a public key value publicly disclosed by the authentication server, and is usually saved in the server encryption certificate thereof. The identity information represents a value capable of uniquely identifying and representing the user, and can be information related to the user identity, such as a mobile phone number, an ID card number, etc., or can be a username, a user ID, etc. The identity information can be obtained by the authentication client when sending data to the authentication server. The attestation private key can sign the hash calculation result of the first public key data to generate the second public key.

[0082] It should be understood that the "registration method of the authentication client" can include the "updating method of the data set" process, but the triggering of the "updating method of the data set" process is not limited to the "registration method of the authentication client" stage. Generally, a user only experiences a registration process once, and in actual application, considering the system access control, the enhancement of the system recognition rate and the adaptive system design, etc., the system can be set to initially perform the "updating method of the data set" process during registration. The "updating method of the data set" process is started by default, and the training process needs to be repeated multiple times. In theory, the larger the amount of the second biological data participating in the generation of the authentication data set, the more truly the physiological characteristics of the user can be reflected, and the interference of accidental data on the subsequent user identification process is reduced as much as possible. After the registration is completed and enters the identification stage, the user can selectively start the "updating method of the data set" mode only when and if the authentication client successfully identifies the user identity.

[0083] In the registration process of the above embodiment, the generation, storage and use of the user key are strictly limited by the system running mechanism and directly affected by the user identification result, thereby improving the security of the data.

[0084] Figure 5 An exemplary flowchart of an identity identification method according to an embodiment of the present application is shown.

[0085] AsFigure 5 The method comprises the following steps:

[0086] Step S501: receiving a message containing first biological data with identity information;

[0087] Step S502: parsing the message to obtain the first biological data;

[0088] Step S503: generating second biological data from the first biological data according to a first preset rule;

[0089] Step S504: calling an original authentication data set according to the identity information;

[0090] Step S505: performing first identification on the second biological data according to the original authentication data set, obtaining and outputting a first identification result;

[0091] Step S506: if the first identification is successful, performing second identification on the identity information by using digital signature and key encryption in combination with the first identification result, and obtaining and outputting a second identification result.

[0092] In the above embodiment, the identity information represents a value capable of uniquely identifying and representing the user, and can be information related to the identity of the user, such as a mobile phone number, an ID card number, a username, a user ID, etc. The identity information can be obtained by adding the identity information by the authentication client when the authentication client sends data to the authentication server. According to the identity information, the original authentication data set corresponding to the identity information can be called.

[0093] Further, step S505 comprises:

[0094] determining the dominance relationship between the second biological data and the original authentication data set;

[0095] If the second biological data is dominated by the original authentication data set, the first identification is successful, otherwise, the first identification fails.

[0096] Further, determining the dominance relationship between the second biological data and the original authentication data set comprises:

[0097] performing Skyline calculation on the second biological data and the original authentication data set to determine the dominance relationship between the second biological data and the original authentication data set.

[0098] Specifically, a large m-dimensional space vector set P = {P1, P2, …, Pn} is provided, and P n , P a , and P b are two different points in P.

[0099] Forward Skyline calculation: for any positive integer j (1≤j≤m), Pa [j]≤P b [j], and there exists at least one j such that P a [j]<P b [j], then P is called a Positive dominance P b Extract all tuples from dataset P that do not have a positive dominance relationship with each other to form a set PSKY(P), denoted as P.

[0100]

[0101] Reverse Skyline computation: For any positive integer j (1≤j≤m), P satisfies a [j]≥P b [j], and there exists at least one j such that P a [j]>P b [j], then P is called a Reverse Domination P b Extract all tuples from dataset P that do not have an inverse dominance relationship with each other to form a set NSKY(P), denoted as NSKY(P).

[0102]

[0103] Skyline computation exhibits additivity: for a multidimensional set of vectors P = {P1, P2, ..., P...} n If dataset P satisfies P = P1∪P2……∪P n ,but

[0104] SKY(P)=SKY(P1∪P2……∪P n )=SKY(SKY(P1)∪SKY(P2)……∪SKY(P n ));

[0105] Assume |PSKY(P)=(a1,…,a s ), NSKY(P)=(b1,…,b t ), where tuple a i and b j It can be represented as an m-dimensional vector and Where 1≤i≤s and 1≤j≤t, the query request vector

[0106] Therefore, the following judgment rules can be formulated.

[0107]

[0108] Among them, Pdom(a i ,w)=PSKY(a i,w), Ndom(a i ,w)=NSKY(b j w), if and only if 0 < ρ + ≤1 and -1≤ρ - <0 indicates that the user authentication has passed.

[0109] Figure 3 An example diagram of a Skyline authentication model according to an embodiment of the present invention is shown. Figure 3 As shown, P1 is a two-dimensional spatial vector set composed of two-dimensional vectors A, B, C, D, E, and F. Performing a forward Skyline calculation on all points in P1 yields the upper contour set PSKY(P1) = {A, B, C, D}, and performing a reverse Skyline calculation yields the lower contour set NSKY(P1) = {E, F}. PSKY(P1) and NSKY(P1) together constitute the data contour points of set P1. For another tuple W outside set P1 in this two-dimensional space, we determine the dominance relationship between W and each tuple in PSKY(P1) and NSKY(P1). Since Pdom(B, W) = 1 and Ndom(E, W) = -1, tuple W belongs to the data contour of dataset P1.

[0110] In the above embodiments, the result of Skyline computation on the collected user biometric data and the authentication dataset formed during the data training phase is used as the basis for unlocking the user's local key. This mechanism simplifies user operation for the authentication system by eliminating the need for users to input usernames and passwords on the authentication client, while the authentication server still uses the traditional PKI system, ensuring system security and device compatibility. Simultaneously, based on the dominance relationships of multidimensional data and the additive nature of the Skyline algorithm, the boundaries of valid data are obtained, forming a unique authentication dataset for a specific user within the system. This dataset is then stored as the user's authentication model, avoiding the system directly storing the user's raw physiological data. Furthermore, Skyline computation can quickly determine the valid range of different types of physiological data, significantly removing duplicate data and reducing system storage requirements, thus ensuring optimal identification performance with minimal memory overhead.

[0111] Furthermore, the message containing the first biological data is obtained through the acquisition terminal in the following manner:

[0112] Acquire initial biological data in real time or within a specified time range;

[0113] According to a preset strategy, biological data is extracted from the initial biological data to generate the first biological data.

[0114] The first biological data is encapsulated to obtain a message containing the first biological data;

[0115] sending a message containing the first biological data to the client.

[0116] Further, in combination with the first identification result, the identity information is subjected to second identification by using digital signature and key encryption, a second identification result is obtained and output, including:

[0117] calling the first private key corresponding to the identity information to sign the first identification result, and generating second identification data;

[0118] calling the encryption public key of the authentication server to encrypt the first identification result, and generating third identification data;

[0119] generating an identification request according to the identity information, the second identification data and the third identification data, and sending the identification request to the authentication server, so as to prompt the authentication server to call the decryption private key to decrypt the third identification data, obtain the first identification result, and use the first public key and the first identification result to verify the second identification data, and obtain and return a verification result;

[0120] outputting the verification result.

[0121] In the above embodiment, the first private key can sign the hash calculation result of the first identification result to generate the second identification data. The Skyline algorithm can quickly obtain the dominance relationship between the first biological data (input data) and the authentication data set (training model data), and use the calculation result as the basis for identity identification, which has small calculation amount and fast system response. Meanwhile, the generation, storage and use of the user key are strictly limited by the system running mechanism and directly affected by the user identification result, so that the data security is high. In addition, the authentication data set is stored without directly recording the original physiological data of the user, so that the privacy protection effect is good.

[0122] Figure 6 A structure diagram of an updating device of a data set according to an embodiment of the application is shown.

[0123] As shown in Figure 6 , the device comprises:

[0124] The first receiving module 601 is configured to receive the message containing the first biological data sent by the collection terminal.

[0125] In the embodiment of the application, the first biological data includes one or more combinations of physiological data such as heart rate, blood pressure, body temperature, respiratory rate, step frequency, step length, blink frequency, vital capacity, body fat rate, and BMI. The message containing the first biological data can include address information, verification information and other contents in addition to the first biological data.

[0126] The first analysis module 602 is configured to analyze the message to obtain first biological data.

[0127] In the embodiment of the present application, the first biological data can be obtained by analyzing the received message.

[0128] The first generation module 603 is configured to generate second biological data according to the first biological data and a first preset rule.

[0129] In the embodiment of the present application, the first preset rule can be a pre-set order, for example, the first field represents body temperature, the second field represents blood pressure, etc. The first biological data is organized in an ordered sequence according to the first preset rule, and all the first biological data is mapped to a specified dimension sequence according to the physiological data type to obtain the second biological data.

[0130] The first calculation module 604 is configured to calculate the second biological data and an original authentication data set to generate a new authentication data set.

[0131] In the embodiment of the present application, the original authentication data set represents a physiological data model corresponding to the user formed by the current system training, and is the result of calculating the second biological data after the user calls the system training process each time. It should be noted that when the user performs the authentication data set training for the first time, the original authentication data set is empty. When the original authentication data set is empty, the second biological data can be directly calculated to obtain the new authentication data set.

[0132] The first update module 605 is configured to replace the original authentication data set with the new authentication data set to obtain an updated authentication data set.

[0133] In the embodiment of the present application, the original authentication data set is replaced with the new authentication data set to obtain the updated authentication data set.

[0134] It should be understood that the process of the above-mentioned embodiment of the "data set updating method" can be a training process or a plurality of repeated training processes. In theory, the larger the amount of second biological data participating in the authentication data set generation process, the more truly it reflects the physiological characteristics of the user, and the more it reduces the interference of accidental data on the subsequent user identification process.

[0135] Compared with the traditional identity authentication method, the above-mentioned embodiment uses biological data as the basis for identity identification, which is faster and better in user experience. At the same time, the updated authentication data set is stored as the user's authentication model, which avoids directly storing the user's original physiological data in the system and improves the privacy protection effect.

[0136] Further, the first calculation module 604 is further configured to:

[0137] Skyline computation is performed on the second biological data and the original authentication data set to obtain a final authentication data set.

[0138] Specifically, a large set of m-dimensional space vectors P = {P1, P2,..., P n} is obtained, and P a , P b are two different points in P.

[0139] Forward Skyline computation: for any positive integer j (1≤j≤m), P a [j]≤P b [j] is satisfied, and at least one j exists such that P a [j]<P b [j], P a is said to forward dominate P b , and all tuples in the data set P that do not have a forward domination relationship with each other are extracted to form a set PSKY(P), denoted as

[0140]

[0141] Reverse Skyline computation: for any positive integer j (1≤j≤m), P a [j]≥P b [j] is satisfied, and at least one j exists such that P a [j]>P b [j], P a is said to reverse dominate P b , and all tuples in the data set P that do not have a reverse domination relationship with each other are extracted to form a set NSKY(P), denoted as

[0142]

[0143] Skyline computation has additivity: for a multi-dimensional space vector set P = {P1, P2,..., P n}, if the data set P satisfies P = P1∪P2……∪P n , then

[0144] SKY(P) = SKY(P1∪P2……∪P n ) = SKY(SKY(P1)∪SKY(P2)……∪SKY(P n ));

[0145] Assume that |PSKY(P) = (a1,..., a s ), NSKY(P) = (b1,..., b t ), where the tuples a i and b j can be represented as m-dimensional vectors and Where 1≤i≤s and 1≤j≤t, the query request vector

[0146] Therefore, the following judgment rules can be formulated.

[0147]

[0148] Among them, Pdom(a i ,w)=PSKY(a i ,w), Ndom(a i ,w)=NSKY(b j w), if and only if 0 < ρ + ≤1 and -1≤ρ - <0 indicates that the user authentication has passed.

[0149] Figure 3 An example diagram of Skyline calculation according to an embodiment of the present invention is shown. Figure 3 As shown, P1 is a two-dimensional spatial vector set composed of two-dimensional vectors A, B, C, D, E, and F. Performing a forward Skyline calculation on all points in P1 yields the upper contour set PSKY(P1) = {A, B, C, D}, and performing a reverse Skyline calculation yields the lower contour set NSKY(P1) = {E, F}. PSKY(P1) and NSKY(P1) together constitute the data contour points of set P1. For another tuple W outside set P1 in this two-dimensional space, we determine the dominance relationship between W and each tuple in PSKY(P1) and NSKY(P1). Since Pdom(B, W) = 1 and Ndom(E, W) = -1, tuple W belongs to the data contour of dataset P1.

[0150] In the above embodiments, the result of Skyline computation on the collected user biometric data and the authentication dataset formed during the data training phase is used as the basis for unlocking the user's local key. This mechanism simplifies user operation for the authentication system by eliminating the need for users to input usernames and passwords on the authentication client, while the authentication server still uses the traditional PKI system, ensuring system security and device compatibility. Simultaneously, based on the dominance relationships of multidimensional data and the additive nature of the Skyline algorithm, the boundaries of valid data are obtained, forming a unique authentication dataset for a specific user within the system. This dataset is then stored as the user's authentication model, avoiding the system directly storing the user's raw physiological data. Furthermore, Skyline computation can quickly determine the valid range of different types of physiological data, significantly removing duplicate data and reducing system storage requirements, thus ensuring optimal identification performance with minimal memory overhead.

[0151] Further, the message containing the first biological data is obtained by the collection terminal in the following manner:

[0152] obtaining initial biological data in real time or within a specified time range;

[0153] extracting biological data from the initial biological data according to a preset strategy to generate the first biological data;

[0154] packaging the first biological data to obtain the message containing the first biological data;

[0155] sending the message containing the first biological data to the client.

[0156] In the embodiment of the application, the initial biological data can be one or a combination of multiple physiological data such as heart rate, blood pressure, body temperature, respiratory rate, step frequency, step length, blink frequency, vital capacity, body fat rate, and BMI. The preset strategy can be a preset processing strategy for related physiological data, including: ① collecting single physiological data in real time; ② collecting the minimum value, average value, or maximum value of a certain physiological data within a specified time range; and ③ collecting the weighted value of the physiological data within a specified time range. For example, the heart rate can be the real-time data, i.e., the last heart rate within the collection time range; and the blood pressure can be the average value, i.e., the average value of all blood pressures within the collection time range. The collection terminal ID can be a preset code of the collection terminal to represent different types of collection terminals. The identity information represents a value that can uniquely identify and represent the user, which can be information related to the user's identity, such as a mobile phone number, an ID number, etc., or a username, a user ID, etc.

[0157] The above embodiments are not limited to using a single type of biological feature data. The more types of biological features used, the higher the dimension of the second biological data and the authentication data set, the higher the accuracy of the identification system, and the stronger the overall anti-attack ability of the system.

[0158] Figure 7 A structural schematic diagram of a registration device according to an embodiment of the application is shown.

[0159] As shown in Figure 7 , the device includes:

[0160] The second receiving module 701 is configured to receive the updated authentication data set with identity information.

[0161] The second key pair generation module 702 is configured to generate a public-private key pair according to the identity information, wherein the public-private key pair includes a first public key and a first private key.

[0162] The second signature module 703 is configured to call a certification private key corresponding to the identity information to sign the first public key, and generate a second public key, wherein a certification public key corresponding to the certification private key is stored in the authentication server.

[0163] The second encryption module 704 is configured to call an encryption public key of the authentication server to encrypt the first public key, and generate a third public key, wherein a decryption private key corresponding to the encryption public key is stored in the authentication server.

[0164] The second signature verification module 705 is configured to generate a registration request according to the identity information, the second public key and the third public key, and send the registration request to the authentication server, so as to cause the authentication server to call the decryption private key to decrypt the third public key to obtain the first public key, and use the certification public key and the first public key to verify the signature of the second public key, to determine a verification result, and if the verification is successful, newly create user data according to the identity information and the first public key.

[0165] The second output module 706 is configured to output the verification result to indicate a registration result of success or failure.

[0166] In the above embodiment, the second signature module 703 and the second encryption module 704 are executed without a sequence, and can be executed in sequence or simultaneously. The certification private key is a secret value stored in the authentication client after the authentication server and the user account are securely negotiated, and the certification public key corresponding to the certification private key is stored in the authentication server and is associated with the user account. The encryption public key is a public key value publicly disclosed by the authentication server, and is usually stored in the server encryption certificate. The identity information represents a value that can uniquely identify and represent the user, and can be information related to the user identity, such as a mobile phone number, an ID card number, etc., or a username, a user ID, etc. The identity information can be obtained by the authentication client when sending data to the authentication server. The certification private key can sign the hash calculation result of the first public key data to generate the second public key.

[0167] It should be understood that the registration device of the authentication client can include the updating device of the data set process, but the triggering of the updating device of the data set process is not limited to the registration device of the authentication client stage. Generally, a user only experiences a registration process once, and in practical applications, the system can be set to perform the data set updating process for the first time during registration for the purpose of system access control, enhancing system recognition rate, and adaptive system design. The data set updating method process is started by default, and the training process needs to be repeated multiple times. In theory, the larger the amount of second biological data participating in the authentication data set generation process, the more it can reflect the physiological characteristics of the user, and the more it can reduce the interference of accidental data on the subsequent user identification process. After registration is completed and enters the identification stage, the user can selectively start the data set updating device mode only when the authentication client successfully identifies the user's identity.

[0168] In the registration process of the above embodiment, the generation, storage and use of the user key are strictly limited by the system running mechanism and directly affected by the user authentication result, thereby improving the security of the data.

[0169] Figure 8 A structure diagram of an identity authentication device according to an embodiment of the present application is shown.

[0170] As shown in Figure 8 , the device comprises:

[0171] The third receiving module 801 is configured to receive a message containing first biological data with identity information.

[0172] The third analysis module 802 is configured to analyze the message to obtain the first biological data.

[0173] The third generation module 803 is configured to generate second biological data from the first biological data according to a first preset rule.

[0174] The third calling module 804 is configured to call the original authentication data set according to the identity information.

[0175] The third identification module 805 is configured to perform first identification on the second biological data according to the original authentication data set, and output a first identification result.

[0176] The fourth identification module 806 is configured to perform second identification on the identity information by using digital signature and key encryption in combination with the first identification result if the first identification is successful, and output a second identification result.

[0177] In the above embodiments, the identity information represents a value capable of uniquely identifying and representing the user, which can be information related to the user identity, such as a mobile phone number, an ID card number, etc., or a username, a user ID, etc. The identity information can be added by the authentication client when the authentication client sends data to the authentication server. According to the identity information, the original authentication data set corresponding to the identity information can be called.

[0178] Further, the third discrimination module 804 is further configured to:

[0179] determine a dominance relationship between the second biological data and the original authentication data set.

[0180] If the second biological data is dominated by the original authentication data set, the first discrimination is successful, otherwise, the first discrimination fails.

[0181] Further, the determination of the dominance relationship between the second biological data and the original authentication data set comprises:

[0182] performing Skyline calculation on the second biological data and the original authentication data set to determine the dominance relationship between the second biological data and the original authentication data set.

[0183] Specifically, a large set of m-dimensional space vectors P = {P1, P2, …, Pn} is provided, and P n , P a , and P b are two different points in P.

[0184] Forward Skyline calculation: for any positive integer j (1≤j≤m), P a [j]≤P b [j] is satisfied, and at least one j exists such that P a [j]<P b [j], then P a is said to forward dominate P b A set PSKY(P) composed of all tuples in the data set P that do not have a forward dominance relationship with each other is extracted from the data set P, denoted as

[0185]

[0186] Reverse Skyline calculation: for any positive integer j (1≤j≤m), P a [j]≥P b [j] is satisfied, and at least one j exists such that P a [j]>P b [j], then P a is said to reverse dominate P bExtract all tuples from dataset P that do not have an inverse dominance relationship with each other to form a set NSKY(P), denoted as NSKY(P).

[0187]

[0188] Skyline computation exhibits additivity: for a multidimensional set of vectors P = {P1, P2, ..., P...} n If dataset P satisfies P = P1∪P2……∪P n ,but

[0189] SKY(P)=SKY(P1∪P2……∪P n )=SKY(SKY(P1)∪SKY(P2)……∪SKY(P n ));

[0190] Assume |PSKY(P)=(a1,…,a s ), NSKY(P)=(b1,…,b t ), where tuple a i and b j It can be represented as an m-dimensional vector and Where 1≤i≤s and 1≤j≤t, the query request vector

[0191] Therefore, the following judgment rules can be formulated.

[0192]

[0193] Among them, Pdom(a i ,w)=PSKY(a i ,w), Ndom(a i ,w)=NSKY(b j w), if and only if 0 < ρ + ≤1 and -1≤ρ - <0 indicates that the user authentication has passed.

[0194] Figure 3 An example diagram of a Skyline authentication model according to an embodiment of the present invention is shown. Figure 3As shown, P1 is a set of two-dimensional space vectors, which is composed of two-dimensional vectors A, B, C, D, E, F, etc. The forward Skyline calculation is performed on all points in P1 to obtain the upper contour set PSKY(P1) of the set P1, and the reverse Skyline calculation is performed to obtain the lower contour set NSKY(P1) of the set P1. PSKY(P1) and NSKY(P1) jointly constitute the data contour points of the set P1. For another tuple W in the two-dimensional space other than the set P1, the dominance relationship of W with each tuple in PSKY(P1) and NSKY(P1) is judged respectively. Since Pdom(B, W) = 1 and Ndom(E, W) = -1, the tuple W belongs to the data contour of the data set P1.

[0195] In the above embodiment, the result of the Skyline calculation of the collected biological feature data of the user and the authentication data set formed in the data training stage is taken as the basis for unlocking the local key of the user. The introduction of this mechanism facilitates user operation for the authentication client because the user no longer needs to input a username and a password. The authentication server still adopts the traditional PKI system, thereby ensuring the system security and the compatibility of the device. Meanwhile, according to the dominance relationship of the multi-dimensional data and the additive property of the Skyline algorithm, the boundary of the effective data is obtained, the authentication data set exclusive to a specified user in this system is formed, and the data set is stored as the authentication model of the user, thereby avoiding the direct storage of the original physiological data of the user by the system. In addition, the Skyline calculation can quickly obtain the effective range of different types of physiological data, greatly removes the repeated data, and reduces the storage amount of the system, that is, the best discrimination performance is ensured at the minimum memory cost.

[0196] Further, the message containing the first biological data is obtained by the collection terminal in the following manner:

[0197] Obtaining initial biological data in real time or within a specified time range;

[0198] Extracting biological data from the initial biological data according to a preset strategy to generate the first biological data;

[0199] Packaging the first biological data to obtain the message containing the first biological data;

[0200] Sending the message containing the first biological data to the client.

[0201] Further, if the first discrimination is successful, the fourth discrimination module 806 is further configured to:

[0202] Calling a first private key corresponding to the identity information to sign the first discrimination result to generate second discrimination data;

[0203] The first authentication result is encrypted by calling the encryption public key of the authentication server to generate third authentication data;

[0204] The authentication request is generated according to the identity information, the second authentication data and the third authentication data, and is sent to the authentication server to prompt the authentication server to decrypt the third authentication data by calling the decryption private key to obtain the first authentication result, and to sign the second authentication data by using the first public key and the first authentication result to obtain and return the signature result;

[0205] The signature result is output.

[0206] In the above embodiment, the first private key can sign the hash calculation result of the first authentication result to generate the second authentication data. The Skyline algorithm can quickly obtain the dominance relationship between the first biological data (input data) and the authentication data set (training model data), and the calculation result is used as the basis for identity authentication, the calculation amount is small, and the system response is rapid. At the same time, the generation, storage and use of the user key and other operations are strictly limited by the system running mechanism and directly affected by the user authentication result, and the data security is high. In addition, the authentication data set is stored, and the original physiological data of the user is not directly recorded, and the privacy protection effect is good.

[0207] The application also provides a computer readable storage medium, which stores one or more programs, and the programs are used by one or more processors to implement any of the above methods for fault identification of on-load tap changers.

[0208] The application has been described by reference to a few embodiments. However, as will be apparent to those skilled in the art, other embodiments, not expressly described above, are equally within the scope of the application, as defined by the appended claims.

[0209] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / an / the [device, component, etc.] are to be interpreted openly as referring to one or more instances of the device, component, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

[0210] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0211] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0212] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0213] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0214] Finally, it should be noted that the above-mentioned embodiments are merely intended for describing the technical solutions of the present application, but not for limiting it. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that the technical solutions of the present application can still be modified or equivalent replaced without departing from the spirit and scope of the present application, and any modification or equivalent replacement should be covered in the protection scope of the claims of the present application.

Claims

1. A method of updating a data set, characterized by, The method comprises: receiving a message containing first biological data sent by a collection terminal; parsing the message to obtain the first biological data; generating second biological data from the first biological data according to a first preset rule; calculating the second biological data and the original authentication data set to generate a new authentication data set; replacing the original authentication data set with the new authentication data set to obtain an updated authentication data set; wherein the message containing the first biological data is obtained by the collection terminal in the following manner: obtaining real-time or initial biological data within a specified time range; extracting biological data from the initial biological data according to a preset strategy to generate first biological data; wherein the preset strategy includes real-time collection of single physiological data, collection of minimum, average or maximum values of certain physiological data within a specified time range, and weighted values of the collected physiological data within the specified time range; packaging the first biological data to obtain a message containing the first biological data; sending the message containing the first biological data to the client; wherein the first biological data is generated into second biological data according to a first preset rule, comprising: a set of ordered sequences of the first biological data organized according to the first preset rule, mapping all first biological data to a specified dimension sequence according to physiological data types to obtain second biological data.

2. The method of claim 1, wherein, calculating the second biological data and the original authentication data set to generate a new authentication data set, comprising: performing Skyline calculation on the second biological data and the original authentication data set to obtain the final authentication data set.

3. A method of authenticating a client's registration, characterized by, The method comprises: receiving an updated authentication data set with identity information; generating a public-private key pair according to the identity information, wherein the public-private key pair includes a first public key and a first private key; calling a certification private key corresponding to the identity information to sign the first public key to generate a second public key, wherein a certification public key corresponding to the certification private key is stored in an authentication server; calling an encryption public key of the authentication server to encrypt the first public key to generate a third public key, wherein a decryption private key corresponding to the encryption public key is stored in the authentication server; generating a registration request according to the identity information, the second public key and the third public key, and sending the registration request to the authentication server to prompt the authentication server to call the decryption private key to decrypt the third public key to obtain the first public key, and use the certification public key and the first public key to verify the second public key to determine the verification result, if the verification is successful, then create new user data according to the identity information and the first public key; outputting the verification result to indicate the registration result of successful or failed registration.

4. An identity authentication method characterized by comprising: The method comprises: receiving a message containing first biological data with identity information; parsing the message to obtain the first biological data; generating second biological data from the first biological data according to a first preset rule; calling the original authentication data set according to the identity information; performing first authentication on the second biological data according to the original authentication data set to obtain and output a first authentication result; If the first authentication is successful, the identity information is subjected to second authentication by using digital signature and key encryption in combination with the first authentication result, and a second authentication result is obtained and outputted; The message containing the first biological data is obtained by the collection terminal in the following manner: Obtaining initial biological data in real time or within a specified time range; Extracting biological data from the initial biological data according to a preset strategy to generate first biological data; Packaging the first biological data to obtain the message containing the first biological data; Sending the message containing the first biological data to the client; The second authentication of the identity information by using digital signature and key encryption in combination with the first authentication result to obtain and output a second authentication result comprises: Calling a first private key corresponding to the identity information to sign the first authentication result to generate second authentication data; Calling an encryption public key of an authentication server to encrypt the first authentication result to generate third authentication data; Generating an authentication request according to the identity information, the second authentication data and the third authentication data, and sending the authentication request to the authentication server to prompt the authentication server to call a decryption private key to decrypt the third authentication data to obtain the first authentication result, and use a first public key and the first authentication result to verify the second authentication data to obtain and return a verification result; Outputting the verification result.

5. The method of claim 4, wherein, The first authentication of the second biological data according to the original authentication data set to obtain and output a first authentication result comprises: Judging a dominance relationship between the second biological data and the original authentication data set; If the second biological data is dominated by the original authentication data set, the first authentication is successful, otherwise, the first authentication fails.

6. The method of claim 5, wherein, The judgment of the dominance relationship between the second biological data and the original authentication data set comprises: Performing Skyline calculation on the second biological data and the original authentication data set to judge the dominance relationship between the second biological data and the original authentication data set.

7. An updating apparatus of a data set, characterized by comprising: The device comprises: A first receiving module for receiving a message containing first biological data sent by a collection terminal; A first analysis module for analyzing the message to obtain first biological data; A first generation module for generating second biological data from the first biological data according to a first preset rule; A first calculation module for calculating the second biological data and an original authentication data set to generate a new authentication data set; A first update module for replacing the original authentication data set with the new authentication data set to obtain an updated authentication data set; The message containing the first biological data is obtained by the collection terminal in the following manner: Obtaining initial biological data in real time or within a specified time range; According to a preset strategy, biological data is extracted from the initial biological data to generate first biological data; wherein the preset strategy includes: real-time acquisition of single physiological data, acquisition of minimum value, average value or maximum value of certain physiological data within a specified time range, and weighted value of the acquired physiological data within the specified time range; The first biological data is encapsulated to obtain a message containing the first biological data; The message containing the first biological data is sent to the client; Wherein, the first biological data is generated into second biological data according to the first preset rule, including: The first biological data is organized into an ordered sequence according to the first preset rule, and all the first biological data is mapped into a sequence of a specified dimension according to the physiological data type to obtain the second biological data.

8. The apparatus of claim 7, wherein, The first computing module is also used for: The second biological data and the original authentication data set are subjected to Skyline calculation to obtain a final authentication data set.

9. A registration device, characterized in that The device includes: The second receiving module is configured to receive an updated authentication data set with identity information; The second key pair generation module is configured to generate a public-private key pair according to the identity information, wherein the public-private key pair includes a first public key and a first private key; The second signature module is configured to call a certification private key corresponding to the identity information to sign the first public key to generate a second public key, wherein a certification public key corresponding to the certification private key is stored in an authentication server; The second encryption module is configured to call an encryption public key of the authentication server to encrypt the first public key to generate a third public key, wherein a decryption private key corresponding to the encryption public key is stored in the authentication server; The second signature verification module is configured to generate a registration request according to the identity information, the second public key and the third public key, and send the registration request to the authentication server, so as to prompt the authentication server to call the decryption private key to decrypt the third public key to obtain the first public key, and use the certification public key and the first public key to verify the second public key, to determine a verification result, if the verification is successful, new user data is created according to the identity information and the first public key; The second output module is configured to output the verification result to indicate a registration result of success or failure.

10. An authentication apparatus characterized by comprising: The device includes: The third receiving module is configured to receive a message containing first biological data with identity information; The third analysis module is configured to analyze the message to obtain the first biological data; The third generation module is configured to generate second biological data from the first biological data according to the first preset rule; The third calling module is configured to call an original authentication data set according to the identity information; The third identification module is configured to perform first identification on the second biological data according to the original authentication data set to obtain and output a first identification result; The fourth identification module is configured to perform second identification on the identity information using digital signature and key encryption if the first identification is successful, to obtain and output a second identification result; Wherein, the message containing the first biological data is obtained by the acquisition terminal in the following way: Obtaining initial biological data in real time or within a specified time range; According to a preset strategy, biological data is extracted from the initial biological data to generate first biological data; The first biological data is encapsulated to obtain a message containing the first biological data; The message containing the first biological data is sent to the client; If the first authentication is successful, the fourth authentication module is further configured to: Call a first private key corresponding to the identity information to sign the first authentication result to generate second authentication data; Call the encryption public key of the authentication server to encrypt the first authentication result to generate third authentication data; Generate an authentication request according to the identity information, the second authentication data and the third authentication data, and send the authentication request to the authentication server to prompt the authentication server to call the decryption private key to decrypt the third authentication data to obtain the first authentication result, and use the first public key and the first authentication result to verify the second authentication data to obtain and return the verification result; Output the verification result.

11. The apparatus of claim 10, wherein, The third authentication module is further configured to: Judge the dominance relationship between the second biological data and the original authentication data set; If the second biological data is dominated by the original authentication data set, the first authentication is successful, otherwise, the first authentication fails.

12. The apparatus of claim 11, wherein, The judgment of the dominance relationship between the second biological data and the original authentication data set includes: Carry out Skyline calculation on the second biological data and the original authentication data set to judge the dominance relationship between the second biological data and the original authentication data set.

Images