Authentication method, device, computer equipment and storage medium

Abstract

The present invention discloses an identity authentication method, apparatus, computer device, and storage medium. The present invention receives encrypted identity information sent by a target device and parses the encrypted identity information to obtain an encrypted identifier, encrypted identity feature information, and the target device's device identifier. When the encrypted identifier meets preset identity authentication conditions, the method obtains the private key information corresponding to the device identifier. The encrypted identity feature information is decrypted using the private key information to obtain decrypted identity feature information. The decrypted identity feature information is then verified to obtain a verification result for the encrypted identity information. This solution can improve the security of identity information verification.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an identity authentication method, apparatus, computer equipment, and storage medium. Background Art

[0002] With the rapid development of computer technology, facial recognition payment systems are becoming increasingly common. Facial recognition payment systems are payment platforms based on facial recognition technology that do not require a wallet, credit card, or mobile phone. To make a payment using facial recognition, consumers simply face the camera on the payment device's screen. The system automatically links their facial information to their personal account, completing the payment process and making the entire transaction extremely convenient.

[0003] In related technologies, during the facial payment process, the payment device collects the consumer's facial image through a camera, obtains the consumer's identity information based on the collected consumer's facial image, and then deducts money from the account bound to the consumer's identity information.

[0004] During research and practice on related technologies, the inventors of this application discovered that in existing technologies, after a payment device captures a consumer's image, it may use the image for other purposes, thereby leaking the consumer's identity information. Therefore, existing facial recognition payment methods are relatively insecure. Summary of the Invention

[0005] The embodiments of the present application provide an identity authentication method, apparatus, computer device, and storage medium, which can improve the security of identity information verification.

[0006] This embodiment of the present application provides an identity authentication method, including:

[0007] Receive the encrypted identity information sent by the target device, and parse the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information and the device identifier of the target device;

[0008] When the encryption identifier meets the preset identity authentication conditions, the private key information corresponding to the device identifier is obtained;

[0009] Decrypting the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information;

[0010] The decrypted identity feature information is verified to obtain a verification result of the encrypted identity information.

[0011] This embodiment of the present application provides another identity authentication method, including:

[0012] Obtaining the target device's device identification, user identity feature information, and public key information used to encrypt the user identity feature information;

[0013] Encrypting the user's identity feature information according to the public key information to obtain encrypted identity feature information;

[0014] Obtaining the number of historical encryptions and determining an encryption identifier corresponding to the encryption process based on the number of historical encryptions, wherein the number of historical encryptions is the number of times the user identity feature information is encrypted before the encryption process;

[0015] Generate encrypted identity information based on the encrypted identity feature information, the encryption identifier, and the device identifier;

[0016] User authentication based on encrypted identity information.

[0017] Accordingly, an embodiment of the present application further provides an identity authentication device, comprising:

[0018] A parsing unit, configured to receive the encrypted identity information sent by the target device and parse the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information, and the device identifier of the target device;

[0019] A first acquiring unit is configured to acquire private key information corresponding to the device identifier when the encryption identifier meets a preset identity authentication condition;

[0020] a decryption unit, configured to decrypt the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information;

[0021] The first verification unit is used to verify the decrypted identity feature information to obtain a verification result of the encrypted identity information.

[0022] In some embodiments, the parsing unit includes:

[0023] A first acquisition subunit is used to acquire a target structure in the encrypted identity information, where the target structure includes a first identification field, a feature field, and a second identification field;

[0024] The extraction subunit is used to extract the encryption identifier from the first identifier field, extract the encrypted identity feature information from the feature field, and extract the device identifier from the second identifier field.

[0025] In some embodiments, the first verification unit includes:

[0026] The second obtaining subunit is configured to obtain user identity feature information corresponding to the device identifier from a preset identity information database, wherein the preset identity information database includes sample user identity feature information corresponding to the sample device identifier;

[0027] A matching subunit, configured to match the decrypted identity feature information with the user identity feature information;

[0028] A first determining subunit is configured to determine that the encrypted identity information verification is successful if the decrypted identity feature information matches the user identity feature information;

[0029] The second determining subunit is configured to determine that the encrypted identity information verification fails if the decrypted identity feature information fails to match the user identity feature information.

[0030] In some embodiments, the apparatus further comprises:

[0031] A third obtaining unit is configured to obtain a number of historical decryption operations corresponding to the device identifier to obtain a first value, wherein the number of historical decryption operations is the number of decryption operations performed on the encrypted identity feature information corresponding to the device identifier before the decryption process;

[0032] a comparing unit, configured to obtain a second value for verifying the encryption identifier based on the value of the encryption identifier, and compare the first value with the second value;

[0033] The second determining unit is configured to determine that the encryption identifier meets a preset identity authentication condition if the first value is less than the second value.

[0034] In some embodiments, the apparatus further comprises:

[0035] A first receiving unit is configured to receive a key distribution request sent by a target device, where the key distribution request carries a device identifier of the target device;

[0036] The third determining unit is configured to generate private key information corresponding to the device identification according to the device identification.

[0037] Accordingly, the embodiment of the present application further provides another identity authentication device, including:

[0038] A second acquiring unit, configured to acquire a device identifier of a target device, user identity feature information, and public key information used to encrypt the user identity feature information;

[0039] An encryption unit, configured to encrypt the user identity feature information according to the public key information to obtain encrypted identity feature information;

[0040] A first determining unit is configured to obtain a historical number of encryptions and determine an encryption identifier corresponding to the encryption process based on the value of the historical number of encryptions, wherein the historical number of encryptions is the number of encryption operations performed on the user identity feature information before the encryption process;

[0041] A generating unit, configured to generate encrypted identity information based on the encrypted identity feature information, the encryption identifier, and the device identifier of the target device;

[0042] The second verification unit is used to perform user identity authentication based on the encrypted identity information.

[0043] In some embodiments, the generating unit includes:

[0044] A third determining subunit is configured to determine a preset structure for storing information, the preset structure comprising: a first identification field, a characteristic field, and a second identification field;

[0045] A writing subunit, configured to write the encrypted identity feature information into the feature field, write the encryption identifier into the first identifier field, and write the device identifier into the second identifier field, thereby generating a target structure after storing the information;

[0046] Get subunit, used to get encrypted identity information based on target structure.

[0047] In some embodiments, the apparatus further comprises:

[0048] A detection unit, configured to detect whether public key information exists in a target device;

[0049] a sending unit, configured to send a key distribution request if the target device does not have public key information, the key distribution request carrying a device identifier of the target device;

[0050] The second receiving unit is configured to receive the public key information returned in response to the key distribution request.

[0051] In some embodiments, the second verification unit includes:

[0052] an initiator unit, configured to initiate a near field communication function of a target device and broadcast a communication signal via the near field communication function of the target device;

[0053] an establishing subunit, configured to receive a response signal from the responding device to the communication signal, and establish a communication connection with the responding device based on the response signal;

[0054] The verification subunit is used to send the encrypted identity information to the responding device to verify the encrypted identity information.

[0055] In some embodiments, the apparatus further comprises:

[0056] The acquisition unit is used to acquire a user's facial image and perform feature extraction on the facial image to obtain the user's facial feature data;

[0057] The processing unit is used to serialize the facial feature data to obtain the user's identity feature information.

[0058] In some embodiments, the first determining unit includes:

[0059] The calculation subunit is used to determine the sum of the numerical value of the number of historical encryption times and a preset numerical value, and generate an encryption identifier based on the sum.

[0060] Correspondingly, an embodiment of the present application also provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes any identity authentication method provided in any embodiment of the present application.

[0061] Correspondingly, an embodiment of the present application further provides a storage medium, which stores a plurality of instructions suitable for loading by a processor to execute the above-mentioned identity authentication method.

[0062] Embodiments of the present application also provide a computer program product or computer program, which includes computer instructions stored in a storage medium. A processor of a terminal reads the computer instructions from the storage medium and executes the computer instructions, causing the terminal to perform the identity authentication method provided in various optional implementations of the above aspects.

[0063] After receiving the encrypted identity information, the embodiment of the present application extracts the encrypted identity feature information, the encryption identifier and the device identifier from the encrypted identity information. When the encryption identifier meets the preset identity authentication conditions, the encrypted identity feature information is decrypted according to the private key information corresponding to the device identifier, and then the identity feature information obtained after the decryption is verified to obtain the identity information verification result, which can improve the security of the identity information verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 A schematic diagram of a scenario of an identity authentication system provided in an embodiment of the present application.

[0066] Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application.

[0067] Figure 3 A flowchart of another identity authentication method provided in an embodiment of the present application.

[0068] Figure 4 A flowchart of another identity authentication method provided in an embodiment of the present application.

[0069] Figure 5 This is a structural block diagram of an identity authentication device provided in an embodiment of the present application.

[0070] Figure 6 This is a structural block diagram of another identity authentication device provided in an embodiment of the present application.

[0071] Figure 7 A schematic diagram of the structure of a computer device provided in an embodiment of the present application.

[0072] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of this application.

[0074] The embodiments of the present application provide an identity authentication method, device, storage medium and terminal. Specifically, the embodiments of the present application provide an identity authentication device suitable for computer devices. The computer device can be a terminal or a server and other devices. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in the embodiments of the present application.

[0075] The identity authentication method in each embodiment of the present application can use cloud technology to process the user's identity information.

[0076] Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to enable data computing, storage, processing, and sharing. Cloud technology is a general term for network, information technology, integration technology, management platform technology, and application technology, all based on the cloud computing business model. It can form a resource pool for on-demand, flexible, and convenient use. Cloud computing technology will become a crucial support. Backend services for technical network systems, such as those for video sites, image sites, and more portals, require significant computing and storage resources. With the rapid development and application of the internet industry, every item will likely have its own unique identifier, requiring transmission to backend systems for logical processing. Data of varying levels will be processed separately, and data from various industries will require robust system support, which can be achieved through cloud computing.

[0077] Specifically, the identity authentication method in each embodiment of the present application can use cloud security technology in cloud technology to verify the user identity information.

[0078] Cloud security refers to the security software, hardware, users, organizations, and cloud platforms used in cloud computing business models. It integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behaviors. Through a network of numerous clients, cloud security detects anomalies in software behavior across the network, obtains the latest information on Trojans and malicious programs on the internet, and sends it to servers for automatic analysis and processing. Solutions to these viruses and Trojans are then distributed to every client.

[0079] The main research directions of cloud security include: cloud computing security, which focuses on how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance auditing, etc.; cloudification of security infrastructure, which focuses on how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building ultra-large-scale security event, information collection and processing platforms through cloud computing technology, realizing the collection and correlation analysis of massive information, and improving the ability to control security incidents and risks across the entire network; cloud security services, which focuses on various security services provided to users based on cloud computing platforms, such as antivirus services.

[0080] See also Figure 1 , Figure 1 A scenario diagram of the identity authentication system provided in an embodiment of the present application includes a terminal and a server. The terminal and the server can be connected through a network, and the network includes network entities such as routers and gateways.

[0081] Among them, the server can receive the encrypted identity information sent by the target device, and parse the encrypted identity information to obtain the encrypted identifier, encrypted identity feature information and the device identifier of the target device; when the encrypted identifier meets the preset identity authentication conditions, obtain the private key information corresponding to the device identifier; decrypt the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information; verify the decrypted identity feature information to obtain the verification result of the encrypted identity information.

[0082] Among them, the terminal can obtain the device identification, user identity feature information, and public key information used to encrypt the user identity feature information of the target device; encrypt the user identity feature information according to the public key information to obtain the encrypted identity feature information; obtain the historical number of encryptions, and determine the encryption identifier corresponding to the encryption processing according to the value of the historical number of encryptions, wherein the historical number of encryptions is the number of encryption operations performed on the user identity feature information before the encryption processing; generate encrypted identity information according to the encrypted identity feature information, the encryption identifier and the device identification; and perform user identity authentication based on the encrypted identity information.

[0083] It should be noted that Figure 1 The scenario diagram of the identity authentication system shown is merely an example. The identity authentication system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. A person skilled in the art will appreciate that, with the evolution of the identity authentication system and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is equally applicable to similar technical problems.

[0084] Based on the above issues, the embodiments of the present application provide a first identity authentication method, apparatus, computer device, and storage medium that can improve the security of identity information verification. The following are detailed descriptions of each. It should be noted that the order in which the following embodiments are described does not limit the preferred order of the embodiments.

[0085] The identity authentication method in each embodiment of the present application can use artificial intelligence technology to collect user identity information.

[0086] Artificial Intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that seeks to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI also involves studying the design principles and implementation methods of various intelligent machines, enabling them to possess the capabilities of perception, reasoning, and decision-making.

[0087] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, large-scale authentication, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0088] Specifically, the identity authentication method in each embodiment of the present application can use face recognition technology in artificial intelligence technology. For example, face recognition technology is used when collecting face information through a camera and extracting face image features.

[0089] Face recognition is a biometric technology that identifies people based on their facial features. It involves using a camera or video camera to capture images or video streams containing faces, automatically detecting faces within the images, and then identifying the detected faces. This technology is also commonly referred to as portrait recognition or facial recognition.

[0090] An embodiment of the present application provides an identity authentication method, which can be executed by a terminal or a server. The embodiment of the present application takes the identity authentication method executed by a server as an example for explanation.

[0091] like Figure 2 As shown, Figure 2 This is a flow chart of an identity authentication method provided in an embodiment of the present application. The specific process of the identity authentication method can be as follows:

[0092] 101. Receive encrypted identity information sent by a target device, and parse the encrypted identity information to obtain an encrypted identifier, encrypted identity feature information, and a device identifier of the target device.

[0093] The target device refers to the device that generates the encrypted identity information, and the target device can send the encrypted identity information to the server in a variety of ways.

[0094] For example, the target device may directly send the encrypted identity information to the server, or the target device may send the encrypted identity information to another device, which then sends the encrypted identity information to the server.

[0095] The encrypted identity information refers to the user identity feature information that needs to be verified. The user identity feature information may include multiple types, for example, the user identity feature information may be facial information, etc.

[0096] In some embodiments, when the encrypted identity information can be sent by the target device to the server, the target device can send the encrypted identity information to the server in the form of sending a request.

[0097] For example, the target device may send an information verification request to the server, where the information verification request carries the encrypted identity information. When the server receives the information verification request sent by the target device, it may obtain the encrypted identity information from the information verification request.

[0098] The encryption identifier is used to represent the encryption identity information. Different encryption identifiers can represent different encryption identity information. The encryption identifier can be composed of numbers, for example, the encryption identifier can be "1".

[0099] For example, the encryption identifier may include: "1", "2", "3", etc., where "1" may represent the first encryption identity information, "2" may represent the second encryption identity information, and "3" may represent the third encryption identity information.

[0100] In an embodiment of the present application, to prevent the same encryption identifier from appearing in different encrypted identity information, the target device may determine the encryption identifier of the encrypted identity information based on the number of times the user identity feature information has been encrypted. Specifically, the target device may set a counter that records the number of times the user identity feature information has been encrypted. Upon completion of an encryption operation, the counter may update and store the number of encryption operations.

[0101] For example, when an encryption operation is currently being performed on user identity feature information, the number of encryption times stored in the counter may be obtained, such as 5 times. It can then be determined that the current encryption operation is the sixth encryption operation, and the encryption identifier of the encrypted identity information obtained by the current encryption operation is determined to be "6."

[0102] The encrypted identity feature information refers to the identity feature information obtained by encrypting the initial user identity feature information, and the encrypted identity feature information may be composed of numbers.

[0103] For example, the encrypted identity feature information may be "1234", etc. Specifically, the initial user identity feature information and the encryption operation of the user identity feature information will be described in detail in subsequent steps.

[0104] The target device's device ID is a string of characters that represents the target device's ID (identity document). This ID can consist of numbers, letters, and / or symbols. For example, the device ID could be "ER374."

[0105] In some embodiments, to ensure the validity of the encrypted identity information, the step of "parsing the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information, and the device identifier of the target device" may include the following operations:

[0106] Obtain a target structure in the encrypted identity information, where the target structure includes a first identification field, a feature field, and a second identification field;

[0107] The encryption identifier is extracted from the first identifier field, the encrypted identity feature information is extracted from the feature field, and the device identifier is extracted from the second identifier field.

[0108] Among them, a structural element is a data set consisting of a series of data with the same data type or different data types, also called a structure.

[0109] A data type is a collection of values ​​with the same properties and a set of operations defined on this collection of values. There are many types of data types.

[0110] For example, integers (int, long), floating-point types (float, double), and strings. Integers refer to numbers without decimal points and exponent symbols, such as "1"; floating-point types refer to numbers with decimal parts, such as "1.1"; and strings refer to a sequence of characters, such as "cdf437".

[0111] The target structure then refers to the data set of multiple data that constitute the encrypted identity information. The first identification field, the characteristic field, and the second identification field each refer to different data, representing different contents within the encrypted identity information. The data types of the first identification field, the characteristic field, and the second identification field can be determined based on the corresponding contents.

[0112] For example, the content of the encrypted identity information includes: encrypted identity feature information, device identification and encryption identification, then the feature field may represent the encrypted identity feature information, the second identification field may represent the device identification, and the first identification field may represent the encryption identification.

[0113] Among them, the encrypted identity feature information can be a string sequence, then the data type of the feature field corresponding to the encrypted identity feature information can be a string type; the device identifier can be a string sequence, then the data type of the second identifier field corresponding to the device identifier can be a string type; the encryption identifier can be an integer, then the data type of the first identifier field corresponding to the encryption identifier can be an integer.

[0114] Specifically, the contents corresponding to the feature field, the second identification field, and the first identification field are extracted from the target structure respectively, and then the encrypted identity feature information, the device identification, and the encryption identification can be obtained from the encrypted identity information.

[0115] For example, a target structure is obtained from the encrypted identity information. The target structure includes the characteristic field "2DFJFE632", the second identification field "SN1", and the first identification field "1". The characteristic field represents the encrypted identity characteristic information, the second identification field represents the device identification, and the first identification field represents the encryption identification. Therefore, from the target structure, extract "2DFJFE632" to obtain the encrypted identity characteristic information; extract "SN1" to obtain the device identification; and extract "1" to obtain the encryption identification.

[0116] 102. When the encryption identifier meets the preset identity authentication condition, obtain the private key information corresponding to the device identifier.

[0117] The preset identity authentication condition is a condition set to determine whether the encrypted identity information is secure data, which can ensure the security of verifying the identity information.

[0118] In some embodiments, to improve the security of identity information verification, determining whether the encrypted identifier meets the preset identity verification conditions may include the following steps:

[0119] Obtaining a historical decryption count corresponding to the device identifier to obtain a first value, wherein the historical decryption count is the number of decryption operations performed on the encrypted identity feature information corresponding to the device identifier before the decryption process;

[0120] Based on the value of the encryption identifier, obtaining a second value for verifying the encryption identifier, and comparing the first value with the second value;

[0121] If the first value is less than the second value, it is determined that the encryption identifier meets the preset identity authentication condition.

[0122] The number of historical decryption times refers to the number of times the encrypted identity feature information corresponding to the device identifier is decrypted before the encrypted identity feature information is decrypted.

[0123] For example, before decrypting the encrypted identity feature information, the server has performed N decryption operations on the encrypted identity feature information corresponding to the device identifier, so the number of historical decryption operations can be determined to be N. Where N is a natural number, such as 1, 2, 3, 4, etc.

[0124] The first value is the value corresponding to the number of historical decryption times. For example, if the number of historical decryption times is 5, the first value can be determined to be 5.

[0125] The second value is also the value in the encryption identifier. For example, the encryption identifier may be "6", and the second value may be determined to be 6.

[0126] As mentioned in the previous step, the encryption identifier can be the number of times the user's identity information has been encrypted. The historical decryption count can be the number of times the user's identity information has been decrypted. Therefore, by determining whether the encryption count is greater than the decryption count, we can further determine whether to repeatedly decrypt the same encrypted identity information, thereby ensuring the security of user information.

[0127] For example, when the target device encrypts user identity information for the first time, the encryption flag's value can be determined to be "1," i.e., the second value, resulting in the encrypted identity information. The target device then sends this encrypted identity information to the server. The server decrypts the user identity information within the encrypted identity information and determines the historical decryption count to be "0," i.e., the first value. Comparing the first value with the second value, it can be determined that the first value is less than the second value. This indicates that this is the first decryption operation performed on the user identity information within the encrypted identity information and that it is the user's own operation, indicating that the current decryption operation is secure.

[0128] For another example, when the server obtains the encrypted identity information, the extracted encryption identifier can be "3", indicating that the number of encryption operations is 3, and then the server obtains the historical decryption number of 3, indicating that the number of decryption operations is 3, then the current decryption operation to be performed is the 4th decryption, then it means that the encrypted identity information is repeatedly decrypted, which does not meet the preset identity authentication, and the 4th decryption operation will not be performed, thereby avoiding the risk of user identity feature information being stolen.

[0129] The private key is a password used to decrypt the encrypted identity information. The password can be composed of multiple numbers. For example, the private key corresponding to the target device's device ID can be "7483675".

[0130] In some embodiments, in order to ensure the security of the private key information of the target device, before the step of "obtaining the private key information corresponding to the device identifier", the following steps may be further included:

[0131] receiving a key distribution request from a target device, the key distribution request carrying a device identifier of the target device;

[0132] Generate the private key information corresponding to the device identification according to the device identification.

[0133] The key distribution request is sent by the target device to the server to request the server to generate the private key information of the target device.

[0134] When the server receives a key distribution request from a target device, it can obtain the device identifier carried in the key distribution request, i.e., the device identifier of the target device. Generating private key information based on the device identifier can be done in a variety of ways, such as using the RAS algorithm. This is not limited in this application, and other methods for generating private key information are also possible, which will not be further described here.

[0135] RSA is a public-key cryptosystem. Public-key cryptosystems use different encryption and decryption keys, making it computationally infeasible to derive the decryption key from a known encryption key. In a public-key cryptosystem, the encryption key (public key) PK is public information, while the decryption key (secret key) SK is kept secret. Both encryption algorithm E and decryption algorithm D are public.

[0136] The RSA algorithm is an asymmetric encryption algorithm. The so-called asymmetric means that the algorithm requires a pair of keys. If one of them is used for encryption, the other is required for decryption.

[0137] The RSA algorithm involves three parameters: n, e1, and e2. n is the product of two large prime numbers, p and q (a prime number, also known as a prime number, is infinite and is a natural number greater than 1 that cannot be divided by any other natural number except 1 and itself). The number of bits used in n's binary representation is the so-called key length. e1 and e2 are a pair of related values. e1 can be any value, but it must be coprime to (p-1) x (q-1) (two integers that have only one common divisor, i.e., 1). Furthermore, e2 is chosen so that (e1 x e2) = 1 (mod (p-1) x (q-1)). The mod operation, or remainder operation, is used to find the remainder when one integer is divided by another. Therefore, (n, e1) and (n, e2) form the key pair. (n, e1) is the public key, and (n, e2) is the private key.

[0138] In the embodiment of the present application, when a key pair is generated using the RSA algorithm, in order to ensure that different target devices correspond to different key pairs, the values ​​of p and q can be determined according to the device identification of the target device.

[0139] For example, the device ID could be "13aa." Based on the numeric combination "13" in the device ID, the value of p could be determined to be 13; based on the letters "aa" in the device ID, the value of q could be determined to be 11. Determining the value of q based on the letters in the device ID can be done by obtaining a sequence number based on the sequence of each letter in the alphabet, and then combining the sequence numbers corresponding to all the letters in the device ID to obtain the value of q.

[0140] Furthermore, after determining the values ​​of p and q based on the device identifier, the value of n is determined to be 143 based on the product of p and q. The value of e1 is determined to be 1 based on the coprime relationship between e1 and (p-1)x(q-1). The value of e2 is determined to be 10 based on (e1xe2)=1(mod(p-1)x(q-1)). The public key is then determined to be (143, 1) and the private key is (143, 10), indicating that the private key information is (143, 10).

[0141] 103. Decrypt the encrypted identity feature information according to the private key information to obtain decrypted identity feature information.

[0142] The encrypted identity feature information can be decrypted according to the RSA decryption algorithm.

[0143] The RSA encryption and decryption algorithms are the same. Let A be the plaintext and B be the ciphertext, then: A=B^e2( mod n); B=A^e1(modn).

[0144] Among them, e1, e2 and n have been explained in the previous step. In the public key encryption system, the public key is generally used for encryption and the private key for decryption.

[0145] For example, the encrypted identity information could be "2," meaning the ciphertext B is 2, and the private key information could be (143, 10). Then, using the RSA decryption algorithm: A = B^e² (mod n), the plaintext A is calculated to be 1024, meaning the decrypted identity information is "1024."

[0146] 104. Verify the decrypted identity feature information to obtain a verification result of the encrypted identity information.

[0147] The encrypted identity feature information is decrypted through the above steps. After the decrypted identity feature information is obtained, the decrypted identity feature information can be verified.

[0148] In some embodiments, to improve information verification efficiency, the step of "verifying the decrypted identity feature information to obtain a verification result of the encrypted identity information" may include the following process:

[0149] Obtain user identity feature information corresponding to the device identifier from a preset identity information database;

[0150] Matching the decrypted identity feature information with the user's identity feature information;

[0151] If the decrypted identity feature information matches the user identity feature information successfully, the encrypted identity information verification is determined to be successful;

[0152] If the decrypted identity feature information fails to match the user identity feature information, it is determined that the encrypted identity information verification has failed.

[0153] The preset identity information database, ie, the identity information database in the server, stores a plurality of sample user identity feature information, and each sample user identity feature information may correspond to a sample device identifier.

[0154] For example, the preset identity information library may store first user identity feature information, second user identity feature information, and third user identity feature information. The device identifier corresponding to the first user identity feature information may be "1," the device identifier corresponding to the second user identity feature information may be "2," and the device identifier corresponding to the third user identity feature information may be "3." If the device identifier of the target device is "3," the user identity feature information corresponding to the device identifier of the target device obtained from the preset identity information library may be the third user identity feature information.

[0155] Furthermore, the acquired user identity feature information corresponding to the target device may be matched with the decrypted identity feature information to obtain a matching result, and a verification result of the encrypted identity information may be obtained based on the matching result.

[0156] For example, the user identity feature information corresponding to the target device obtained can be "2", and the decrypted identity feature information can be "2". By matching the user identity feature information with the decrypted identity feature information, it can be determined that the user identity feature information and the decrypted identity feature information match successfully, indicating that the decrypted identity feature information is consistent with the user identity feature information, and it can be determined that the encrypted identity information is verified successfully.

[0157] For another example, the user identity feature information corresponding to the target device obtained may be "3", and the decrypted identity feature information may be "2". By matching the user identity feature information with the decrypted identity feature information, it can be determined that the user identity feature information and the decrypted identity feature information fail to match, indicating that the decrypted identity feature information is inconsistent with the user identity feature information, and it can be determined that the verification of the encrypted identity information has failed.

[0158] The embodiment of the present application discloses an identity authentication method, which includes: receiving encrypted identity information sent by a target device, parsing the encrypted identity information to obtain an encrypted identifier, encrypted identity feature information, and a device identifier of the target device; when the encrypted identifier meets a preset identity authentication condition, obtaining private key information corresponding to the device identifier; decrypting the encrypted identity feature information according to the private key information to obtain decrypted identity feature information; verifying the decrypted identity feature information to obtain a verification result of the encrypted identity information. In this way, after receiving the encrypted identity information, the encrypted identity feature information, the encrypted identifier, and the device identifier are extracted from the encrypted identity information; when the encrypted identifier meets the preset identity authentication condition, the encrypted identity feature information is decrypted according to the private key information corresponding to the device identifier, and then the identity feature information obtained after the decryption is verified to obtain an identity information verification result, which can improve the security of identity information verification.

[0159] Based on the above introduction, the following examples will be given to further illustrate the identity authentication method of this application. In this embodiment, the identity authentication device will be specifically integrated into the terminal as an example for explanation. Please refer to Figure 3 , Figure 3 This is a flow chart of another identity authentication method provided in an embodiment of the present application. The specific process can be as follows:

[0160] 201. Obtain a device identifier of a target device, user identity feature information, and public key information used to encrypt the user identity feature information.

[0161] The target device is a device used to obtain user identity feature information and encrypt the user identity feature information. For example, the target device can be a smart phone.

[0162] The device identification of the target device refers to the serial number used to identify the target device.

[0163] For example, the device ID of the target device may be "123AB". The device ID of the target device may be set when the target device leaves the factory. Different devices may correspond to different device IDs.

[0164] Among them, user identity feature information refers to information used to identify different user identities. For example, user identity feature information can be facial information, fingerprint information, or voice information, etc. In the embodiment of the present application, facial information can be used as an example.

[0165] The public key is a password used to encrypt the user's identity information. The password can be composed of multiple numbers. For example, the private key can be "123".

[0166] In some embodiments, to ensure the security of the encryption processing of the user identity feature information, before the step of "obtaining the device identification of the target device, the user identity feature information, and the public key information used to encrypt the user identity feature information", the following steps may also be included:

[0167] Detect whether public key information exists in the target device;

[0168] If the target device does not have public key information, a key distribution request is sent, which carries the device identification of the target device;

[0169] Receive public key information returned in response to a key distribution request.

[0170] The target device may be provided with a SE (Secure Element) chip for storing public key information and performing encryption and decryption operations on user identity feature information based on the public key information.

[0171] An SE (Security Module) is a microcomputer that implements secure data storage, encryption, and decryption through a security chip and chip operating system. SEs can be packaged in various forms, including smart cards and embedded security modules (eSEs). Developed for NFC (Near Field Communication) terminals, eSEs utilize a smart security chip that meets the CCEAL5+ (Certified Certified High-Level Information Security) security level. They also feature a built-in secure operating system, meeting terminal requirements for secure key storage and data encryption services. They are widely used in finance, mobile payments, urban transportation, healthcare, retail, and other fields, ensuring the security of online payments while also serving as a wallet for offline payments in conjunction with NFC.

[0172] Specifically, the presence of public key information on the target device can be detected by detecting whether the public key information is stored in the SE chip of the target device. If it is detected that the public key information is not stored in the SE chip, a key distribution request can be sent to the server to ensure the privacy of the public key information. The server generates the public key information corresponding to the target device based on the key distribution request.

[0173] After the target device sends a key distribution request to the server, the server obtains the device identifier in the key distribution request and generates corresponding public and private key information based on the device identifier. The specific implementation method for the server to generate public and private key information based on the device identifier has been detailed in the previous embodiment and will not be repeated here. The server can then send the generated public and private key information to the target device and store the public and private key information corresponding to the target device's device identifier.

[0174] In some embodiments, in order to quickly obtain user identity feature information, before the step of "obtaining the device identifier of the target device, the user identity feature information, and the public key information used to encrypt the user identity feature information", the following steps may also be included:

[0175] Collect the user's facial image and perform feature extraction on the facial image to obtain the user's facial feature data;

[0176] The facial feature data is serialized to obtain the user's identity feature information.

[0177] The target device may include a camera, and the target device may capture a user's facial image by turning on the camera.

[0178] In the field of artificial intelligence, when using facial images for face recognition and identity verification, facial features need to be represented as vectors that can be understood by computers. In other words, facial features need to be expressed. The description of facial features can generally be divided into two categories: geometric features and algebraic features.

[0179] Geometric features are based on the shape and geometric relationships of facial organs. A face is composed of organs such as the eyes, nose, mouth, and chin. The geometric positions of these feature points are relatively fixed, and their geometric features can be used as important features of the face. This approach, based on prior knowledge of the geometric relationships of facial topology, extracts features of the main facial organs using a structure-based approach at the knowledge level, representing the face as a set of geometric feature vectors. Algebraic features are determined by the grayscale distribution of the facial image itself and describe the internal information of the image. This method captures and describes the characteristics of the face as a whole.

[0180] In some embodiments, facial feature extraction from facial images can be performed based on the aforementioned geometric features, primarily using facial features. These features may include eyes, eyebrows, nose, mouth, and ears. Facial feature extraction can be performed using a variety of algorithms, such as the Active Shape Model (ASM) algorithm.

[0181] ASM refers to a subjective shape model, which abstracts the target object through a shape model. ASM is an algorithm based on the Point Distribution Model (PDM). In PDM, the geometric shapes of similar objects, such as faces, hands, hearts, and lungs, are represented by a shape vector formed by concatenating the coordinates of several key feature points (landmarks). The ASM algorithm provides a trained feature point model, which can be directly used to extract feature points from facial images in practical applications.

[0182] For example, a user's face image is captured by the target device's camera, and then the facial region in the image is detected. The trained feature point model provided by the ASM algorithm is obtained, and facial feature points are extracted from the facial region using the trained feature point model to obtain the user's facial feature data.

[0183] In some embodiments, facial features can also be extracted using the Local Binary Patterns (LBP) algorithm. LBP is a non-parametric operator that describes the local spatial structure of an image. The LBP operator can be used to analyze image texture features and has been shown to have strong discriminative power in texture classification. The LBP operator is defined as a grayscale-invariant texture operator, derived from the common definition of local neighborhood texture.

[0184] The basic concept of LBP is to use the grayscale value of the central pixel as a threshold and compare it with its neighborhood to generate a binary code to represent local texture features. The LBP operator is one of the best texture descriptors for texture analysis. Its main advantages include: the grayscale of the LBP operator does not change with any single transformation, resulting in good grayscale robustness, including robustness under lighting conditions; and fast computational speed. Because it can be obtained through comparison operations within a small neighborhood, it makes it possible to analyze images under complex real-time conditions. Because the LBP operator is a parameter-free method, no prior assumptions about its distribution are required during its application.

[0185] For example, within a 3x3 neighborhood of a facial image, the grayscale value of the center pixel in the neighborhood is used as a threshold. The grayscale values ​​of the eight adjacent pixels are compared with the threshold. If the surrounding pixel values ​​are greater than the center pixel value, the pixel is marked as 1; otherwise, it is marked as 0. This comparison of the eight points within the 3x3 neighborhood generates an 8-bit binary number (usually converted to a decimal number, known as an LBP code, of which there are 256 types). This LBP value is then used to reflect the texture information of the area. The texture information of all these areas is then combined to obtain the texture information of the facial image, which can be used as facial feature information.

[0186] Since the generated facial feature data has a large amount of data and may include multiple types of data, in order to facilitate the storage of the facial feature data, the facial feature data can be serialized and converted into a serialized string.

[0187] Serialization is the process of converting an object's state information into a form that can be stored or transmitted. During serialization, an object writes its current state to a temporary or persistent storage area. The object can then be recreated by reading, or deserializing, its state from the storage area. Serialization enables other code to view or modify object instance data that would otherwise be inaccessible.

[0188] Typically, all fields of an object instance are serialized, meaning that the data is represented as the instance's serialized data. This allows code that can interpret the format to determine the value of that data independently of the member's accessibility. Similarly, deserialization extracts data from the serialized representation and sets the object's state directly, also independent of accessibility rules.

[0189] For example, facial feature data may include: first data, second data, third data, fourth data, etc. By serializing the first data, second data, third data, and fourth data, a string corresponding to the facial feature data, such as "125", can be generated. Therefore, the facial identity feature information can be determined to be "125".

[0190] 202. Encrypt the user identity feature information according to the public key information to obtain encrypted identity feature information.

[0191] The user identity feature information may be encrypted using an RSA encryption algorithm.

[0192] In the previous embodiment, we mentioned that the RSA encryption and decryption algorithms are identical. Let A be the plaintext and B be the ciphertext, then: A = B^e1( mod n); B = A^e2 ( mod n). e1, e2, and n are parameters in the RSA algorithm, and (n, e1) and (n, e2) are the key pair. (n, e1) is the public key, and (n, e2) is the private key. In a public key encryption system, the public key is generally used for encryption, and the private key is used for decryption.

[0193] For example, the user identity feature information can be "125", that is, the plaintext A is: 125, and the public key information can be (143, 2). Then, according to the RSA encryption algorithm: B=A^e1(mod n), calculation processing can be performed to obtain the ciphertext B: 15625, that is, the encrypted identity feature information is "15625".

[0194] 203. Obtain the number of historical encryptions, and determine the encryption identifier corresponding to the encryption process according to the value of the number of historical encryptions.

[0195] The number of historical encryption times refers to the number of times the user identity feature information is encrypted before the current encryption process is performed on the user identity feature information.

[0196] For example, before the current encryption process of the user identity feature information, the target device has performed N encryption operations on the user identity feature information, and the number of historical encryption operations can be determined to be N. Wherein, N is a natural number, such as 1, 2, 3, 4, etc.

[0197] In some embodiments, to avoid the same encryption identifier appearing in different encrypted identity information, the step of "determining the encryption identifier corresponding to the encryption process based on the value of the number of historical encryptions" may include the following operations:

[0198] The sum of the historical encryption times and a preset value is determined, and an encryption identifier is generated based on the sum.

[0199] The preset value is used to distinguish the encryption identifier in each encrypted identity information, and the preset value can be a natural number greater than 0, such as 1, 2, 3, 4, etc.

[0200] For example, the historical encryption times may be 3 times, then the value of the historical encryption times is: 3, the preset value may be: 1, and the sum of the historical encryption times and the preset value may be calculated to obtain a sum of: 4, based on which an encryption identifier "4" may be generated.

[0201] 204. Generate encrypted identity information based on the encrypted identity feature information, the encryption identifier, and the device identifier of the target device.

[0202] Among them, encrypted identity information refers to information used to verify user identity. It is identity information obtained by performing encryption operations and other processing on the basis of initial user identity feature information, and has high security.

[0203] In some embodiments, to ensure the privacy of the encrypted identity information, the step of "generating the encrypted identity information based on the encrypted identity feature information, the encryption identifier, and the device identifier" may include the following operations:

[0204] Determine a preset structure for storing information, the preset structure including: a first identification field, a characteristic field, and a second identification field;

[0205] Writing the encrypted identity feature information into the feature field, writing the encryption identifier into the first identifier field, and writing the device identifier into the second identifier field to generate a target structure after storing the information;

[0206] Get encrypted identity information based on the target structure.

[0207] The definition of the structure has been described in the previous embodiment, so please refer to that embodiment. Therefore, the preset structure refers to a preset data set used to store multiple data items of encrypted identity information. The target structure refers to a data set that stores multiple data items of encrypted identity information. The target structure can be a representation of the encrypted identity information.

[0208] The encrypted identity information includes the following: encrypted identity feature information, an encrypted identifier, and a device identifier. Therefore, the encrypted identity information includes at least three types of data. Therefore, at least three fields can be set in the preset structure to store different data.

[0209] For example, a preset structure may include: a first identification field, a second identification field, and a characteristic field. The first identification field may be used to store a device identification, the second identification field may be used to store a device identification, and the encryption field may be used to store encrypted identity characteristic information. The encrypted identity characteristic information in the encrypted identity information is then written into the characteristic field, the encrypted identification in the encrypted identity information is written into the first identification field, and the device identification in the encrypted identity information is written into the second identification field, thereby generating a target structure storing the encrypted identity information. This target structure may represent the encrypted identity information.

[0210] 205. Perform user identity authentication based on the encrypted identity information.

[0211] When the target terminal encrypts the user's identity feature information and obtains the encrypted identity information, the encrypted identity information can be used in a variety of identity authentication application scenarios, such as payment scenarios, withdrawal scenarios, access control scenarios, etc.

[0212] In actual application scenarios, before using encrypted identity information for user authentication, the target device needs to send the encrypted identity information to the verification end (the verification end can be a server or other verification device). The verification device then verifies the encrypted identity information and obtains the user authentication result. The target device can send the encrypted identity information to the verification end in various ways, such as through near-field communication, wireless network, or Bluetooth.

[0213] In some embodiments, to ensure data transmission security, the target terminal may send the encrypted identity information to the verification end device for verification via near-field communication. The step of "performing user identity authentication based on the encrypted identity information" may include the following operations:

[0214] activating a near field communication function of the target device and broadcasting a communication signal through the near field communication function of the target device;

[0215] receiving a response signal from the responding device in response to the communication signal, and establishing a communication connection with the responding device based on the response signal;

[0216] The encrypted identity information is sent to the responding device for verification.

[0217] Near Field Communication (NFC) is a short-range, high-frequency radio technology that operates at a frequency of 13.56 MHz within a distance of 20 cm. NFC uses both active and passive reading modes. NFC technology evolved from the integration of contactless radio frequency identification (RFID) and interoperability technologies. It combines the functions of an inductive reader, inductive card, and peer-to-peer communication on a single chip, enabling identification and data exchange with compatible devices over short distances. It provides a wireless connection technology that allows for easy, secure, and fast communication. Compared to other wireless connection methods, NFC is a close-range, private communication method.

[0218] For example, the target device may be equipped with an NFC chip to implement near field communication (NFC) functionality. NFC chips have both intercommunication capabilities and computing capabilities.

[0219] The responding device refers to a device that is in communication with the target device and receives the encrypted identity information sent by the target device. The responding device may also be provided with an NFC chip to complete the communication function with the target device through the NFC chip.

[0220] For example, when the target terminal is close to the responding device, the NFC communication function can be activated to send a communication signal to the responding device. After receiving the communication signal from the target device, the responding device can respond to the communication signal, that is, feedback the response signal to the target device, and thus establish an NFC connection between the target device and the responding device.

[0221] After the target device establishes a communication connection with the responding device, data transmission can be performed through the peer-to-peer mode in NFC technology.

[0222] Peer-to-peer mode can be used for data exchange, but it has a shorter transmission distance, faster transmission creation speed, and lower power consumption. Linking two NFC-enabled devices enables peer-to-peer data transfer, such as downloading music, exchanging pictures, or synchronizing device address books. Therefore, devices can exchange information or services using NFC peer-to-peer mode.

[0223] For example, a target terminal activates NFC communication and acts as the NFC initiator (master), providing a radio frequency field throughout the communication process with the responding device. As the master, the target device selects the transmission speed and then sends data (i.e., encrypted identity information) to the responding device. After receiving the encrypted identity information from the target device, the responding device can perform authentication. For details on authentication, see the previous embodiment.

[0224] The embodiment of the present application discloses an identity authentication method, which includes: obtaining the device identification of the target device, user identity feature information, and public key information for encrypting the user identity feature information; encrypting the user identity feature information according to the public key information to obtain the encrypted identity feature information; obtaining the number of historical encryptions, and determining the encryption identifier corresponding to the encryption processing according to the value of the historical encryption number, wherein the historical encryption number is the number of times the user identity feature information is encrypted before the encryption processing; generating encrypted identity information according to the encrypted identity feature information, the encryption identifier and the device identification; and performing user identity authentication based on the encrypted identity information. In this way, the user identity feature information is encrypted by the public key information assigned by the server, and the encryption identifier corresponding to the encryption operation is generated. Then, the encrypted identity information is obtained according to the encrypted identity feature information, the encryption identifier and the device identification component data structure, which can ensure the privacy of the user identity feature information. At the same time, it enriches the functions of the offline face recognition terminal and improves the adaptability and experience of offline users.

[0225] like Figure 4 As shown, Figure 4 This is a flow chart of another authentication method provided by an embodiment of the present application. Taking the interaction between a payment device, a payment device, and a server as an example, an authentication method is provided that can be applied to payment scenarios. The specific process is as follows:

[0226] 301. When receiving a payment instruction, obtain the user's encrypted identity information.

[0227] The payment instruction instructs the payment device to execute a payment function. The payment device may be installed with application software, which can be used to complete the payment function of the payment device.

[0228] For example, the application software may be a payment software, and the user may trigger a payment instruction by operating the payment software.

[0229] The encrypted identity information refers to user identity information stored in the payment device, which can be used to verify the user's identity during payment operations. This encrypted identity information can be stored in the payment device's memory in the form of a structure and may include: an encryption identifier, a device identifier of the payment device, and encrypted identity feature information. Specifically, the encryption identifier, device identifier, and encrypted identity feature information have been described in the above embodiments and can be referenced in the description of these embodiments.

[0230] For example, the obtained encrypted identity information of the user can be: {"2DFJFE632", "sn1", "1"}, where "2DFJFE632" refers to the encrypted identity feature information, "sn1" refers to the device identifier, and "1" refers to the encryption identifier.

[0231] In some embodiments, in order to ensure the security of user identity information, the payment device can store the encrypted identity information in the SE chip. After receiving the payment instruction, the payment device can read the encrypted identity information from the SE chip.

[0232] Since the SE chip can also perform encryption and decryption operations, the payment device can also store user identity feature information in the SE chip, and encrypt the user identity feature information through the SE chip to obtain the encrypted identity feature information. In the embodiment of the present application, the user identity feature information can be facial information.

[0233] When encrypting user identity features, asymmetric encryption can be used to ensure security. Asymmetric encryption algorithms require two keys: a public key and a private key. The public and private keys form a pair. If data is encrypted with the public key, it can only be decrypted with the corresponding private key; if data is encrypted with the private key, it can only be decrypted with the corresponding public key. Because encryption and decryption use two different keys, this algorithm is called an asymmetric encryption algorithm.

[0234] In the embodiment of the present application, the public key and the private key can be generated by the server according to the device identification of the payment device. The specific generation method can refer to the above embodiment. The server can then send the generated public key and private key to the payment device.

[0235] For example, the payment device can send a key distribution request to the server, which can carry the device identification of the payment device. When the server receives the key distribution request, it can obtain the device identification of the payment device, and then generate the public key and private key corresponding to the device identification, and then return the public key and private key to the payment device.

[0236] The encryption operation of the user identity feature information may be performed before the terminal receives the payment instruction, thereby improving payment efficiency.

[0237] For example, before receiving a payment instruction, a user can launch payment software and use a camera to capture facial information. By performing feature extraction and other operations on the captured facial information through an algorithm, a storable string, such as "1F3D3RT44," can be generated. This string can then represent the initial user identity information.

[0238] Furthermore, the initial user identity feature information is written into the SE chip, and the initial user identity feature information is encrypted in the SE chip to obtain encrypted identity feature information, such as "2DFJFE632".

[0239] 302. Activate the near field communication function and send the encrypted identity information to the payment device.

[0240] In an embodiment of the present application, in order to ensure the security of data transmission, data transmission can be performed through near field communication (NFC). The payment device can be provided with an NFC chip, and the NFC function is activated through the NFC chip.

[0241] Correspondingly, the payment device communicating with the payment device may also be provided with an NFC chip. The payment device and the payment device establish a communication connection by activating their respective NFC chips, and then the payment device sends the encrypted identity information to the payment device via the near field communication connection.

[0242] 303. Receive the encrypted identity information sent by the payment device, and send the encrypted identity information to the server.

[0243] In some embodiments, to improve the security of identity authentication, identity authentication operations can be centralized on the server side. Thus, after receiving the encrypted identity information from the payment device, the payment device can send an identity authentication request to the server, which carries the encrypted identity information, so that the server can verify the encrypted identity information.

[0244] 304. Parse the encrypted identity information to obtain the encryption identifier, device identifier, and encrypted identity feature information.

[0245] Here, parsing the encrypted identity information is to extract different data from the encrypted identity information to obtain different contents in the encrypted identity information.

[0246] For example, the encrypted identity information received by the server may be: {"2DFJFE632", "sn1", "1"}. The server then extracts "2DFJFE632" from the encrypted identity information to obtain the encrypted identity feature information, extracts "sn1" to obtain the device identifier, and extracts "1" to obtain the encrypted identifier.

[0247] 305. Determine whether the encrypted identifier meets the preset verification conditions.

[0248] Among them, the preset verification conditions are used to verify the encrypted identifier. If the verification is successful, the next verification operation can be performed. By performing multiple verifications on the encrypted identity information, the security of identity authentication can be improved.

[0249] Specifically, the encryption identifier may indicate the number of encryptions corresponding to the encrypted identity feature information in the encrypted identity information. For example, when the payment device performs an encryption operation on the initial user identity feature information for the first time to obtain the encrypted identity feature information, the encryption identifier may be "1".

[0250] Among them, the preset verification condition refers to the encryption identifier being valid for one time.

[0251] For example, when the server receives the encrypted identity information for the first time and parses the encrypted identifier as “1”, it can be determined that the encrypted identifier meets the preset verification condition, and step 306 can be executed.

[0252] For example, when the server receives the encrypted identity information for the second time and the parsed encryption identifier is "1", and then the server obtains that the encryption identifier parsed from other encrypted identity information before this parsing operation also contained "1", then the server can determine that the current encryption identifier does not meet the preset verification conditions, that is, the verification fails, and step 309 can be executed.

[0253] 306. Obtain private key information corresponding to the device identifier, and decrypt the encrypted identity feature information according to the private key information to obtain decrypted identity feature information.

[0254] The private key information, also known as the private key, is mentioned in the above steps. The server can generate a public key and a private key corresponding to the device ID of the payment device based on the device ID of the payment device. The server can also store the generated public key and private key corresponding to the device ID. The encrypted identity feature information corresponding to the device ID can then be decrypted using the public key and the private key to obtain the decrypted identity feature information.

[0255] Specifically, the operation of decrypting the encrypted identity feature information according to the private key information has been described in the above embodiment and will not be elaborated here.

[0256] For example, the server parses the encrypted identity information and obtains the encrypted identity feature information as "2DFJFE632", and then decrypts the encrypted identity feature information according to the private key information corresponding to the stored device identification, and the decrypted identity feature information can be "1F3D3RT44".

[0257] 307. Determine whether the decrypted identity feature information is the preset identity feature information.

[0258] The preset identity feature information refers to the initial user identity feature information pre-stored in the server by the payment device.

[0259] For example, the decrypted identity feature information may be "1F3D3RT44", and the preset identity feature information may be "1F3D3RT44". By matching the decrypted identity feature with the preset identity feature information, it can be determined that the decrypted identity feature is the same as the preset identity feature information, and then step 308 can be executed.

[0260] For another example, the decrypted identity feature information may be "1F3D3RT44" and the preset identity feature information may be "8N3D3RT00". By matching the decrypted identity feature with the preset identity feature information, it can be determined that the decrypted identity feature is different from the preset identity feature information, and then step 309 can be executed.

[0261] 308. Obtain the account information bound to the user identity information and perform a payment operation on the account information.

[0262] The account information refers to the user account number used for payment, for example, the account information may be a bank card number, etc.

[0263] When the decrypted identity feature information successfully matches the preset identity feature information, it can be said that the user identity verification is successful. At this time, the payment device can obtain the account information bound to the user identity information in the payment device.

[0264] For example, the account information bound to the user identity information may be: payment account A, and then the payment device can receive payment from the payment account A.

[0265] 309. Generate a prompt message indicating that the identity information verification has failed, and send the prompt message to the payment device.

[0266] If the decrypted identity information fails to match the preset identity information, it may indicate that the user's identity authentication has failed. In this case, to ensure the security of the user's account information, the server may generate a prompt message to inform the user of the identity authentication failure. For example, the prompt message may contain "Authentication failed, please recheck!"

[0267] The embodiment of the present application discloses an identity authentication method, which includes: when a payment device receives a payment instruction, obtaining the user's encrypted identity information, then activating a near-field communication function, and sending the encrypted identity information to a payment receiving device; after receiving the encrypted identity information sent by the payment device, the payment receiving device sends the encrypted identity information to a server; the server parses the encrypted identity information to obtain an encryption identifier, a device identifier, and encrypted identity feature information, and determines whether the encryption identifier meets a preset verification condition; if the encryption identifier meets the preset verification condition, obtaining the private key information corresponding to the device identifier, performing a decryption operation on the encrypted identity feature information according to the private key information, obtaining the decrypted identity feature information, and then determining whether the decrypted identity feature information is the preset identity feature information; if the decrypted identity feature information is the preset identity feature information, the verification is successful, and the payment receiving device can obtain the account information bound to the user's identity information and perform a payment operation on the account information. In this way, while ensuring the security of the user's identity information, the security of the user's account information is also guaranteed.

[0268] To facilitate better implementation of the identity authentication method provided in the embodiment of the present application, the embodiment of the present application also provides an identity authentication device based on the above identity authentication method. The meanings of the terms are the same as those in the above identity authentication method, and the specific implementation details can be referred to the description in the method embodiment.

[0269] See also Figure 5 , Figure 5 This is a structural block diagram of an identity authentication device provided in an embodiment of the present application, which includes:

[0270] The parsing unit 401 is used to receive the encrypted identity information sent by the target device and parse the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information and the device identifier of the target device;

[0271] The first acquiring unit 402 is configured to acquire private key information corresponding to the device identifier when the encryption identifier meets the preset identity authentication condition;

[0272] The decryption unit 403 is used to decrypt the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information;

[0273] The first verification unit 404 is used to verify the decrypted identity feature information to obtain a verification result of the encrypted identity information.

[0274] In some embodiments, the parsing unit 401 may include:

[0275] A first acquisition subunit is used to acquire a target structure in the encrypted identity information, where the target structure includes a first identification field, a feature field, and a second identification field;

[0276] The extraction subunit is used to extract the encryption identifier from the first identifier field, extract the encrypted identity feature information from the feature field, and extract the device identifier from the second identifier field.

[0277] In some embodiments, the first verification unit 402 may include:

[0278] The second obtaining subunit is configured to obtain user identity feature information corresponding to the device identifier from a preset identity information database, wherein the preset identity information database includes sample user identity feature information corresponding to the sample device identifier;

[0279] A matching subunit, configured to match the decrypted identity feature information with the user identity feature information;

[0280] A first determining subunit is configured to determine that the encrypted identity information verification is successful if the decrypted identity feature information matches the user identity feature information;

[0281] The second determining subunit is configured to determine that the encrypted identity information verification fails if the decrypted identity feature information fails to match the user identity feature information.

[0282] In some embodiments, the apparatus may further comprise:

[0283] A third obtaining unit is configured to obtain a number of historical decryption operations corresponding to the device identifier to obtain a first value, wherein the number of historical decryption operations is the number of decryption operations performed on the encrypted identity feature information corresponding to the device identifier before the decryption process;

[0284] a comparing unit, configured to obtain a second value for verifying the encryption identifier based on the value of the encryption identifier, and compare the first value with the second value;

[0285] The second determining unit is configured to determine that the encryption identifier meets a preset identity authentication condition if the first value is less than the second value.

[0286] In some embodiments, the apparatus may further comprise:

[0287] A first receiving unit is configured to receive a key distribution request sent by a target device, where the key distribution request carries a device identifier of the target device;

[0288] The third determining unit is configured to generate private key information corresponding to the device identification according to the device identification.

[0289] The embodiment of the present application discloses an identity authentication device, which receives the encrypted identity information sent by the target device through a parsing unit 401, and parses the encrypted identity information to obtain an encrypted identifier, encrypted identity feature information, and a device identifier of the target device; a first acquisition unit 402 obtains the private key information corresponding to the device identifier when the encrypted identifier meets the preset identity authentication conditions; a decryption unit 403 decrypts the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information; a first verification unit 404 verifies the decrypted identity feature information to obtain a verification result of the encrypted identity information. In this way, after receiving the encrypted identity information, the encrypted identity feature information, the encrypted identifier, and the device identifier are extracted from the encrypted identity information; when the encrypted identifier meets the preset identity authentication conditions, the encrypted identity feature information is decrypted according to the private key information corresponding to the device identifier, and then the identity feature information obtained after the decryption is verified to obtain an identity information verification result, which can improve the security of identity information verification.

[0290] See also Figure 6 , Figure 6 This is a structural block diagram of another identity authentication device provided in an embodiment of the present application, the device comprising:

[0291] The second acquisition unit 501 is used to obtain the device identification of the target device, user identity feature information, and public key information used to encrypt the user identity feature information;

[0292] The encryption unit 502 is used to encrypt the user identity feature information according to the public key information to obtain the encrypted identity feature information;

[0293] A first determining unit 503 is configured to obtain a historical number of encryptions and determine an encryption identifier corresponding to the encryption process based on the value of the historical number of encryptions, wherein the historical number of encryptions is the number of encryption operations performed on the user identity feature information before the encryption process;

[0294] A generating unit 504 is configured to generate encrypted identity information based on the encrypted identity feature information, the encryption identifier, and the device identifier of the target device;

[0295] The second verification unit 505 is configured to perform user identity verification based on the encrypted identity information.

[0296] In some embodiments, the generating unit 504 may include:

[0297] A third determining subunit is configured to determine a preset structure for storing information, the preset structure comprising: a first identification field, a characteristic field, and a second identification field;

[0298] A writing subunit, configured to write the encrypted identity feature information into the feature field, write the encryption identifier into the first identifier field, and write the device identifier into the second identifier field, thereby generating a target structure after storing the information;

[0299] Get subunit, used to get encrypted identity information based on target structure.

[0300] In some embodiments, the apparatus may further comprise:

[0301] A detection unit, configured to detect whether public key information exists in a target device;

[0302] a sending unit, configured to send a key distribution request if the target device does not have public key information, the key distribution request carrying a device identifier of the target device;

[0303] The second receiving unit is configured to receive the public key information returned in response to the key distribution request.

[0304] In some embodiments, the second verification unit 505 may include:

[0305] an initiator unit, configured to initiate a near field communication function of a target device and broadcast a communication signal via the near field communication function of the target device;

[0306] an establishing subunit, configured to receive a response signal from the responding device to the communication signal, and establish a communication connection with the responding device based on the response signal;

[0307] The verification subunit is used to send the encrypted identity information to the responding device to verify the encrypted identity information.

[0308] In some embodiments, the apparatus may further comprise:

[0309] The acquisition unit is used to acquire a user's facial image and perform feature extraction on the facial image to obtain the user's facial feature data;

[0310] The processing unit is used to serialize the facial feature data to obtain the user's identity feature information.

[0311] In some embodiments, the first determining unit 503 may include:

[0312] The calculation subunit is used to determine the sum of the numerical value of the number of historical encryption times and a preset numerical value, and generate an encryption identifier based on the sum.

[0313] The embodiment of the present application discloses an identity authentication device, wherein a second acquisition unit 501 acquires a device identifier of a target device, user identity feature information, and public key information for encrypting the user identity feature information; an encryption unit 502 encrypts the user identity feature information according to the public key information to obtain encrypted identity feature information; a first determination unit 503 acquires a historical number of encryptions and determines an encryption identifier corresponding to the encryption process according to the value of the historical number of encryptions, wherein the historical number of encryptions is the number of times the user identity feature information is encrypted before the encryption process; a generation unit 504 generates encrypted identity information according to the encrypted identity feature information, the encryption identifier, and the device identifier of the target device; and a second verification unit 505 performs user authentication based on the encrypted identity information. In this way, the user identity feature information is encrypted using the public key information assigned by the server, and an encryption identifier corresponding to the encryption operation is generated. Then, the encrypted identity information is obtained based on the encrypted identity feature information, the encryption identifier, and the device identifier component data structure, thereby ensuring the privacy of the user identity feature information.

[0314] The embodiment of the present application also provides a computer device, which may be a terminal. Figure 7 As shown, the terminal may include components such as a radio frequency (RF) circuit 601, a memory 602 including one or more storage media, an input unit 603, a display unit 604, a sensor 605, an audio circuit 606, a wireless fidelity (WiFi) module 607, a processor 608 including one or more processing cores, and a power supply 609. It will be understood by those skilled in the art that Figure 7 The terminal structure shown in the figure does not constitute a limitation on the terminal, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0315] RF circuit 601 is used for signal reception and transmission during the information transmission and reception process. Specifically, it receives downlink information from the base station and transmits it to one or more processors 608 for processing. It also transmits uplink data to the base station. Typically, RF circuit 601 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, and so on. RF circuit 601 can also communicate with the network and other devices via wireless communication.

[0316] Memory 602 can be used to store software programs and modules. Processor 608 executes various functional applications and data processing by running the software programs and modules stored in memory 602. Memory 602 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.). Furthermore, memory 602 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory 602 may also include a memory controller to provide access to memory 602 by processor 608 and input unit 603.

[0317] The input unit 603 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, in a specific embodiment, the input unit 603 may include a touch-sensitive surface and other input devices. The touch-sensitive surface, also known as a touch display or touchpad, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or near the touch-sensitive surface) and drive the corresponding connected device according to a pre-set program. In addition to the touch-sensitive surface, the input unit 603 may also include other input devices. Specifically, other input devices may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, etc.

[0318] The display unit 604 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the server. These graphical user interfaces can be composed of graphics, text, icons, videos and any combination thereof. The display unit 604 may include a display panel. Optionally, the display panel can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch-sensitive surface can cover the display panel. When the touch-sensitive surface detects a touch operation on or near it, it is transmitted to the processor 608 to determine the type of touch event. The processor 608 then provides corresponding visual output on the display panel according to the type of touch event. Although in Figure 7 In the embodiment, the touch-sensitive surface and the display panel are used as two independent components to realize input and output functions, but in some embodiments, the touch-sensitive surface and the display panel can be integrated to realize input and output functions.

[0319] The terminal may also include at least one sensor 605, such as a light sensor, a motion sensor, or other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor may adjust the brightness of the display panel according to the brightness of the ambient light, and the proximity sensor may turn off the display panel and backlight when the server is moved to the ear.

[0320] Audio circuit 606, speakers, and microphones provide an audio interface between the user and the server. Audio circuit 606 converts received audio data into electrical signals and transmits them to the speaker, which then converts them into sound signals for output. Conversely, the microphone converts collected sound signals into electrical signals, which are then received by audio circuit 606 and converted into audio data. The audio data is then processed by output processor 608 and transmitted via RF circuit 601 to, for example, a terminal. Alternatively, the audio data is output to memory 602 for further processing. Audio circuit 606 may also include an earphone jack to allow external headphones to communicate with the server.

[0321] WiFi is a short-range wireless transmission technology. The terminal can help users send and receive emails, browse web pages and access streaming media through the WiFi module 607. It provides users with wireless broadband Internet access. Figure 7 A WiFi module 607 is shown, but it is understandable that it is not an essential component of the terminal and can be omitted as needed without changing the essence of the application.

[0322] Processor 608 is the terminal's control center, connecting all components of the phone using various interfaces and circuits. By running or executing software programs and modules stored in memory 602 and accessing data stored in memory 602, it executes various server functions and processes data, thereby performing overall phone testing. Optionally, processor 608 may include one or more processing cores; preferably, processor 608 may integrate an application processor and a modem processor, with the application processor primarily handling the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 608.

[0323] The terminal also includes a power supply 609 (e.g., a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 608 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. The power supply 609 can also include any of one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and other components.

[0324] Specifically, in this embodiment, the processor 608 in the terminal loads the executable files corresponding to one or more application processes into the memory 602 according to the following instructions, and the processor 608 runs the applications stored in the memory 602 to implement various functions:

[0325] Obtaining the target device's device identification, user identity feature information, and public key information used to encrypt the user identity feature information;

[0326] Encrypting the user's identity feature information according to the public key information to obtain encrypted identity feature information;

[0327] Obtaining the number of historical encryptions and determining an encryption identifier corresponding to the encryption process based on the number of historical encryptions, wherein the number of historical encryptions is the number of times the user identity feature information is encrypted before the encryption process;

[0328] Generate encrypted identity information based on the encrypted identity feature information, the encryption identifier, and the device identifier;

[0329] User authentication based on encrypted identity information.

[0330] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0331] As can be seen from the above, the terminal of this embodiment can implement the identity verification step, thereby improving the security of identity information verification.

[0332] The embodiment of the present application also provides a computer device, which can be a server, such as Figure 8 As shown, it shows a schematic diagram of the structure of the server involved in the embodiment of the present application, specifically:

[0333] The server may include one or more processing core processors 701, one or more computer-readable storage media memories 702, a power supply 703, an input unit 704 and other components. Those skilled in the art will appreciate that Figure 8 The server structure shown in the figure does not constitute a limitation on the server, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0334] Processor 701 is the server's control center, connecting various components of the server using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 702 and accessing data stored in memory 702, it performs various server functions and processes data, thereby performing overall server testing. Optionally, processor 701 may include one or more processing cores; preferably, processor 701 may integrate an application processor and a modem processor, with the application processor primarily processing the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 701.

[0335] Memory 702 can be used to store software programs and modules. Processor 501 executes various functional applications and data processing by running the software programs and modules stored in memory 702. Memory 702 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as sound playback or image playback); the data storage area may store data generated based on server usage. Furthermore, memory 702 may include high-speed random access memory (RAM) and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory 702 may also include a memory controller to provide processor 701 with access to memory 702.

[0336] The server also includes a power supply 703 for supplying power to various components. Preferably, the power supply 703 can be logically connected to the processor 701 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. The power supply 703 can also include one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and other arbitrary components.

[0337] The server may further include an input unit 704, which may be configured to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0338] Although not shown, the server may further include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 701 in the server will load the executable files corresponding to one or more application processes into the memory 702 according to the following instructions, and the processor 701 will run the application stored in the memory 702 to implement various functions as follows:

[0339] Receive the encrypted identity information sent by the target device, and parse the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information and the device identifier of the target device;

[0340] When the encryption identifier meets the preset identity authentication conditions, the private key information corresponding to the device identifier is obtained;

[0341] Decrypting the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information;

[0342] The decrypted identity feature information is verified to obtain a verification result of the encrypted identity information.

[0343] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0344] As can be seen from the above, the server of this embodiment can implement the identity verification step and improve the security of identity information verification.

[0345] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a storage medium and loaded and executed by a processor.

[0346] To this end, an embodiment of the present application provides a storage medium storing a plurality of instructions that can be loaded by a processor to execute the steps of any data processing method provided in an embodiment of the present application. For example, the instructions can execute the following steps:

[0347] Obtain the device identification, user identity feature information, and public key information used to encrypt the user identity feature information of the target device; encrypt the user identity feature information according to the public key information to obtain encrypted identity feature information; obtain the number of historical encryptions, and determine the encryption identifier corresponding to the encryption processing according to the value of the historical encryption number, wherein the historical encryption number is the number of encryption operations performed on the user identity feature information before the encryption processing; generate encrypted identity information according to the encrypted identity feature information, the encryption identifier, and the device identification; and perform user authentication based on the encrypted identity information.

[0348] or,

[0349] Receive the encrypted identity information sent by the target device, and parse the encrypted identity information to obtain the encrypted identifier, encrypted identity feature information and the device identifier of the target device; when the encrypted identifier meets the preset identity authentication conditions, obtain the private key information corresponding to the device identifier; decrypt the encrypted identity feature information according to the private key information to obtain the decrypted identity feature information; verify the decrypted identity feature information to obtain the verification result of the encrypted identity information.

[0350] The specific implementation of the above operations can be found in the previous embodiments and will not be repeated here.

[0351] The storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0352] Since the instructions stored in the storage medium can execute the steps in any identity authentication method provided in the embodiments of the present application, the beneficial effects that can be achieved by any identity authentication method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0353] Embodiments of the present application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a terminal reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the terminal to perform the identity authentication method provided in various optional implementations of the above aspects.

[0354] The above is a detailed introduction to the identity authentication method, device, computer equipment and storage medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An identity authentication method, characterized in that: The method comprises: Receiving the encrypted identity information sent by the target device, and parsing the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information, and the device identifier of the target device; When the encryption identifier meets the preset identity authentication condition, obtaining the private key information corresponding to the device identifier; Decrypting the encrypted identity feature information according to the private key information to obtain decrypted identity feature information; Verifying the decrypted identity feature information to obtain a verification result of the encrypted identity information; Determining whether the encrypted identifier meets a preset identity authentication condition includes: obtaining a historical decryption count corresponding to the device identifier to obtain a first value, wherein the historical decryption count is the number of decryption operations performed on the encrypted identity feature information corresponding to the device identifier before the decryption process; Based on the value of the encryption identifier, obtaining a second value for verifying the encryption identifier, and comparing the first value with the second value; If the first value is less than the second value, it is determined that the encryption identifier meets the preset identity authentication condition; The encryption identifier is the number of times the user identity feature information is encrypted.

2. The method according to claim 1, characterized in that The parsing of the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information, and the device identifier of the target device includes: Obtaining a target structure in the encrypted identity information, the target structure comprising a first identification field, a feature field, and a second identification field; The encryption identifier is extracted from the first identifier field, the encrypted identity feature information is extracted from the feature field, and the device identifier is extracted from the second identifier field.

3. The method according to claim 1, characterized in that The verifying process on the decrypted identity feature information to obtain a verification result of the encrypted identity information includes: Obtaining user identity feature information corresponding to the device identifier from a preset identity information database, wherein the preset identity information database includes sample user identity feature information corresponding to sample device identifiers; Matching the decrypted identity feature information with the user identity feature information corresponding to the device identifier; If the decrypted identity feature information successfully matches the user identity feature information corresponding to the device identifier, it is determined that the encrypted identity information is successfully authenticated; If the decrypted identity feature information fails to match the user identity feature information corresponding to the device identifier, it is determined that the encrypted identity information verification has failed.

4. The method according to claim 1, wherein Before obtaining the private key information corresponding to the device identifier, the method further includes: receiving a key distribution request sent by a target device, wherein the key distribution request carries a device identification of the target device; Generate private key information corresponding to the device identification according to the device identification.

5. An identity verification device, characterized in that: The device comprises: a parsing unit, configured to receive the encrypted identity information sent by the target device, and parse the encrypted identity information to obtain the encrypted identifier, the encrypted identity feature information, and the device identifier of the target device; A first acquiring unit, configured to acquire private key information corresponding to the device identifier when the encryption identifier meets a preset identity authentication condition; a decryption unit, configured to decrypt the encrypted identity feature information according to the private key information to obtain decrypted identity feature information; a first verification unit, configured to verify the decrypted identity feature information to obtain a verification result of the encrypted identity information; Determining whether the encrypted identifier meets a preset identity authentication condition includes: obtaining a historical decryption count corresponding to the device identifier to obtain a first value, wherein the historical decryption count is the number of decryption operations performed on the encrypted identity feature information corresponding to the device identifier before the decryption process; Based on the value of the encryption identifier, obtaining a second value for verifying the encryption identifier, and comparing the first value with the second value; If the first value is less than the second value, it is determined that the encryption identifier meets the preset identity authentication condition; The encryption identifier is the number of times the user identity feature information is encrypted.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the identity authentication method according to any one of claims 1 to 4 is implemented.

7. A computer storage medium, characterized in that The storage medium stores a plurality of instructions, which are suitable for loading by a processor to execute the identity authentication method according to any one of claims 1 to 4.

Images